{ "Event": { "published": true, "date": "2021-05-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-20", "timestamp": 1621555382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3809d7f5-24cb-46c6-a37a-cd6109f88050", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8970a2-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533057, "uuid": "be2d8169-8340-4374-9f54-63c026d3674f", "comment": "Malware payload (Dridex)", "value": "7d79a27e7b801838bdce9c7940fb68ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533057, "uuid": "dff18e6e-fc40-4166-b347-cdb2ecbbf613", "comment": "Malware payload (Dridex)", "value": "006c93f23fceafa1af2647324886544430f3c55df538423e05c40dd4299b74b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533057, "uuid": "6dbc1efc-15aa-41a4-a73a-6c99169a4433", "comment": "Malware payload (Dridex)", "value": "5230ce66684d26d56942e08f62a5a7113747f1d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533057, "uuid": "4e553ca0-04d5-4b31-9c4d-b84007473fde", "comment": "Malware payload (Dridex)", "value": "825dd073387cf2a35c73f9e1f6daa662e8d90be8eb7086d322b4e5b3982a4117eadeb42644d1002739e6263f8e8dea28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533057, "uuid": "7d567e08-86f1-4f45-aaf7-24f49ea324bc", "value": "1404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533057, "uuid": "58c8d5ee-ddef-4723-b0a3-c20329f2a815", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533057, "uuid": "f5a58913-8918-4a57-b6fe-fa44a8d2ffc5", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533057, "uuid": "79f31e25-d0e8-4560-a694-552238526c86", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533057, "uuid": "04dced5b-d044-4fea-ba6d-f172bfa986b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533057, "uuid": "6b4ba0de-c3d7-424d-b3a1-a968073c0413", "value": "7d79a27e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23548002-b931-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490626, "uuid": "e2922d1e-b3c6-4b33-a044-9de4108d8968", "comment": "Malware payload (Dridex)", "value": "c353fb50701dd74447c341108a6baa4d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490626, "uuid": "a14bf3c9-2390-44d5-b91c-082d76632952", "comment": "Malware payload (Dridex)", "value": "00c8be876c851d8a926f62fa61b645449fcc6e99a9c68f9dd22ef6beb4a4ce14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490626, "uuid": "3b8133d0-6f61-41b0-b6be-e83a3359ad0e", "comment": "Malware payload (Dridex)", "value": "25845b86cbdec12565bdba32530b0381a3fe8418", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490626, "uuid": "4da23153-9147-4de6-8d23-d8139015a3fb", "comment": "Malware payload (Dridex)", "value": "1c25f57a4437e94d3a63159fd295232baf196013eefa55be61394592297251a0d10533ae3ccd64dc414ff871e16f8dde", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490626, "uuid": "79460800-aaad-4abc-af07-f333c42f8707", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490626, "uuid": "5dbab492-af6a-4633-bd50-81701268113b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490626, "uuid": "e8b678ae-2e1a-48e7-8a85-47bd6ef2b90f", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490626, "uuid": "740f0f3b-1bae-4364-8c01-dd3cea0d5cf5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490626, "uuid": "58275438-735e-4248-a852-497d828863ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490626, "uuid": "d5312855-4c6f-4b8f-a029-9e8d9783911c", "value": "c353fb50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c784469-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527739, "uuid": "3a22cbc2-f737-4cf2-8e81-d214d2f8a991", "comment": "Malware payload (Dridex)", "value": "593cb1f7340692733c1cc033079b18a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527739, "uuid": "0b758290-8e5e-4c69-a507-b3ff2de65fd2", "comment": "Malware payload (Dridex)", "value": "01133770f72537943bc9aa7bf6a999d0bf7d69b9f4a7c53813e9d48ce2cc1938", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527739, "uuid": "15c45598-c0a8-4e51-8460-0594ab2dfc30", "comment": "Malware payload (Dridex)", "value": "db039cb96b2ce565b6b6812644614ce2fcbdd6c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527739, "uuid": "632491b7-cbf7-4ec7-8fb2-04045bd98566", "comment": "Malware payload (Dridex)", "value": "85af523f8af564b5f72b5b1dcd4e09aac722734c5f19b30283c12ef2a6008fa196ef7fc592b5f350f962c2748bade74b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527739, "uuid": "ab1077f3-8de3-4044-9c1f-49dad793233e", "value": "7804BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527739, "uuid": "cc319f66-dfcb-4958-8ecc-d6e73f6348d0", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527739, "uuid": "fef1ae8c-a2e7-4149-b32c-45cb37eee41c", "value": "3072:hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:hH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527739, "uuid": "f7051edb-b725-4cb8-b602-692d5bf741ff", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527739, "uuid": "fbdf177c-f94d-4fe1-bcd8-47f4076686c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527739, "uuid": "0ec0c5cb-3141-4cfb-ba21-cd44d6704b51", "value": "593cb1f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5f65b4-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539689, "uuid": "620b1a45-1dc2-4ab8-890e-77e8ab0a34c4", "comment": "Malware payload", "value": "47d81608034d73b01cc85c157466f9f3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539689, "uuid": "1f2d528f-70ba-435e-8202-a9d951266202", "comment": "Malware payload", "value": "012c1ab705184fa21a7c9f948f9f69972acaec97f4d3055ef4ad870995aaf918", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539689, "uuid": "6005cde5-1536-45ff-a31b-e732fba3010a", "comment": "Malware payload", "value": "7d9c852495b09fe790e012546c698230de50630d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539689, "uuid": "4132b259-39d7-4fa6-9a7b-7b926ff39c34", "comment": "Malware payload", "value": "a131d6eff28d51481b46701b290db32bf351a1b51d5502f41e6d67ce51d296a301b7a29951f580d9c20583e9c364dbbe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539689, "uuid": "8c606947-6c64-4fe7-9ec8-4ef58caf7c2a", "value": "ECF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539689, "uuid": "2b739908-45ce-443b-b27f-1c9cae94a15c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539689, "uuid": "769b9bc7-5f16-4259-8c10-392c45ce5c9c", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539689, "uuid": "a9dd108b-f651-4131-be40-a16ed1b4d3e2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539689, "uuid": "43367ee8-3076-44c9-95f8-ad86160b6fae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539689, "uuid": "fa42903c-c7cc-4273-8559-3a1d40f87f20", "value": "47d81608_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c46893-b965-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1621513207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513207, "uuid": "d6949701-039a-419f-8ae6-21a2f309bc6f", "comment": "Malware payload (OskiStealer)", "value": "c659765bca12e5c5532fd8b85b4793a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513207, "uuid": "4a45f527-f01d-49b7-b1b0-58449da782c9", "comment": "Malware payload (OskiStealer)", "value": "017c0459b56b7e178721e18438dc793bbf2cd6cfe14481716a62441efcda3f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513207, "uuid": "56963c77-2a9c-4761-bdf8-6b2f3b28e8bc", "comment": "Malware payload (OskiStealer)", "value": "f6c72b749ba83c5bd4442e8b490cdba941068546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513207, "uuid": "6e159a13-babd-45e6-86ad-05aa2f05cd2e", "comment": "Malware payload (OskiStealer)", "value": "f5ea348a186a5588e3973ba0fca64c138e5ae7c02bcd5f03083e2fa5209d60bb5aa7aa1ded798d1887860739221570e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513207, "uuid": "87240a01-fdbc-4c3f-adf6-67baa2c4d18b", "value": "B544126B36C8C53BDA23487118A3BE36FBB4E3F45A242217A7119F2D4C675464F151CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513207, "uuid": "914791d8-e396-4a48-9e98-fce6f101248f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513207, "uuid": "8118ece3-04d2-4d01-8d31-0e60e1b39571", "value": "6144:7shqSw+c9HW06wVUVacdog21IMhjcAvL7zxW:ythcf6WUVBdoFVhdzxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621513207, "uuid": "cbf2bdb0-feb7-4bf1-a313-e0c13629f80a", "value": 261194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621513207, "uuid": "94e32a2f-e152-4d2a-b327-9a12b3fc84ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513207, "uuid": "968aa909-09a1-4b02-b307-607fa2d4792d", "value": "RoomDeposit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3495cfb-b986-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527455, "uuid": "0c11b674-4498-47df-a9e0-660199807bc6", "comment": "Malware payload (Dridex)", "value": "e886edc7e5b51bc13a2cd13f2f57e9c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527455, "uuid": "e4c01981-b59b-4242-9dc0-b6c427fe77af", "comment": "Malware payload (Dridex)", "value": "017d73349c877daa293950117a49d329b7ce27d8b837e9fe15e1aeb46cb85f29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527455, "uuid": "3300ff0b-d693-41f3-9239-89f237b898a9", "comment": "Malware payload (Dridex)", "value": "dde1fab85e4601c45877a6d02e93f032e0065754", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527455, "uuid": "dc1f3ec1-fe00-4884-9754-668df1d77bdc", "comment": "Malware payload (Dridex)", "value": "392b002c71dc3d4920d4fb02be4ca52db275f38391e93d433928c1e67a330db30e4cb01c94bc1d084349a88759e8b665", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527455, "uuid": "3429232c-ae63-4af3-8e95-2d957e99cba4", "value": "A304B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527455, "uuid": "80f304b0-d796-41b8-8acf-0a144d47139e", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527455, "uuid": "d03625c6-72e9-408a-a787-34c973df2953", "value": "3072:YWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:YWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527455, "uuid": "848bcfdd-7f21-44b3-9fd9-fe83de2d01c2", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527455, "uuid": "232c557c-8d4d-47ff-9f3e-bf80aa2be5d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527455, "uuid": "6531a3db-fe43-4783-80e5-df60fecca648", "value": "e886edc7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01370f0-b9be-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621551421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551421, "uuid": "d5160e30-1e80-475d-aa80-f48b03804e2c", "comment": "Malware payload", "value": "e9591592ab74c215938bd3afb954d586", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551421, "uuid": "a9aad526-69aa-4b7f-8a13-a182ee732813", "comment": "Malware payload", "value": "01bd9c3404ecad3c797b2b4fc6194b947c15985e8899e6a0d2085c490ea4112d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551421, "uuid": "c62c5efa-091a-474d-b30d-72b14f436bf0", "comment": "Malware payload", "value": "eae69f9ea3af8320a02586a86223a458f656f41c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551421, "uuid": "907c53cc-504d-4259-a3b9-7ef59856bd61", "comment": "Malware payload", "value": "475064bcb567cfb8b7d53b138daaf1ca773f8d74e6d153f26bc9a2504eabe8929821f5a157f40167ab161aed590fa3ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551421, "uuid": "988a04d4-6ffe-46f7-93c9-acb2a6ab6c95", "value": "6304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551421, "uuid": "d84f6325-34e9-4f7f-8ec7-856ec71fb718", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551421, "uuid": "026c1aa7-0bf0-43cf-9586-20fc2e68402b", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621551421, "uuid": "11753bf8-e0eb-4873-a5d9-45fc5e472e41", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621551421, "uuid": "d9ab145f-64bb-41d5-ab94-905b798ae8a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551421, "uuid": "45032199-dca9-4d2a-838b-5728e5a2ed2e", "value": "e9591592_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b261f92-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621476090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476090, "uuid": "cceb14f8-4d92-4ac9-abf1-235b2c0f5e12", "comment": "Malware payload", "value": "23da3ba02bb388ea2667b6911ade49da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476090, "uuid": "c5d3efb3-ad35-42a2-92bc-99b34a024bcc", "comment": "Malware payload", "value": "01d1652e2a9c29ee2e4c55053778a240d2ac9f7d7340ddc2cc5ffcc3fbe1fcc9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476090, "uuid": "d426fac2-3a35-480b-a945-926bbd9529fa", "comment": "Malware payload", "value": "395d95b9e90bc09f882b4c50b2add95b08a26bc6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476090, "uuid": "68086d00-7f4d-4135-bed2-89f50ac593ac", "comment": "Malware payload", "value": "87fedce360fbc022ea41aabfb55123b6757a1aba606c00912997a9051ef6bd122d4ab87450159328331b60ec2b8b8627", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476090, "uuid": "f13f066c-3f37-47a3-b5b6-9f1b771230e8", "value": "E0D4234CC3BE649FD60B95BD426E368DF10274BA8F4A024ADEBD98C64E39458ED1CD1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476090, "uuid": "ed825b1f-7906-450c-a2e9-ad4951ba2966", "value": "12288:qVul1sxzSNnDhudeTtmAWujHMQn7yNQdOk7B5YrLk3F8BoFwS:ygaxSthuYoNIHXn7Bd3BOcV8BoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476090, "uuid": "1cef1dd9-0835-4f0b-ae7e-506f8e5cd8ad", "value": 622057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476090, "uuid": "5bd1b3c9-d06f-49f3-8197-4f03b11d4ad5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476090, "uuid": "7a13a450-7da8-4b66-944c-638ebae4fba1", "value": "23da3ba0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65f007f-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541553, "uuid": "da00b296-de0a-46e5-a9bb-062126b4cb7c", "comment": "Malware payload", "value": "a9a7f09a98ed53fa6ff8b2f72cb4582c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541553, "uuid": "6f5f97f1-8a36-4aa2-83b8-c88ca0f4ca14", "comment": "Malware payload", "value": "01fd38efd6b413c52b73ae4bdb563472a37a2ec440a8441a86ed11f4d8f4c5a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541553, "uuid": "62ab61e2-764c-45dd-a36e-1a66f201a92c", "comment": "Malware payload", "value": "f1e87f85f6fd3f365c65c41df4467f1e912bc7fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541553, "uuid": "527e3d6f-714c-4641-bbad-9cd45ae256ca", "comment": "Malware payload", "value": "bceef2d2913f38beeb02bfc5d52203f47a2ae6a7a475a5661d3d9dbae69eda3a7665c66ef28063b36ffc7281a22c193c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541553, "uuid": "1b2e3d47-830f-41c9-8dd3-3b1e85513bda", "value": "5B84AD5076D2A0B0D17286390E29DAE0073CBC659F658BDB37E41E9F9D3D6C26E31722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541553, "uuid": "3bd201f6-614b-4773-b33e-9b4aa146cae3", "value": "006f77d45bc6bf6904ce975747281afc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541553, "uuid": "26d6f0dc-08bd-4690-98a6-f118870761e3", "value": "6144:NAqX6GBMYdZdpfkmGjwSgF8H3V6Ucl65wdL5FczVN877v4FOH/:N5qQdZrkmGs58H3k/o5wdL5OVN877aG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541553, "uuid": "86cd82f4-449e-4e87-b8c2-cf6131bf390f", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541553, "uuid": "abc160b3-df1f-4c80-8bf3-d37166f3d825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541553, "uuid": "eb2137d5-227b-487e-9561-3d06982f4850", "value": "a9a7f09a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bd195d-b9bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550256, "uuid": "2a1cc15b-7400-46d0-b8be-112e2fbdcaac", "comment": "Malware payload", "value": "5d3b91da5df550aef5cb1b40887bd7a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550256, "uuid": "92197039-d091-40c8-826b-03ee8cca9ebb", "comment": "Malware payload", "value": "0226618832c8fc788a9bf21914b800716f49f89713b4e6c789c844744a09c5be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550256, "uuid": "38ae9fe6-16ff-4cd3-8d4b-0a85f04b7196", "comment": "Malware payload", "value": "469f142782349e9cacbaebeb108c8382db41f391", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550256, "uuid": "c396dc3c-d62d-488a-aaa1-93a6506e0686", "comment": "Malware payload", "value": "8561e427e2fae1bcb3c1ba49b39dd63db7bd5e22afacab49bccf1e1a906a14f0e1be8015383d036fa202b7cf95116421", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550256, "uuid": "c5508745-8cdf-46b7-b138-eae3360a4174", "value": "D204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550256, "uuid": "ed7327ec-9e8c-4727-8d51-1bca7b3fe5f6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550256, "uuid": "6e0d5fae-0ac1-43ea-9b31-d32b4590ccb2", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550256, "uuid": "2c00ea34-c91b-45fd-8b76-1aea4deac212", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550256, "uuid": "b2a9df4e-9ab7-4ebf-987e-992ed08e68d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550256, "uuid": "65225939-73a5-47c1-897a-181f43bd867c", "value": "5d3b91da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dfa872-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527966, "uuid": "02da27a6-ac21-487a-8c65-7f534c98c118", "comment": "Malware payload (Dridex)", "value": "c9cc4567a01c45a49ab22bffc6861b66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527966, "uuid": "8357d777-214b-4e4a-add7-b85eb63d1c9a", "comment": "Malware payload (Dridex)", "value": "0230101a57ea1e01971e730d881045168900d204c8f7214ca8e12e887be2465d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527966, "uuid": "4cd73189-804a-4342-8a03-9d0df511c7b7", "comment": "Malware payload (Dridex)", "value": "dff572e7a5ed0956354d12af8395b3bf9630e155", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527966, "uuid": "b8aeef38-ca44-47d8-836c-c0238bfc7edb", "comment": "Malware payload (Dridex)", "value": "df75ece4d7844474d7939b0649886d825fd6531fd945d64b98a23bad111969d8246eb322141d7f2b9b40801b554c9d96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527966, "uuid": "211a27b1-ce61-4a92-94cb-78254e82b730", "value": "F704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527966, "uuid": "a94cb244-d083-4231-9a21-c65b229500a1", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527966, "uuid": "8e4683c0-800a-40e9-8765-ffbc705bb754", "value": "3072:1i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:1H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527966, "uuid": "35459441-c0e6-4600-95b2-7b444aac787e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527966, "uuid": "d95c17bf-6502-4ec0-88c2-f42f1d99011c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527966, "uuid": "89cd4a56-e489-49e8-ab00-933153351421", "value": "c9cc4567_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225e7148-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527990, "uuid": "2565a74a-560b-4259-b5b3-5f80a5b1332c", "comment": "Malware payload (Dridex)", "value": "70b56562b4eef51b3ff0cd9e20594187", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527990, "uuid": "ba9c467a-e502-470d-877e-a3e6f8a95be0", "comment": "Malware payload (Dridex)", "value": "0263c2aa941acf0bb34978a2550ad802ace017ad98f8d7b0758db2635e6cf751", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527990, "uuid": "365aa58f-d25c-406b-815c-7526f0ccab13", "comment": "Malware payload (Dridex)", "value": "7cd44990559c7f0b62351f28235e05d9b9f6d524", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527990, "uuid": "1d22fbcd-b32d-4b3b-9181-ca8d971ecee4", "comment": "Malware payload (Dridex)", "value": "bffac44abab9973e0188e8ec8ab03bb885f57239a871d6e4f1f6e7ce3c8960c48e5d74c0ba8644ad40f098f332844cb2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527990, "uuid": "61a3c284-358f-4649-9767-f4e6c46dd74d", "value": "7704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527990, "uuid": "140c352b-eae7-4b1d-8ba2-181cff632ad1", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527990, "uuid": "12c3bf86-5af8-4013-80ea-51ebde2c33cc", "value": "3072:Hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:HH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527990, "uuid": "e6a778f1-ce1f-4f33-aabe-2409f31436ec", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527990, "uuid": "9fe071c3-80ce-4527-b5bf-0efbc9d11576", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527990, "uuid": "e632ef54-b854-4467-8f90-5bf6cf232e52", "value": "70b56562_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f89f149-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533193, "uuid": "244e5a09-801e-43f0-9ecf-49bbd36dac49", "comment": "Malware payload (Dridex)", "value": "82cf18b73b0ff21be577929566e2af89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533193, "uuid": "3f078bf9-19da-4321-834f-3796f0d28627", "comment": "Malware payload (Dridex)", "value": "02a5ce0483d7a17abd187daacbc5237f245cb8e20e5d9472e910f2b7833ee795", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533193, "uuid": "1ffab105-87e8-401d-bd0f-9b1e239796e1", "comment": "Malware payload (Dridex)", "value": "c725f1e82456704f3a4c997723eed84427a445ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533193, "uuid": "a38713ee-2688-4a92-a1a6-179080d6d59f", "comment": "Malware payload (Dridex)", "value": "a795f74b5eb3b0fa41b1d830e9cf749bc89397be36a93ad892ca23955b4c15d679eeeee95aba1949cc039f38104c6903", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533193, "uuid": "c6d90931-bcb9-4c8f-add7-ad195c09b012", "value": "CC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533193, "uuid": "d7a70281-8f28-4bf5-b16a-cceb50837e51", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533193, "uuid": "e7b73c8d-0d75-4a88-8e63-f57dc62a69fd", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533193, "uuid": "b4d15911-c8dd-42aa-9815-893e6109a405", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533193, "uuid": "1bd03966-24f5-47e5-a895-8f564944e39a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533193, "uuid": "e99ec579-e481-483f-9e21-40c333c7ca18", "value": "82cf18b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e66d85b-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544519, "uuid": "1f2e6619-67c4-454e-bd16-2dcc4632f6a0", "comment": "Malware payload", "value": "dfd5777bc49ad01eaeb479dc60eb1ed0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544519, "uuid": "0726c44b-c963-40bb-b342-a673ccf0230b", "comment": "Malware payload", "value": "03436fd45176f0cde449b96d1a97658a48f165bc3f5c7658f0494bb17a70675b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544519, "uuid": "bd40e833-d4c4-4a3d-941e-5c786ed9a32b", "comment": "Malware payload", "value": "a983d1cb770cacf6875f87f1f1a7a4c5cadac685", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544519, "uuid": "e72f9f87-e21d-47b9-ac6b-4b4575366890", "comment": "Malware payload", "value": "343569ee219bc7842462ac0a84f87e988997128444c3f6586e5b589fce1818dd69d163a58637a1863dec7375221e906d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544519, "uuid": "d8beaa04-fc8f-471b-8381-613d4a64da78", "value": "B404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544519, "uuid": "87d26484-2116-4e1a-8e83-3e7cd83001ad", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544519, "uuid": "96e42da8-325c-4caf-b2f1-e6d7f8e59b6b", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544519, "uuid": "58e4f314-bbbb-4008-a82b-562c7692d49c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544519, "uuid": "50a29844-6157-48a8-a52a-b14cebdb8390", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544519, "uuid": "d95dbf81-d3e2-4af7-a36f-99e5127e3c6b", "value": "dfd5777b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c4383a-b907-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472557, "uuid": "26a6a03f-b2ce-4263-9de1-b558b902038e", "comment": "Malware payload (Dridex)", "value": "1c658389b116176cb8fe986b58065991", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472557, "uuid": "8fd61547-64bc-44b2-9ca9-05f32bbf525f", "comment": "Malware payload (Dridex)", "value": "0346519fec274b1e9594e170c606a8f14d507b14995b51ccf9427b8e9e686d30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472557, "uuid": "4eafd8c8-b8db-41c6-a26b-0e741089d793", "comment": "Malware payload (Dridex)", "value": "11e343a9e59e0b255f910551b25f3066b7e68251", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472557, "uuid": "fd52cfe1-9e1d-4804-892d-c2fcb11946e4", "comment": "Malware payload (Dridex)", "value": "9d5b0ee369b5e87139776df7d417f18fb6fc21c19dde058f333a2aec85f98eb84aca18cd8db132b4694ff7bd8bdf66d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472557, "uuid": "37e16b52-fc79-4aed-af98-b60ec419eaca", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472557, "uuid": "31139a53-9787-4af8-86c2-f52e8bc97f9d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472557, "uuid": "b710ab1b-a824-43a3-94c7-6bb509d4cde5", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472557, "uuid": "85f19224-baf2-4f89-a352-c7005804f804", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472557, "uuid": "27957a61-1681-4249-a854-3e7c57e1e622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472557, "uuid": "88271458-7934-4bbe-9c66-1d578c9c41ea", "value": "1c658389_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a7230b-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528967, "uuid": "f935346f-197b-42db-9394-0eddd5c497db", "comment": "Malware payload (Dridex)", "value": "93b3341d57077b1b18209e3408259ffd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528967, "uuid": "df8b8351-1ee8-4da0-99c1-0b9323b0ff1c", "comment": "Malware payload (Dridex)", "value": "035d6070e5fe15ed3cffeedd2ec6690c5710b82af18ac51a0e01927cc58d53c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528967, "uuid": "4180f296-6403-413d-939b-3a567b3faec0", "comment": "Malware payload (Dridex)", "value": "9d6636e48f21ee8ac81067a9aa1687683dc93bc6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528967, "uuid": "9b48d8b0-6625-4432-bda7-1b375ca8e957", "comment": "Malware payload (Dridex)", "value": "ff214321f2e31dfd8aef5666c607501b3d88bfbbf0a31aa74b75adfa1981efd5038f183d33e4df99c8fc39dc484bfb94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528967, "uuid": "d724ec38-21eb-41d9-be9f-5e5690cab4ba", "value": "9D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528967, "uuid": "e9d79400-28f5-4a8e-98bc-3ddc2d77c357", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528967, "uuid": "879119db-015b-4f9a-94de-3aa204943327", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528967, "uuid": "2d9013e3-088e-40a4-8333-89585f70d20e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528967, "uuid": "a2d73a1d-3f5e-4737-b39c-8c177f9b7f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528967, "uuid": "1ec95110-ef2b-4113-86ef-db3849cb6e79", "value": "93b3341d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b503f09-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528972, "uuid": "4f70c29a-f1e8-4d66-b119-24ea20d833c7", "comment": "Malware payload (Dridex)", "value": "0f077b2ce4d5fb07f06d86c2e2bc54fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528972, "uuid": "96ee9938-320a-4091-b115-5406027bb9b7", "comment": "Malware payload (Dridex)", "value": "0368cdf41aba5dc6f873fb490f07842eb5d4043a08c80fa92267c339c66c39df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528972, "uuid": "288836c5-c299-4339-bee0-46429481a7f2", "comment": "Malware payload (Dridex)", "value": "491dee2e9865ea9266288a1f17cf28f8b59ad370", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528972, "uuid": "5ca069ff-a66e-44e8-8f43-62719c046c01", "comment": "Malware payload (Dridex)", "value": "cf7ba2197350c7b15c31e14b92ff653aa0071082bd27b3916beaf5f305faea1b09c2e4be4359643a9f83be6a57b7dc96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528972, "uuid": "5ec2f834-8373-4775-8bcc-3fe4d1235e18", "value": "D004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528972, "uuid": "b7c6a14b-7d12-42da-be31-5d8662e3ce5b", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528972, "uuid": "f7240a4d-4307-40a7-ab0d-5e84a60d8630", "value": "3072:bi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:bH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528972, "uuid": "dbcf5c4c-954d-4097-be8b-d3a8eb9b4d3e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528972, "uuid": "0a91668b-cb15-4534-b1fd-a8514d24aeea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528972, "uuid": "750ae1b4-44da-497a-b77a-3ab5d3686c50", "value": "0f077b2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e033f037-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524014, "uuid": "d5476106-a489-435c-b3c8-89510d15f8f3", "comment": "Malware payload (Dridex)", "value": "433981c756367b1d2796569efc80b609", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524014, "uuid": "325c1fe3-0cb2-48e8-8ed7-425fe8029f9d", "comment": "Malware payload (Dridex)", "value": "041b53676ceccbf24ce79672f474c9bcb52f944173b8acce9bbc0e2ff2480233", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524014, "uuid": "9046bcb5-b83f-4da3-9d09-28d85536b759", "comment": "Malware payload (Dridex)", "value": "ecc4ac25203df6689d7a85561e1cd5406418cd9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524014, "uuid": "9b1562bc-2566-41a6-bccc-50cf09ff3b64", "comment": "Malware payload (Dridex)", "value": "a46cf7fccf33d640e8e2539e4ddfb3bf5468394dc4676644585ae76e02b065c38644d67fa247e46ffb346859b6fdc8dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524014, "uuid": "142abc45-1498-40ba-b710-cca9c8b169d9", "value": "9D04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524014, "uuid": "f327f9d6-0b9f-4a01-acaa-d930b3503dc6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524014, "uuid": "98701a4d-f6d6-4caa-bd6d-596905dc87e8", "value": "3072:li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:lH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524014, "uuid": "bbc69f4b-25e8-488d-9a30-b7ef0069ad4c", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524014, "uuid": "031e279d-daca-434c-b824-3ae4786fe3a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524014, "uuid": "afcecb10-7202-4084-8780-ceaefd181693", "value": "433981c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfe92f8-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuasarRAT)", "timestamp": 1621523740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523740, "uuid": "4b326e18-8f31-445a-9cc2-23e42c1aac15", "comment": "Malware payload (QuasarRAT)", "value": "c153c7c1953de71bae7a27aa812cbe3f", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523740, "uuid": "7daad1ad-e5d3-496e-8d68-60200407ff48", "comment": "Malware payload (QuasarRAT)", "value": "041e611b0ba792d4d87d0be0a36bbc90448598e84b40f669b8fef3acdfee0eee", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523740, "uuid": "8924dcc0-8db3-402e-83f0-dffd239ea55e", "comment": "Malware payload (QuasarRAT)", "value": "f573d1f84715d7c0fefd12ea64bebba27e08a6a4", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523740, "uuid": "5cf4500d-cf20-4d55-9144-307f8098ff95", "comment": "Malware payload (QuasarRAT)", "value": "1cf7c7313e85b1643bea76a62cbc49e1a5f005a9cde43c51ac91519e3b496b510df835a131bea8af810c58142f2726f3", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523740, "uuid": "1ed78dbf-83ec-4524-8e06-c12473006ad7", "value": "F1A4CFD2F11085EDED6A177224271CA20A932CBEE6B5D15C71F936336FF72A3001A95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523740, "uuid": "9ff61ecc-cd88-499e-8fdc-f7f56ac40d03", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523740, "uuid": "b8906b3e-dff1-40e6-b822-05ebd08866fc", "value": "12288:NW0pyy1pDDShyZ25XUYoWFk0vlLmetEAJ:3py0pDBZ25/oGHoAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523740, "uuid": "52391b22-3e7a-48b1-8f0f-30632e280277", "value": 457878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523740, "uuid": "82a7c932-95ec-466e-9b13-53a8e6353f8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523740, "uuid": "b787d3f3-8705-4b3a-afed-a5cc7bf5d06f", "value": "TT09000000900000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e3048c-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529855, "uuid": "d7662eea-c1bc-4314-b9eb-2f27bd97ad08", "comment": "Malware payload (Dridex)", "value": "05ca07e6ff7d63b64052a95e933d2430", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529855, "uuid": "f473bb00-ddf2-420e-be0e-13fa7b861a48", "comment": "Malware payload (Dridex)", "value": "04265e1a10f8148f6f84baccc7d118e655fdd92985aebe9aeb474d223b200c67", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529855, "uuid": "cd86d479-886f-4524-94ec-d5c8049a950f", "comment": "Malware payload (Dridex)", "value": "411cd2640e6b946bfd0ae670ea40b342411e1b7c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529855, "uuid": "0cc7cb99-116b-4989-b7e5-e5ea269d7a90", "comment": "Malware payload (Dridex)", "value": "797e2208ab3fe92d0c52005be2932f2548ec0628e5ad95f9dd361101cae31f5aef4851afaab06022fd866cb3d371a2f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529855, "uuid": "5186aebb-809a-4c02-a1f8-417f05bece99", "value": "8104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529855, "uuid": "3f3ef1c3-f0d6-4ee0-946c-d06385c81227", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529855, "uuid": "c55a08c5-da26-464b-aa85-464276bc2fcf", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529855, "uuid": "e88e8f74-1083-4d57-833a-a612561ac9c1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529855, "uuid": "62d35c4a-b933-407e-821e-550b8caebbce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529855, "uuid": "c34e9c5f-a588-4e5d-af13-3685b73a3c2e", "value": "05ca07e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6121bf77-b93d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1621495883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495883, "uuid": "189235c7-1f5d-4824-a778-c381d9ab9f25", "comment": "Malware payload (Gozi)", "value": "453d7a64de34d33e2982bcd94881ba54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495883, "uuid": "a48f7647-d6b9-4a69-89fb-e8ee44761ba7", "comment": "Malware payload (Gozi)", "value": "044c5a1455380206a7a459bc8d4b52fce0f456bba6d78fdf506cadfd8ab0fd2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495883, "uuid": "9e04416f-31a7-4627-9e60-8d15b951cbdf", "comment": "Malware payload (Gozi)", "value": "6b62c0dc577de7fac4314cde99eb7487101c8566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495883, "uuid": "6bf65620-8d7e-48e5-875c-f07b78fce299", "comment": "Malware payload (Gozi)", "value": "316437efa99bdd61fbe76dd5edf20ee495eaab0507dadcfe8debfa5347af8f3848c186752fea65d7c1b7f0855e1a2880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495883, "uuid": "3275b182-c6da-4074-88df-f6df3b392769", "value": "2BD4B011F6A1C038F0B245B98A69D6F96B397D30AB2C55CB72C03FAF65701E19E31722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495883, "uuid": "f1318222-cadb-4773-8513-60bc57bd8911", "value": "e12ed5541cf30c166e89a8e03716fdc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495883, "uuid": "4fed3760-2e4a-4377-bafd-af1b295971a2", "value": "12288:L6vbjHSBI8bK+trc+zGTlGH/WeJwjFRK2j9Z:YyBlnrcWH/3ex5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621495883, "uuid": "6d99a992-6ff1-4f44-b6a0-36bfd6e72324", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621495883, "uuid": "84fb7156-5d57-4ce3-8ab6-a413eda7af90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495883, "uuid": "235028dd-2f98-4ef8-ab30-ab07caf04965", "value": "image24.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23774195-b932-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621491055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491055, "uuid": "6a9d5ef1-622b-4d73-86a8-dacef5594c20", "comment": "Malware payload (Dridex)", "value": "2b150aef09e61ce44b4a252e484c837c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491055, "uuid": "7f6b114a-3343-445c-b120-411612671578", "comment": "Malware payload (Dridex)", "value": "048bcd2e6ccaf5dff5c6129fb1037867858cae0ffa634828f0e74fff06d864ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491055, "uuid": "342f6875-2a8a-473b-8126-9f5a6d632050", "comment": "Malware payload (Dridex)", "value": "5f325950c22f3c543bfefce53877d0697f229eef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491055, "uuid": "336e3085-166e-4384-a675-9891660bf646", "comment": "Malware payload (Dridex)", "value": "3542859832f97401a385d3c8fc0f261fc9f832497c881e3a825e6679e1b99dbd7be122b11aba51fc1e4e55cdb8619d64", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491055, "uuid": "4483ce3b-6a5a-4c40-ab53-344564473334", "value": "55F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491055, "uuid": "6b1d4277-9b68-457c-9434-6e4dfbaecce9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491055, "uuid": "6146d545-93d2-4fed-91c9-1eb41c7f72b9", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621491055, "uuid": "f658a4fd-560e-455f-943b-34ca7b369395", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621491055, "uuid": "a52c2f21-140d-4665-93d6-e90c98aacf15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491055, "uuid": "de0da247-993d-4c25-8cd1-e122b687a92d", "value": "2b150aef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27cfedd-b943-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621498651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498651, "uuid": "cc2549c3-93d5-4363-8bdb-4098ffb52ad8", "comment": "Malware payload (Dridex)", "value": "38f954a907187c747d7f1702f6da2741", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498651, "uuid": "328355d2-b23e-42d4-b2a5-d5dc4183bfe8", "comment": "Malware payload (Dridex)", "value": "04dd8e6b8925c8492cfd1ba085048fc884d36f6b914745ae07ef491ae954948f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498651, "uuid": "b0198964-670b-4175-8b85-2e7d3f5c29b8", "comment": "Malware payload (Dridex)", "value": "7f44d8e7b3259aeca70f00e629710d200b8d0b59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498651, "uuid": "886cca25-7d9d-47f8-8174-9a08b2c16513", "comment": "Malware payload (Dridex)", "value": "7ee2b9498e735cdedc0eb7a376b888fe016cc05e39aeccf156e6b277cfd58ef76f3e2687c91d78bf19ea36e1161354e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498651, "uuid": "947d0e04-2504-40df-a5d7-5c381aa34254", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498651, "uuid": "fbcc6fc5-611d-4bfb-885e-cf9fb5a75bcb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498651, "uuid": "0e27e53c-00a7-418a-83a1-cc660d440f2d", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621498651, "uuid": "f93428ec-de88-4657-bd40-d8157f7af03c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621498651, "uuid": "61bcdf8b-e955-446f-94bf-76918a21e793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498651, "uuid": "1c36bcf4-77cf-4a5b-93ec-2940e0faca6b", "value": "38f954a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76faa580-b9b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545312, "uuid": "dcb8c86b-a827-4a7b-babd-b665f658a9e4", "comment": "Malware payload", "value": "12002ff13aa69ef41ecb79754bee05d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545312, "uuid": "44260387-123f-4877-a784-6c8d2f9b0c3c", "comment": "Malware payload", "value": "04e192ca3cbb8df14203194ae9a5a91a2185f0c24b521d68ea6327161197a885", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545312, "uuid": "7ab04f11-889d-4962-bbce-5f253ccb398b", "comment": "Malware payload", "value": "0580ca741be817c997ce6db3f21df2d41822d1fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545312, "uuid": "2613d998-41e6-4354-8b69-301d68f1861c", "comment": "Malware payload", "value": "089d8451946ab8c3e86fcc5eee0f99f5a5f1aa8f88b38074c80ceda09e097d955e4f7b33b94280ba37148994014e7e5b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545312, "uuid": "e46938d8-5bf6-4ef1-b760-73982fe3f849", "value": "2404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545312, "uuid": "538fcb17-9706-40f7-8764-ea06a360225d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545312, "uuid": "78cca6f1-ab5f-482d-80b8-c0bda7ea848f", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545312, "uuid": "7c0c8cf4-9598-493b-87e0-38519e9e9c61", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545312, "uuid": "fd991baa-179a-433b-877c-a6237670ed2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545312, "uuid": "eb7d0c1d-3fa0-4f1e-a148-4602a9fad00a", "value": "12002ff1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da558b3-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523473, "uuid": "bd385fd1-aea1-4d68-a3f3-01bb137bb627", "comment": "Malware payload (Dridex)", "value": "d919cabacb8d272ca0cb09ac3559abf6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523473, "uuid": "ad39b7a5-b5c3-48e2-8d5f-4e8aa325eb07", "comment": "Malware payload (Dridex)", "value": "050c9652e1f4786dd87855326fe2190473786aa5950742b528ed2a7881d9a356", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523473, "uuid": "2d7c8b42-9fa4-4c0c-a693-b429e61d5f5b", "comment": "Malware payload (Dridex)", "value": "bd0fe5c8162c76e2c4c4c17f09e8ad481360a2fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523473, "uuid": "77d8d0c6-1b69-44db-b6fd-7186ccfc97bf", "comment": "Malware payload (Dridex)", "value": "41e30702fac48bdbaefa42365d19ccfa9772abcb851205134437d51de88dd3b406899402ed6e2e8693f50399dc08242f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523473, "uuid": "10a85ef8-f521-489d-b683-646217700010", "value": "5304BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523473, "uuid": "63d98a56-cccf-4930-9fec-58bc01cfa89f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523473, "uuid": "640312a5-5455-489b-99d3-b13934600ea6", "value": "3072:4i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:4H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523473, "uuid": "5049d629-3c1d-4703-a8b0-c60e79281be0", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523473, "uuid": "24716429-38b1-40e0-baea-be61d9af1d28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523473, "uuid": "eaa2748e-b6ba-4705-94e4-720a4eeeba4d", "value": "d919caba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3159d678-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536605, "uuid": "61c0c86e-c2a6-4e60-a27f-b7477625ce84", "comment": "Malware payload (Dridex)", "value": "b2b587dced771eb688cb4e39647f04b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536605, "uuid": "69fbefba-cff4-434d-983a-02536613b562", "comment": "Malware payload (Dridex)", "value": "05515f5a14fe25f542b8f6bf88bb5f2c6f21cebc90886ab1c3cb45a70a6a458d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536605, "uuid": "8e75f8e6-a4b5-4c33-bc7b-9d1b37f73a71", "comment": "Malware payload (Dridex)", "value": "5032863992429199ad5ec6ce6d8828f8b28ae792", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536605, "uuid": "31881b0c-41dc-46ae-a5eb-077034895d28", "comment": "Malware payload (Dridex)", "value": "33b5f54503a4f3fe0f5a778019db64651c159436ce7950e57a10146b29f1b23db08789c690131e03e936b8dd923e70f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536605, "uuid": "f1dc0e0e-b434-434d-a8a6-84917a8cc9f7", "value": "F004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536605, "uuid": "2778f201-0eaa-40d7-a1cd-166111e7926f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536605, "uuid": "5cf677f7-eee5-41bf-80cf-e9d53da165d1", "value": "3072:yi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:yH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536605, "uuid": "8ea6f727-9a5a-4712-966a-8c46e517ba4f", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536605, "uuid": "234f24e5-1588-489e-898c-37c2e90437ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536605, "uuid": "1def4df5-de43-4dc5-8fff-4c742388e534", "value": "b2b587dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2962236-b941-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621497765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497765, "uuid": "f8e9e0e5-1d3b-4269-862f-45955145d54f", "comment": "Malware payload (Dridex)", "value": "af36952943dbcf385592c47a5d37bde9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497765, "uuid": "6efd7575-bc6b-41ba-b26e-db48fb33e47b", "comment": "Malware payload (Dridex)", "value": "055f6a48fd9bce4bfe0208adcfc2688e150cad0e621959f9440d9b92c65a82cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497765, "uuid": "471d033e-766e-488f-80c7-0bfba370e6d4", "comment": "Malware payload (Dridex)", "value": "b5680c0971ad6d9434a5f8c5ba4b7db146d34d48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497765, "uuid": "f15785ea-c453-40b9-9037-5e047a60a32b", "comment": "Malware payload (Dridex)", "value": "163ba42d6f78f05424778de94f2093300f8ed5e36f278253bf8c47481c8fb7aace092043c3b03e86feb9fb9023949ad2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497765, "uuid": "84f5eb82-7065-420d-bb94-83747f51d0c1", "value": "1904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497765, "uuid": "a72b75c9-9fcd-4562-aa51-18a70e9614e9", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497765, "uuid": "4fd2871c-b9e7-4d71-8c14-a0c87f10a435", "value": "3072:Pi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:PH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621497765, "uuid": "84063141-605a-44ba-ad12-0c7480cb1588", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621497765, "uuid": "7429b128-0857-4390-8ca2-b1af41bd8b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497765, "uuid": "58858c3a-d716-4baf-9007-3343fa802daa", "value": "af369529_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184b4291-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539570, "uuid": "36c45282-dc8f-4e63-9f81-80e75671df45", "comment": "Malware payload", "value": "87adc7381fa0aaa8fcf969573f1b4ed0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539570, "uuid": "f6b6d471-885b-4db5-82d9-408a3c363b68", "comment": "Malware payload", "value": "057c9dae0e338c4a4cb4d5d7e1ca0d732293db67cd21813ddff5d0b6d0e8ecbf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539570, "uuid": "0b4974c7-d581-4a58-bd96-1a35b2a5387c", "comment": "Malware payload", "value": "321fc1a70ef01bf90657cb580e5ecab8f214d851", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539570, "uuid": "ce17507b-6b02-44fc-8434-3f4c49a10d9f", "comment": "Malware payload", "value": "7afdb70f1b59e3cfab04a97c005fff4ea01906cf60e14852a1e595824375f75d55e94b8c228d41f5cebda0c0cb30e2cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539570, "uuid": "c88b4efe-04c4-4aea-913b-26d61547bc5a", "value": "C304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539570, "uuid": "186e2ce5-da3d-471f-a627-0c5dedd18024", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539570, "uuid": "ef2840d7-efe7-4406-ad87-ef1dbcc23eb2", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539570, "uuid": "c2112295-0769-4dc1-bfef-86b6ec08f637", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539570, "uuid": "5a83bb7e-16b4-463a-8489-be44713f8842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539570, "uuid": "f82c1565-3e08-4cae-aff6-a201eb1a1f88", "value": "87adc738_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175e50c2-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524106, "uuid": "40bb3ded-8157-40fc-8571-77baa7b6558b", "comment": "Malware payload (Dridex)", "value": "9fa4f5474c94c1b642502024900de8c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524106, "uuid": "90f3b706-5993-40a8-8ba9-028f8eab0208", "comment": "Malware payload (Dridex)", "value": "063c02129a1b978e7f7bc78ed32944ea9ac77ba6587eb370a6a5d05326630a14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524106, "uuid": "06fc43f9-ab95-4c2d-bc86-c112e5dba123", "comment": "Malware payload (Dridex)", "value": "cad4bae3a2832e5c64d202e25b17e1f429f27573", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524106, "uuid": "0f8b9cfb-40de-48dc-9bf6-98b6804f01a8", "comment": "Malware payload (Dridex)", "value": "e8f50d5b46c742305dc4ce653654f3bab41ba8bb4936e06ae357b3be748a4624d9d079fac45f1c224cdcba7e4ae500fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524106, "uuid": "0893bb82-f150-4539-9619-36d1bc1f0af0", "value": "6004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524106, "uuid": "8bdb47f9-a54b-45c2-ab26-4408ec0a96a5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524106, "uuid": "ae2c8e62-685a-4e62-9789-3eb3782d6e03", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524106, "uuid": "924569a4-371d-4f7e-a3db-c68780adc5aa", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524106, "uuid": "5376addc-6ed1-41e7-8dbc-9c8427c994a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524106, "uuid": "85a82824-965e-46a2-a3fa-98169a573b23", "value": "9fa4f547_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48332377-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531919, "uuid": "2a110ff9-be08-4705-a9a1-e6daf3a16095", "comment": "Malware payload (Dridex)", "value": "17508b3afaab95b707e4caafb0677385", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531919, "uuid": "dc7848a6-c1e9-4fcd-8f3d-804d803612b1", "comment": "Malware payload (Dridex)", "value": "065d24a16313c2cfee632936cf54ffda2b09f9f920e7f0f66c0f7e2fe3668c49", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531919, "uuid": "38c44834-ec47-4b73-9632-a655e7b8f7c6", "comment": "Malware payload (Dridex)", "value": "478e533d4fa3a38e1c7686c497ae72c006b09144", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531919, "uuid": "0ededa7b-6870-40b1-a471-99185e6937d8", "comment": "Malware payload (Dridex)", "value": "0955cec62d69a30302f38863c4f896ebd516b7b0f90f2162c88b9282ed423b05a58cb7fce99a2558e887ef2621caf5a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531919, "uuid": "76048709-839f-41e2-bd92-6a5824df3327", "value": "E304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531919, "uuid": "8783bc88-f33f-44fa-9908-57466e8423a4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531919, "uuid": "4c838229-85ec-4cae-96b4-0b2a563e618d", "value": "3072:SV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:SV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531919, "uuid": "6d142825-b959-456e-87df-9e3d88042661", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531919, "uuid": "5be5c4d5-0a72-4b93-93c1-da11788f71e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531919, "uuid": "9881ada9-fa83-4669-9820-86c1af72e396", "value": "17508b3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395a576b-b96a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621515144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515144, "uuid": "a4dda68a-4bd7-4eea-977a-1f4a19a90faa", "comment": "Malware payload (RemcosRAT)", "value": "efd470bc758fe8c23d832cda5eb246ce", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515144, "uuid": "f138398b-ffab-4a93-884e-6f2adc462695", "comment": "Malware payload (RemcosRAT)", "value": "0690480dc368a8a85e260416d96fe9fd5db0e59fecba72923b45df8b3409e57e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515144, "uuid": "d5696c92-f3cf-410b-80aa-eb9cfc43b452", "comment": "Malware payload (RemcosRAT)", "value": "d62fef2cc7533ec4fe7a71545ef1a5a57f27882e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515144, "uuid": "8aef8252-6bb1-4266-ac2c-265c6498db44", "comment": "Malware payload (RemcosRAT)", "value": "0c49c3ec91d3f6d667d90ce0ee2baef56f1855f317591b886c01df24d50a2c3b8275dc35607be17a45d1203a8bc6549d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515144, "uuid": "4a00d773-d65a-4200-b192-54f12086f834", "value": "D714026B18F684EBE05E1AB248F7DB32E7B5AE465260155B77453F2B3831343483E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515144, "uuid": "c8c8c398-097e-4713-9107-ca149aa10407", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515144, "uuid": "9e99baec-2b7f-4de1-bb1a-0d7de4c01f3d", "value": "6144:MsxjGjTQSKoBOgIgdM4LFc2WahfhWUrdle:5GPnVBOmdJCahfhWMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621515144, "uuid": "3e794861-0af2-4ef7-9bf8-4334cf51ffc0", "value": 198626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621515144, "uuid": "5e877dae-0f2e-410f-88e3-c58667bd4cda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515144, "uuid": "832a4061-aa57-49e9-a2f5-3840be150379", "value": "PO KAUFEN BESTELLUNG-34002174,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a600e1-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536636, "uuid": "108a72f0-331c-4163-bae9-06a5241b894e", "comment": "Malware payload (Dridex)", "value": "cc8bddf6b4e4de9eed53b47955ba8c11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536636, "uuid": "7829438b-eb86-4da4-a17d-97deb42301ed", "comment": "Malware payload (Dridex)", "value": "0696f4dbb2a8164956af40ba4f488e58c6be294ee9fab340a97511d633bbc3a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536636, "uuid": "4ea4223a-29dc-4b00-80bd-09b3bc200ae7", "comment": "Malware payload (Dridex)", "value": "508d34a049339de15acee3ec58cac1f868556e07", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536636, "uuid": "2024d95b-3cd1-4353-8556-9aab7d275d1a", "comment": "Malware payload (Dridex)", "value": "081e07c24ea753c31bbe087e7dbcb41f13730e6ccef54447eabdcf49cf777784371c821ec346ee590d38e1c6a4876181", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536636, "uuid": "f1b3bfd8-68c2-410f-b932-a7056586d318", "value": "C904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536636, "uuid": "a1a94334-40a3-443a-8a4d-bf5609a5d2c3", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536636, "uuid": "dd8c04fa-9d81-4302-941e-b656d50de2da", "value": "3072:xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:xH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536636, "uuid": "5be2b15a-60a3-4883-881a-dd330ab7d1f8", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536636, "uuid": "742986e2-5969-496c-b608-127ba1f19982", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536636, "uuid": "ac1153c7-ddf2-42bb-bf76-2a1d4e773ff7", "value": "cc8bddf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17f12a0-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526915, "uuid": "e49e3eb9-8ec5-4b98-8a2f-7d432a382040", "comment": "Malware payload (Dridex)", "value": "39a52bb4121479ac07b9f3d2b06c6288", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526915, "uuid": "01f34edd-0ea9-4930-a1db-c735acf5723c", "comment": "Malware payload (Dridex)", "value": "06ceb9b0673d4367dc61f2bc5e4c1e1908e33d9083a29615f5bbe11ffecba8e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526915, "uuid": "8957eba3-05cf-4d98-adc1-3f64d4e5e28e", "comment": "Malware payload (Dridex)", "value": "811e022a3299b432ad35647e0ee55fdaf90c14c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526915, "uuid": "c1b5444c-e581-42c9-b105-a31e7a6e1ea0", "comment": "Malware payload (Dridex)", "value": "474b6a4afc5fd84be70d591f4991ab0429dc9a7b27af4fdb961f285590e0be23e537fc439cbf9dee0cf59b7c680c491b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526915, "uuid": "ac32f0a2-ecf4-4ee8-bed5-b5f0c5e85709", "value": "AC04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526915, "uuid": "3623ce4a-a74c-446f-9738-065613e7315b", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526915, "uuid": "5bde109f-ca52-4971-9e8e-d6cf98669ada", "value": "3072:Ai49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:AH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526915, "uuid": "ad9a1d50-0afb-48f9-97f2-82850cb11495", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526915, "uuid": "187c4923-04ea-448f-9497-4f7674fa1495", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526915, "uuid": "3b231281-3980-48ae-b805-a21a4df65645", "value": "39a52bb4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577c9ad1-b96d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621516483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516483, "uuid": "36dcf54f-1a85-4e9b-b320-ee0faa1e6a4e", "comment": "Malware payload (Dridex)", "value": "dc95468f4b717b17483affde72201608", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516483, "uuid": "7c734562-9917-4659-a5a0-fb096319ce85", "comment": "Malware payload (Dridex)", "value": "07295a36249f57b72178d070246b0df677190a78f7f813b1925e92ffa11446fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516483, "uuid": "324e7194-c38b-4ef8-9577-84043ddaaf86", "comment": "Malware payload (Dridex)", "value": "2a7dc1ccb2fdf085cb2cb1e44c4d7d7ed151d45b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516483, "uuid": "eeca7c4d-2f31-4e26-a53f-e93ec9e871aa", "comment": "Malware payload (Dridex)", "value": "23608262f04e1669fafa23d0becba94e1b0a853c7e90383f5edc887d56995bec05e3dc1ae8f7bc4442fdace1731a891b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516483, "uuid": "85b4e275-9c8d-4f3c-aad2-0fddef68da96", "value": "57F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516483, "uuid": "f94011dc-827e-4e4f-8d75-72cc13ba480a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516483, "uuid": "bde1774a-5681-40a3-906c-66b478622aed", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516483, "uuid": "be702068-81dd-4a3a-9e8f-2e38baf01009", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516483, "uuid": "72c0ba7e-71b6-4b74-aad4-39e51de8994e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516483, "uuid": "52e7e4b1-34ba-43de-ae55-50acaa7dfbd8", "value": "dc95468f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871985dc-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526441, "uuid": "3ee29415-53a6-43e4-81dc-e29a2f4b0cc5", "comment": "Malware payload (Dridex)", "value": "a9b03358e5a4fa1bab6cf6c756a18929", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526441, "uuid": "3c04974f-3ed5-403a-bb17-c5423e730884", "comment": "Malware payload (Dridex)", "value": "07599156f4b60aa2ce513e23a2f9d9d5ceca9f6290d35f0ec71d1194bc4e1f3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526441, "uuid": "bb2cdaf4-d491-45ee-a76b-569c611646dc", "comment": "Malware payload (Dridex)", "value": "0a5e92b4d027eb77d088ad9ac3fe6e6cbf7e184e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526441, "uuid": "546e956e-ee0c-4065-90c6-8a96da789e95", "comment": "Malware payload (Dridex)", "value": "2f8f00fcc6ee539a8c2302ced941d33198cf1143010860668817ea51a5ee572b8ae4968585647e10f1e718352a6f36c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526441, "uuid": "752f29ed-d80e-4c4d-a161-9ce44f265df2", "value": "3304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526441, "uuid": "6ad798fe-4c22-45d7-a308-f9469e38c69c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526441, "uuid": "386451cb-03f4-4c94-a82e-6437e6b67814", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526441, "uuid": "b6ae48d6-370a-4290-85c5-2dca02faf601", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526441, "uuid": "35749f36-5581-422a-974d-b50a3e6c2c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526441, "uuid": "551256cc-8ffc-41e4-9510-bf45992d6a6b", "value": "a9b03358_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b2c365-b975-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621520164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520164, "uuid": "48e01ef5-3c5e-4203-bb5e-e22fe2737f21", "comment": "Malware payload (RaccoonStealer)", "value": "d40e91dbbe80688907297d37313f1a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520164, "uuid": "bc0cf8a4-5af9-4815-9d6f-74d66b3fc9e1", "comment": "Malware payload (RaccoonStealer)", "value": "07b18b26f93bfd5240f4afbc62dc9762ad594926aeff9ecec0de7fb4a7b70822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520164, "uuid": "768d2c00-2c7f-42bf-a604-293d0c3b1d02", "comment": "Malware payload (RaccoonStealer)", "value": "a6c7e711973287c9c149472a94132d102f3b4fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520164, "uuid": "ef15c2c2-112a-404a-8b25-2f280c785fc7", "comment": "Malware payload (RaccoonStealer)", "value": "cd0082a5077a3152cc488541efc4bbb37f119961e11626af1051ab91df1fd2c700e4e0a0d7a2c9d031ec032973b26e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520164, "uuid": "69c44f1e-dcd9-4d46-b2a4-228e53190736", "value": "1AC4D000A691C039F5F732F48ABA826DA57E79A16739A4CF52D526FA07346F0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520164, "uuid": "56d40119-2f84-42db-b87e-0e430794d80c", "value": "9d456e41ef4f6f2344dc7a1eb92dfc95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520164, "uuid": "349be550-b434-407c-b742-193aeca9b6be", "value": "12288:sMyJ7zrgJNX/0Gp0b5ySlYqWsfVfJKkPCJpFoBnDo4q:sxzr090b5yOYqvzKICLiDBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520164, "uuid": "861aed3e-b0b3-49c5-ad7b-aa16f976aa23", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520164, "uuid": "17d72fb3-a756-44e5-887c-de1663cf9ba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520164, "uuid": "34259833-486a-4817-a2cf-2538fa2a99bc", "value": "d40e91dbbe80688907297d37313f1a35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2256acd5-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520259, "uuid": "cc26680b-d719-4f3c-af6f-f4bbadce4140", "comment": "Malware payload (Dridex)", "value": "f8e1486975ef111d9964942907ab9a63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520259, "uuid": "99ae9016-8467-4ce3-a71e-a19f5609bd7c", "comment": "Malware payload (Dridex)", "value": "07b5d9d6fe94ff3aa487b757d0555f4ce086452a6ebf6b873b1c434d90ceba1f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520259, "uuid": "f3d0f0f9-b9fc-4232-b444-953cb92d79de", "comment": "Malware payload (Dridex)", "value": "31814a35d08f9fa1cf714d06e3a7ef53f5592e3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520259, "uuid": "2b5bca12-18e4-4685-b2a9-038d0993fb23", "comment": "Malware payload (Dridex)", "value": "3f4c4a57dc04eb8c1299a3bb425f4afb1926c64b761f18fe32b2bf61f9cd80b11ee12cdc63f3e720269781b63d219989", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520259, "uuid": "dde18794-5c52-4f79-bf10-172c6916b209", "value": "C4F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520259, "uuid": "0124b277-4c31-422b-8833-d1d3e87faf7f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520259, "uuid": "8b85db74-cce2-4976-b221-f61f6f1f6e4a", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520259, "uuid": "140a76d5-0484-48f9-860d-f0e9db591a7e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520259, "uuid": "7874bbce-aaf7-439e-b15e-d391a7b5143f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520259, "uuid": "bcd5fbbc-7a80-4f0b-85a7-8a907ed6a747", "value": "f8e14869_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a0dbe0-b96a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621515161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515161, "uuid": "f24d70e0-b26f-440a-b37a-153013fe6329", "comment": "Malware payload", "value": "7d216963eff2efe2b5aa60ffdcaa5627", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515161, "uuid": "3691538d-fb10-4cca-bd92-e7754f803be1", "comment": "Malware payload", "value": "0817d182db4c00aeb6d3e6946dcd1f4fd8881b5d673960b1d22e1a97f80fdc6f", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515161, "uuid": "25409749-e2c5-4bb0-99b1-0e491eb6f81f", "comment": "Malware payload", "value": "d3c28e553d75889eb9c022850931640632fe5e24", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515161, "uuid": "8453c546-335d-4669-ba7f-823cd054d870", "comment": "Malware payload", "value": "8f82457897f4a385f493aa35dc067e724727f28ef20261c098a309f6fdb83970f998fb00f310dfc48777485db8be371a", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515161, "uuid": "ee617731-84bf-4b41-bc83-277a6bdbe275", "value": "D5525B7CBE585F5DCBBA17B54239A88D018CBA3533C091E178ACE7217F0AA3B07044A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515161, "uuid": "278dc52f-6cbe-4b3a-93d0-b1bc33895f11", "value": "384:qxjHIj/LvrJfAz1VZLKo0B+vICwORyKGdv62SdM4KvLF2:uHIj7rJfiZLlS3uCUcp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621515161, "uuid": "8c2dc8d0-6074-4398-a3e4-5bbdd67659b5", "value": 13982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621515161, "uuid": "f0c9feac-ff7b-4dbf-9dc5-468cf08c64e9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515161, "uuid": "ecad6eb7-714c-442d-891f-c0e20c1fd572", "value": "wbk.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6db5992-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536803, "uuid": "65c4f969-3d74-4094-b374-eb6eef1c02a8", "comment": "Malware payload (Dridex)", "value": "c0d21db7e169d6c2c56f57b96e59f64c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536803, "uuid": "220a5329-a681-4245-afbe-ee7aba57891b", "comment": "Malware payload (Dridex)", "value": "081afe77d346ab8d3642ce766f28f912ba3c5815615933b05cc1807e4d313fe9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536803, "uuid": "412a06a7-be8e-420b-81b5-024f9114676f", "comment": "Malware payload (Dridex)", "value": "fe3c9171397aa6d92f5657e26c8bdf5a30d51d57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536803, "uuid": "2f7d48cf-a1f6-4547-8ee8-d8d269047630", "comment": "Malware payload (Dridex)", "value": "92b1dc86c84a234f3cc05a654f03bda23e9423579e8ae878e1c9423551c9ae06ea8ab5b9db144c156615896876f3c0ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536803, "uuid": "7a2c7afd-9bbf-4791-b196-52620ae01fe7", "value": "D404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536803, "uuid": "d2654f05-a1cb-4e5b-89c4-7838f15a0475", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536803, "uuid": "d18332f8-dbd6-49f5-b188-164994729d9d", "value": "3072:1i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:1H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536803, "uuid": "ba7ab0c4-2a3c-4f9b-9c50-2fd94121984e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536803, "uuid": "23632ffc-d667-46d6-9eae-201a57cd559b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536803, "uuid": "6a33bf12-62dd-4c49-ad94-144dd06a70ff", "value": "c0d21db7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6728d-b9ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543362, "uuid": "8374798e-21eb-4b73-9e2d-d4df00d58e8b", "comment": "Malware payload", "value": "7b9ad4873e500adc4ed704fdcfe97c34", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543362, "uuid": "7a3696e4-491c-4755-b205-83e76b69106b", "comment": "Malware payload", "value": "08398c9fb45f3b371e94b71691ef08abf7da3d7875c0903ca4f7dc7b06858ba1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543362, "uuid": "9e6741bc-a990-4150-bb31-07ed43418010", "comment": "Malware payload", "value": "98e149578470295027480672b37ad26c7560b7ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543362, "uuid": "bda26cf8-d76f-4287-a3e7-820d15cecc5f", "comment": "Malware payload", "value": "2234277d9c4f2d4a24c25a78f492bcf4e85193283292b9c6b2270f4e6f06f9a706fe31d37aac4d5b73285078aa358798", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543362, "uuid": "fc3c1183-46aa-4193-8eab-bd78a16485af", "value": "1A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543362, "uuid": "3c5e4113-66ba-4d9b-87bf-4082db2ab5e5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543362, "uuid": "1d797c79-c279-410a-aa58-7bbb8291cacf", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543362, "uuid": "f0c27682-e818-40dc-a4fd-9a195ab72589", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543362, "uuid": "93b483fa-335a-4f18-a31c-ca7f272edbf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543362, "uuid": "836406bb-2d7c-4dca-add1-cbbf225b5bcd", "value": "7b9ad487_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad4c3dd-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520354, "uuid": "f60327ef-368a-491c-811a-4d9ac80d9d6e", "comment": "Malware payload (Dridex)", "value": "66c29a97b8d85f36ccf27984a4f9dc69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520354, "uuid": "a9c70f29-4e61-436f-a82a-f5f1e03f2956", "comment": "Malware payload (Dridex)", "value": "084d0de4d27625b1a82adb0cc4e79a444fc48100dc212fd83e3308bdeb6d542d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520354, "uuid": "bd77b00c-e09c-4bbd-a48e-147de6d57961", "comment": "Malware payload (Dridex)", "value": "a0673f29d61904f1c61d13ea3cffa3c5b784ced9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520354, "uuid": "a8575970-0b57-4f7b-82f9-81bdde7152d0", "comment": "Malware payload (Dridex)", "value": "fba121f754891ed8c5fa1b03392a1a5ebebd854800283b16c6ab276f198ab7db0ba24fd1191d07edf1dc28efcd87b430", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520354, "uuid": "a80b8532-1556-4879-aa13-42c1a3cd56c2", "value": "ABF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520354, "uuid": "3f989ee0-991d-4f5e-a22e-4418ca5ebba0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520354, "uuid": "ea78540c-5c93-45cc-9edc-c9e0b2683c81", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520354, "uuid": "a549062f-a4e4-4dd5-b909-dc9d1293655b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520354, "uuid": "ef4bc2d7-1412-4466-b880-f4528dc173e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520354, "uuid": "9dc40c3c-cb65-447b-89ae-9cf756447f8d", "value": "66c29a97_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b901332-b92d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621488868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488868, "uuid": "a4203e9a-209f-403d-9998-0c7613043e14", "comment": "Malware payload (SnakeKeylogger)", "value": "4890ad7a55bc7de6e5860dd1ba3711c3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488868, "uuid": "fcc49216-ba8b-434c-b6ac-1d258f72c921", "comment": "Malware payload (SnakeKeylogger)", "value": "08b0372843a01b4ce17bfc2e2b741676cd8a3d6c1a749fa3d39ae84bbd4ba4e7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488868, "uuid": "0c60891d-3e4a-4e8b-b256-708873e9f21b", "comment": "Malware payload (SnakeKeylogger)", "value": "fc8693fe4d3b0938203279aec2bacfc60a82cba6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488868, "uuid": "cce4d5bd-bdff-4428-9a41-a55bdb5cce68", "comment": "Malware payload (SnakeKeylogger)", "value": "4ffed8d7409d016cf819e925c5604a908853aa88e4f81173c498b569a3aec7dec104bef588f2d99e42b35a400f84163e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488868, "uuid": "af153f25-8047-410a-a854-6d080b3435ee", "value": "54C4F03477947F04E6BE4B3BC9A496505BFEED17A712C24E68E0358C1DB3BA18262713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488868, "uuid": "b23db8c7-f4dc-4373-be1f-e3ab242f494f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488868, "uuid": "a9224716-f733-4f53-b506-05ebdd33f7d0", "value": "12288:n5gN/Dw4pitnsyBZRcO0EIXgBa3DbOiUFcJszMKzLnGAX+X:nopiB9BBI3DIgwFzLnGAX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621488868, "uuid": "d50be38a-ae31-4769-a6f8-e2ab449e3728", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621488868, "uuid": "3d52754e-6c55-4a72-91e3-2cd98461fc93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488868, "uuid": "e063dd66-f35f-4f8b-accc-6fb0912e457a", "value": "lista de orden.pdf______________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939d971a-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523456, "uuid": "d6a84ef2-d6b1-41c6-bf7f-d8dd7a27ec19", "comment": "Malware payload (Dridex)", "value": "ecc8d159acf30ca471316d1e96d2f13d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523456, "uuid": "0b18a65c-79d7-460b-a098-64afc94bcb0f", "comment": "Malware payload (Dridex)", "value": "08d38d77eea5f55d75b004b78e07f210a7bf9e59539c515ed39e95a2a24f204d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523456, "uuid": "7eddb4ea-94e9-4441-a05c-3828f67747b9", "comment": "Malware payload (Dridex)", "value": "fe589227a57194ee7b19e7566b92908dc2c26beb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523456, "uuid": "28d41ae9-18d6-46b0-bc3c-91bca30ebacc", "comment": "Malware payload (Dridex)", "value": "b50eaccab507054cd1cc39a6c21e97f26a11a8388ae2ab810ed789a214093ef8c511038289400f513610d699ea145c3f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523456, "uuid": "00268aca-f38c-4bdc-bbe3-f56c8c4c8234", "value": "CB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523456, "uuid": "570787bc-fc4e-4f1c-b037-60a35e3e57f3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523456, "uuid": "5fbb41c0-e80f-4524-98cb-a322dd75ffec", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523456, "uuid": "ac73acbb-4a58-4a8d-be9e-b75b6e61a30d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523456, "uuid": "2fa6e62a-13b3-4cca-ba5b-87bed2344b93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523456, "uuid": "55f5ea1a-b44e-473f-821e-ff830af4218c", "value": "ecc8d159_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe950cc-b9ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543126, "uuid": "dd8790aa-5065-4a1a-b508-ef8ae4cbde04", "comment": "Malware payload", "value": "699520d898e3e01d77be856ddeb42379", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543126, "uuid": "75b64303-1f25-467d-a4eb-5f22366d2132", "comment": "Malware payload", "value": "08dfb50cb7397b52b75693073f2cba34bb92367af607c91d0bd20982d196c3cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543126, "uuid": "2976afec-479c-45b4-8304-0a778cf3f8ee", "comment": "Malware payload", "value": "a2c67f7054e80a5d11eb3504096393d99b825f44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543126, "uuid": "542802b8-9e8c-4281-a694-f48eb637d16d", "comment": "Malware payload", "value": "e2cada25320e197a581689223ae287e25776e20fb96066117a8e8cb466b37fb18c886c1bf09cfd91cc17e76943639820", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543126, "uuid": "2671b6cb-6308-4e52-8d4a-4e85ef5e9443", "value": "8004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543126, "uuid": "4ee607e6-00c6-48df-998d-3c667a034887", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543126, "uuid": "d05a1a6c-541f-462c-a76d-95068f441c26", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543126, "uuid": "f2fb05a3-1e5a-450c-8c28-d8eb34d334cc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543126, "uuid": "5dec8404-d636-4cde-b0a7-18d09f283343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543126, "uuid": "f1c1ddd1-272c-41c8-83fd-6046ebb12c1e", "value": "699520d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115be9e1-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "4750edb2-6c5d-4204-aecc-d52e42bbcd52", "comment": "Malware payload (Dridex)", "value": "e26f02ac69d296f859cb451281c30488", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "c8514fdc-0d35-4719-bfc4-be542c2a7247", "comment": "Malware payload (Dridex)", "value": "09396304204ebf0c7e62abc669453b422b5e302f4b5be0f1f2a6e186e02d5d56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "b7d21f4c-b13e-4cbf-b14e-f269161b4d45", "comment": "Malware payload (Dridex)", "value": "d6326cda04d000bcbe3a7b879198ce90669d772e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "644802aa-9754-44c3-a95c-94117d883a93", "comment": "Malware payload (Dridex)", "value": "70a8335695a4e711168c8fde4dcb51ff9154d246688d64f6d0649a20803d4c54f51408d791aeeb2e826461e418e94cb9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "a6f68c56-d464-4f15-ad05-ab3ca6dcc5fc", "value": "FC04B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "1997cdc3-fd36-48d1-9e2f-9a56566a8f1d", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "35a6ca03-d960-4771-9d25-59445c13943b", "value": "3072:YWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:YWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536122, "uuid": "609ef681-f9f3-4d98-a2ca-072f57384a6d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536122, "uuid": "06c68542-4928-4536-9920-6c41113c3528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "09ce2f8f-3986-4de8-be17-3a13a5bd2e25", "value": "e26f02ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e2c5b7-b9b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545475, "uuid": "8701406c-3ac3-4135-81e0-cacb384b64b6", "comment": "Malware payload", "value": "3f4dfc1f6435166ae8e5f6878a9845b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545475, "uuid": "efec86cd-b399-4aa3-897c-e16195aa5234", "comment": "Malware payload", "value": "0951cdaf2e03e3aef1cb49d74e18e6b84372b3dbed5e6954a2f4003b761490f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545475, "uuid": "0ecf3fa5-0b83-4b75-8277-eccfb7163958", "comment": "Malware payload", "value": "5c29e862512f1f3d088bf9bade50f40f617056a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545475, "uuid": "b9aa1ac8-134a-4442-bbfb-4c2120715c61", "comment": "Malware payload", "value": "53f653a2e487104ce81fcf4caa7fe2aec6c96ed823fd21b7cc13dc3aa2920158adaebdd0c6e47a5d97115cf9cfe8ae0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545475, "uuid": "340d3baa-5a86-41ca-8dd8-91dae77a905b", "value": "4FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545475, "uuid": "051a9b8d-c7b7-4881-bc6f-d6d4a790c519", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545475, "uuid": "20b47125-4054-4245-8f1b-dac5355f8df4", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545475, "uuid": "2ca1b864-ffa3-435f-bb72-6f86b0b24d58", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545475, "uuid": "facc0556-d719-4943-9b32-cebefd0b700d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545475, "uuid": "f9837f81-69ed-425c-8a9a-baf1fe184754", "value": "3f4dfc1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf8f5c1-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528812, "uuid": "d5af2677-031e-4f1a-ad6f-6c0a794d4c84", "comment": "Malware payload (Dridex)", "value": "ecbc26b7afbe47341d72b3402484b164", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528812, "uuid": "aacb951d-a156-477f-97f3-7aa0cb541c24", "comment": "Malware payload (Dridex)", "value": "0991ca48c37fec40283b14a69cba96746fb887ac58513e9667590a4dee7edf81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528812, "uuid": "f84f14a8-6f8b-4d76-92f6-908bcf1feef3", "comment": "Malware payload (Dridex)", "value": "a52de99a63dd6b9d58a412b990cea8f036c242de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528812, "uuid": "92f450ac-512a-4b35-ba2b-b9611c295fb1", "comment": "Malware payload (Dridex)", "value": "a72fcec3d69996d5e78753bd8f8ad85a2b81334ceb8cb2a2d1b09703ae4feaf7a6ffa6b8408260c6058b28ed03ff6c1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528812, "uuid": "3b698091-aedf-4090-864b-0b08a97836b3", "value": "1C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528812, "uuid": "1346d6f4-1647-495a-a758-369a06e99de8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528812, "uuid": "11715aeb-3780-44e2-ae84-ae1a99481166", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528812, "uuid": "037f2a9d-b06f-4714-abe4-ea1f16d2ee23", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528812, "uuid": "4fa2e834-fc72-4349-bb5b-5e04f5fa4801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528812, "uuid": "f57c6c6a-cfdd-4b34-9294-81d3383087b7", "value": "ecbc26b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f23121-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "dab55279-4e71-4ddd-936c-2d27e4ad902b", "comment": "Malware payload", "value": "80bd58c015af700177d94ac5d9412cd4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "ee52d0be-3104-40c3-bf3f-7dd32229e551", "comment": "Malware payload", "value": "0997d0bca1da53ca5d1decc737c28bdd21b41e64d423d38259c5beb70c200262", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "67327bba-1b91-41bb-b479-53438644c9eb", "comment": "Malware payload", "value": "cfabd2ec67f103fe494a6ed3af7a36c1a0c548d3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "d9aeb6a0-136a-4044-8ebf-62e1ba4961fa", "comment": "Malware payload", "value": "b6b992d93748be789bf26b412ac7f268deba6a17cc6b51a0a43d374abb097a9a77246c7c4aebf68711eb73bb078e0dfa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "1f493e3a-df3b-4675-86c1-8c4a3b12e7c3", "value": "87F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "ba9e928c-dd08-44e6-ae38-f27ddd1738a0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "b718e621-776f-4169-8c36-f87786d6225b", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541012, "uuid": "18dd645b-b739-443b-90e0-ac823e9c065b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541012, "uuid": "876ac7eb-df75-4717-9127-515615c466e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "1d91827d-07cf-4608-bcbf-78f3d8ecb6ea", "value": "80bd58c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c87c460-b956-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621506506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506506, "uuid": "7091d2a0-ba56-40f0-9e74-804f64aa8fcd", "comment": "Malware payload (Dridex)", "value": "99be64d1ace7b18914e35bf684bd3d96", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506506, "uuid": "63bf4ecd-87f9-455b-b380-1aa8dc54d1e3", "comment": "Malware payload (Dridex)", "value": "0999845e0a3ad32caae8832eb59aa350718f71e0078496d4428bfec5a720fa02", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506506, "uuid": "d9441ab8-2dbd-434d-90b0-44db919f89e6", "comment": "Malware payload (Dridex)", "value": "e166a641fdbc39a9fc155293180ae806560701c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506506, "uuid": "1a0e1000-95ed-47d9-9e35-bc6405d77d70", "comment": "Malware payload (Dridex)", "value": "82b2e23385e941c69cc1d92f5856b1a920fa922050a1411f73e3d982adc3258853e405c9642e6bb2063c4ec8b58464b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506506, "uuid": "451b5214-6cf5-41c3-93ba-0a7697e97ed7", "value": "63F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506506, "uuid": "a1584b65-86cd-49b8-8261-a99dccef6a64", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506506, "uuid": "6da04c7c-39d6-4769-9b15-68a65ea2dddf", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621506506, "uuid": "b9f07454-fd62-4f7c-966b-9d3a5ac3d6d3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621506506, "uuid": "b56ae8ba-80de-475e-977a-43c884e1ef17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506506, "uuid": "1d468f0d-aeb8-4493-9309-fd3728c7a1cd", "value": "99be64d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ccae71-b9be-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621551132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551132, "uuid": "0f0af3bc-38d7-4b7b-ba28-154f359316b6", "comment": "Malware payload", "value": "9172c0429c1e6511a52fca7500ea5ad1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551132, "uuid": "2e226f63-15dd-48c8-82f8-001c4ce27450", "comment": "Malware payload", "value": "09ca64da645c51f17bce2a9044f5aac7cef31bc5f9f5d59d81c17dbdaf8677cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551132, "uuid": "7650ef33-b41b-4b5a-9e5c-5b46416701d1", "comment": "Malware payload", "value": "0614fd2a406be25ba4e791972d01b7f0f293a3c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551132, "uuid": "daedf44e-e401-43f6-84d8-8e5269e1c59f", "comment": "Malware payload", "value": "92a94fe7304bb6675f6f192d3b13ac47d84b4ed781422d1dfac9c67c5e9a5ff5900ee90e7240fcb33337da361b6637f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551132, "uuid": "7995b464-0acc-4f85-be6a-dec05fbd9f6a", "value": "FF04120DE144EE1376C3BAD87521BDB9A6F2022F19F0078853A5E55E0225477DEBDB32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551132, "uuid": "952e8ff3-7037-4de2-a2a8-359f5e0fe9bc", "value": "3072:jjY5OvhAkqVder6WrnlwBLUMiNBxObY6bOtGWe+U9rQH4W2mJndKD8JZUqTFSnDL:jkZderLnuBLUt3xOz1aU9lLh8JZNFSnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621551132, "uuid": "b094de69-d6a3-425b-bac0-746cdccd308d", "value": 177097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621551132, "uuid": "4082d870-62f4-467e-b7a7-bc5fc75f6a13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551132, "uuid": "c6dbf134-f3b8-474e-a1d1-450cee3a557a", "value": "9172c042_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bd0548-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532271, "uuid": "7ee4929d-086b-46e0-bd72-a767c8b80c9e", "comment": "Malware payload (Dridex)", "value": "acd7ae3152cb6219d5833540d06b3d3b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532271, "uuid": "6fb09c26-f9c3-4ab0-9c13-1138d359d8b5", "comment": "Malware payload (Dridex)", "value": "09db507275e0c99ef8020e91555b918c2a8c1a16d5ba54fd49338b4a11bae81f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532271, "uuid": "f9df65af-b521-4cc3-a094-dc69845ca227", "comment": "Malware payload (Dridex)", "value": "3fe858df981241590c70982117b09b0c8bbe0989", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532271, "uuid": "68ba6493-0d70-42ad-8728-7156e8c558de", "comment": "Malware payload (Dridex)", "value": "c6abd2cb80684496181ac88acbacfad0e3c03a39fe22097a76548474cf1b40efd0f08800118000582eef7d4c490bdd42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532271, "uuid": "c84a8eb2-92c2-4eae-94d4-d0a62305d8b8", "value": "DF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532271, "uuid": "08f15eb9-db94-42f1-8d0b-fe0f29d477e8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532271, "uuid": "9537daa4-b118-4060-a84c-8fc7fc6f4747", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532271, "uuid": "d429330a-29b6-42d7-be39-3def283c6e74", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532271, "uuid": "1c52f08a-d01a-4562-9da4-6c07beffd4ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532271, "uuid": "2aad2213-0a65-43e1-b843-03c49817b0ce", "value": "acd7ae31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08091d7-b974-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621519719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519719, "uuid": "9a5eda55-6ffb-4fdd-a359-87ef38b2eb0c", "comment": "Malware payload (AgentTesla)", "value": "f6c0475943e6e97a0864519ae6ea1813", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519719, "uuid": "7a7606d8-1de7-4375-afe6-1f97f31ad435", "comment": "Malware payload (AgentTesla)", "value": "09ea0a2ebdd26b99c69cc5453271f24e92aed461c3f45741fee12109159411fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519719, "uuid": "4b58b073-ea7d-4b78-a6a2-a0e19414483a", "comment": "Malware payload (AgentTesla)", "value": "d6b603ef6e10382cd3895e8c0ef14c36f7ca8e1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519719, "uuid": "eb183675-8a1b-4052-b92c-3d563619d302", "comment": "Malware payload (AgentTesla)", "value": "f311d9d77a208856fbe240558485fc59844e8d4fb29dbccc29a5b20cffc6d0d9747543a264c7b66aa6532d5b33d913a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519719, "uuid": "13f96cfb-730b-4c72-b885-d35faf0fa2e2", "value": "BC3569EFAD5C6541CCF58EB0F5F852A94A6A7D355403930B38BF7F8A763224C8B80652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519719, "uuid": "06db1592-7e6d-4759-aad1-74afec34218f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519719, "uuid": "97e94fe7-11d2-4b91-ac2e-228a7281f51e", "value": "24576:aMonW3YhBfzyl6HmN/V9KOIJ7gRV7KxFtn/7px:TonHBfFmN8S7KxF5D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621519719, "uuid": "b50058b8-8129-4c19-ae6a-4225f75fd75f", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621519719, "uuid": "97e8b1ae-77fa-408d-b6d6-8316fdb26797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519719, "uuid": "2df2289e-0664-4418-a32c-117e26a2144c", "value": "f6c0475943e6e97a0864519ae6ea1813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc3d417-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532382, "uuid": "792764be-68c6-409d-a13a-1d24d2e64d4f", "comment": "Malware payload (Dridex)", "value": "867d020d8cd86a7473437d9762ac5d18", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532382, "uuid": "489d87a3-9412-4c31-99d9-2a4732b08c56", "comment": "Malware payload (Dridex)", "value": "0a036a9ff4fa080edc1c09ffb0fc4779f1a21df4e8c319ba23b2953e54dfad5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532382, "uuid": "42922cee-4da4-49cf-99fe-05f13028bafb", "comment": "Malware payload (Dridex)", "value": "89ab6cbac0178ba1ff7ba1d3a1887b96acdf8344", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532382, "uuid": "a4607dec-5ef9-4fb3-a0ef-a7779252b6ec", "comment": "Malware payload (Dridex)", "value": "ef3c548c4adf3c3f1cae5c22e201aa7f9d26e14381553a1b2ba3ffdec04f77be3cbc902594dec4d542956120f3d783aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532382, "uuid": "cc1075d7-2725-44ea-a76e-3aea842e3c24", "value": "A304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532382, "uuid": "f29e10d6-5fc6-4f16-8f70-80465ee74161", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532382, "uuid": "2d52cf92-f52d-450a-9433-1a0a550dafb9", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532382, "uuid": "061c5698-d421-495a-afcb-65a5d09f9a5a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532382, "uuid": "93b6cda0-362e-4010-a08c-406c114e1b6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532382, "uuid": "42658a8e-81d3-4dde-bae1-c8672178fe96", "value": "867d020d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96287242-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483946, "uuid": "98fdaae7-aefe-49a6-8896-f8ff55ce4e44", "comment": "Malware payload (Dridex)", "value": "eff39aecc4f277c3317e350fafae5f1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483946, "uuid": "22033679-958e-4989-8d6e-c3a901a22eef", "comment": "Malware payload (Dridex)", "value": "0a17263b8515214212ed67fdad8648d39cf654cdfdba5399cd33064b98dc1b94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483946, "uuid": "666ba59c-f994-4d08-829a-290d9517f843", "comment": "Malware payload (Dridex)", "value": "748d01695b75938037a5731a524ebdc3ddf09363", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483946, "uuid": "0b893e10-d09c-4bcf-8236-3e053450d267", "comment": "Malware payload (Dridex)", "value": "249f5673458aaa5914f7eed0842875a699c369abe34dc5346f82e94164b69cca442a68cc08ea66b65c29b57b11e692fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483946, "uuid": "92cfb1d4-57f9-44ac-b4a3-8cd111d7d121", "value": "5304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483946, "uuid": "4d6e1430-95db-4b50-90e0-5659b4b3451d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483946, "uuid": "93ee93b6-728f-46a5-a284-b4bb3c1c6f5f", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483946, "uuid": "a7bb9d0a-7990-4bb5-92fe-e2c0ec27d5de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483946, "uuid": "8475c9b6-3163-4b9d-aef4-d3007e7cf236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483946, "uuid": "8d1b4945-adc3-4024-a053-473f91951524", "value": "eff39aec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc978d8-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483506, "uuid": "3450ec16-2199-4dc4-8a4b-cbebf10b825f", "comment": "Malware payload (Dridex)", "value": "9cab7a42a975f770d0507efabce051e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483506, "uuid": "0f205e1a-77fa-4ca2-b774-6f0b859bd764", "comment": "Malware payload (Dridex)", "value": "0a2e2afae02dc52d42cfa2302403d1b9cc8a47893b972f1acc4562d4785123c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483506, "uuid": "bd8e74ca-c71a-4f93-971a-374e4a949604", "comment": "Malware payload (Dridex)", "value": "8503cdbafdedd54090a25ac58f0fee8d603c9b05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483506, "uuid": "b94b913c-411b-4d95-818a-8d214e4d7fdc", "comment": "Malware payload (Dridex)", "value": "9ad722464a3ea784d582f664bb1de8b7624cbb6494cb73c6e13c98718c01f1a798fb66bcc0caf1f1e89e1193a812bf00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483506, "uuid": "7b1c8a64-188c-4660-bd2a-891f02bd6788", "value": "7AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483506, "uuid": "893c1369-55e3-4cab-a38d-89f5c4f2de84", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483506, "uuid": "d5016367-2321-49f1-92ff-230b1dff8332", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483506, "uuid": "97225423-6f45-4d5c-b5fc-352d8222edc8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483506, "uuid": "d2c17900-4802-48c0-9cb2-24f5d9040788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483506, "uuid": "e1af50ed-e487-48d6-854c-65ebc0ecaf90", "value": "9cab7a42_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0de400-b9c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554265, "uuid": "a1e30d38-1a02-43cd-a6a8-4493fec54b29", "comment": "Malware payload", "value": "615fbeffb35098b5b467ed7c81eebe19", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554265, "uuid": "51e4fce1-397a-4ec6-9baf-5236bcca63a7", "comment": "Malware payload", "value": "0a5501366dc3262424bded5413c943a760e6e12fdcf232d2bb8c57b826e68a6b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554265, "uuid": "97a2a142-01c0-4bba-a640-cbe48d2f5a51", "comment": "Malware payload", "value": "645d335aa309d98e5c1f9bda742c39cc3d5a057f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554265, "uuid": "e8c6f5ac-0efd-4450-a3aa-1e9ba0b90d96", "comment": "Malware payload", "value": "49cd401d6a8acd092f448f405c5da579a2f83841aab7631875e3680378d4524710ef4392c58776d29b3163281601dda8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554265, "uuid": "9637ba4e-632f-411b-82bf-e1ba6c00e8e2", "value": "9804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554265, "uuid": "811c5ef6-2766-4232-85a5-15e3739f033f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554265, "uuid": "80d6ee3d-4002-45cc-a3a4-a0e031052fab", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554265, "uuid": "2d6af05e-d02c-4dd2-a28c-3525692324ce", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554265, "uuid": "f0c2edb3-aee0-4f58-97a4-cf6ecd1c0cc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554265, "uuid": "f9853aa4-5228-4d83-bb71-1de537084dbc", "value": "615fbeff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dce570-b97c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621523134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523134, "uuid": "1b3963f7-a018-4436-96de-ceed5fbd13b3", "comment": "Malware payload (AgentTesla)", "value": "6b3f63384c80b8f1ea8e2e5b62f145fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523134, "uuid": "8b1fb37d-bbe1-4685-8234-8bd127141f90", "comment": "Malware payload (AgentTesla)", "value": "0ae134d16c6d96a7020703e8efa78f40e05072b0cdfb1ce9936427e02157e22d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523134, "uuid": "31854b14-cc7e-43c0-8dc2-2485ef0e1ddb", "comment": "Malware payload (AgentTesla)", "value": "42cdfc9f7931ccf5e41ae147fd0cfc75fc3ebb79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523134, "uuid": "c46132bc-dfda-4592-9470-3c02d3011bdf", "comment": "Malware payload (AgentTesla)", "value": "23f80c10276f517d1fea8448c3c2065e3125782c009b6e46753f18c7b8148f9bc01b9c97d9392e98f2ba49444609748a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523134, "uuid": "e26095cb-872e-420f-80a6-776b69300fbc", "value": "51352331235CEAECE53E637D5CB0D0100BF5EA05C212F5AA5EA452AE0697B2FC6F5E05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523134, "uuid": "0af6b27d-2af3-4bab-9b8c-ad739ae7d50d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523134, "uuid": "62246e9d-d29b-4d6b-a45b-941bb07f5b9b", "value": "24576:YDb2ADEsVWuGhGtYKqg+4r98yLz5+YNtdBldeZIz:Yrw4trqgrLz5xtPlgez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523134, "uuid": "3822e181-b098-4cc0-988e-daa989fa18d8", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523134, "uuid": "2979be7a-4ac7-4916-8cbf-b9e543cadc33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523134, "uuid": "323144f8-2767-4e29-aa99-04b34e727c9f", "value": "New P.O [5542332#].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2ca2bf-b939-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621494241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494241, "uuid": "f75dc9a6-ebef-4dd1-932f-d5776c9cdb3b", "comment": "Malware payload (Dridex)", "value": "b2e0f7e75fe55c78a13733a36cba9f88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494241, "uuid": "5bc1cbd5-4df4-4f7d-8ffc-5faeb0dc6c6e", "comment": "Malware payload (Dridex)", "value": "0ae3e47fc5e42db64a91348dd0d6ddd166140718cbf63e15e60046f516a77ea3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494241, "uuid": "3a0351a7-13a5-4c80-872c-d7eef51e0e57", "comment": "Malware payload (Dridex)", "value": "d08da69e3a96063906656feb00af9a3f50955145", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494241, "uuid": "c65d3991-7e7e-4d2b-9e68-08a1be05790b", "comment": "Malware payload (Dridex)", "value": "9070188d863d1dde7b69cf603564cb4d022ccf8498d8903c437162226e5515605fe70eeb04d1fa3976b0bea97df0e143", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494241, "uuid": "ebf333da-4bc8-4c4e-9ffa-16cb245b43b0", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494241, "uuid": "314bc43b-4bf0-47ad-b567-c15de5c9db5e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494241, "uuid": "284b82fd-3047-409a-8999-8356600db15d", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621494241, "uuid": "52f4743b-cc1f-4fea-8dea-6ec404686a2a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621494241, "uuid": "5c6be481-0f4f-452f-b9d1-2e94a057af36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494241, "uuid": "51908ab7-ba27-43ff-b602-4769eaaa7b1f", "value": "b2e0f7e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a143c7-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533103, "uuid": "dc4fc691-1cea-4ea6-be79-4e0d97eda637", "comment": "Malware payload (Dridex)", "value": "1a2819121d482bed29fcc57240b5fd37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533103, "uuid": "9765e1f1-fccc-4a84-b16f-c6c1064c317d", "comment": "Malware payload (Dridex)", "value": "0b0fd5e291d80d8fbb9d09ed66b87f99da7e38ca4814f4b4cd32891c41b0f35f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533103, "uuid": "e33c7792-cf13-4373-a3ed-3ce1447de0a5", "comment": "Malware payload (Dridex)", "value": "e479d42edae559da203026d514fba06fca1418a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533103, "uuid": "041881db-ba0a-4d6c-9756-6f99935848f8", "comment": "Malware payload (Dridex)", "value": "9453902fe1229944615424c50f13a136ca583da5ffe97b393b5bb4e29a2d008e326f46145847a0867645fe3e8b1ebdef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533103, "uuid": "4b39aa62-9774-4412-a6a7-5b9a4675e581", "value": "7704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533103, "uuid": "c238c7f6-df37-44ec-b417-d02edb1ca186", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533103, "uuid": "290f6bc6-6ae9-41a6-944e-d3cf46844ccc", "value": "3072:Gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:GH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533103, "uuid": "2404522c-715f-4846-8958-d8d2ce06b8ab", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533103, "uuid": "275ee6d5-a2ea-49e2-ae38-d28f37c5744e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533103, "uuid": "836a19a8-574c-4422-ac02-d77e7ea8a71c", "value": "1a281912_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770fa5e9-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546171, "uuid": "b52acaf3-2dfa-4ec9-9481-776847477f37", "comment": "Malware payload", "value": "2163ae3f73ecef41100c4abb06097a0f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546171, "uuid": "88d859e4-55a5-4e6c-a063-07560c90b879", "comment": "Malware payload", "value": "0b3339a6cbeae7c542954be17b3acc0e2e6adc822e8dd8780de8ffbd1f185a14", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546171, "uuid": "63f5f226-ed78-4d4c-a55d-619942eb94a2", "comment": "Malware payload", "value": "8824cbb22944b5462584fe5fc642891bec377ac8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546171, "uuid": "36a83c8b-f7e3-4810-bae4-3f1d081424b2", "comment": "Malware payload", "value": "3f1b129d8b5a11ad945ce40b688cd89aa95495bf5c93e44170c79b3ef29fc4c4393f6d72b2a9c6520abafe6568d8e731", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546171, "uuid": "3dd6ab0e-8a8b-4b58-b862-53e2a222d320", "value": "C104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546171, "uuid": "9c98a36b-fc08-4aaf-9038-9fc20004eca6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546171, "uuid": "e4787452-98a1-4d10-843b-59cd3a9ea84f", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546171, "uuid": "053a41af-0097-40fb-b2da-a0d6f32c4937", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546171, "uuid": "cd5e34a9-55d1-42a3-87d8-197bec5437ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546171, "uuid": "f6b35bcf-590e-4aaf-9ab6-613c1a19fb03", "value": "2163ae3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b990d12-b978-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621521134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521134, "uuid": "fa5ec1c2-1dec-40a0-a512-da970e02653d", "comment": "Malware payload (GuLoader)", "value": "405fb8aa2e5c03fabef74abbbf331192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521134, "uuid": "621d3991-8810-48ef-bd23-3895effdefd8", "comment": "Malware payload (GuLoader)", "value": "0b54ff609b5ae4eb2d5e32b26ce5446ac83684088785dc51b22bbfccf61e06e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521134, "uuid": "89def64d-13e8-4895-9141-a18be8d26fe0", "comment": "Malware payload (GuLoader)", "value": "3b65868687cb84c25737ebba99f0f7f2c91c1255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521134, "uuid": "4ea05eba-e1b2-4ebe-ad2b-7927ce31426a", "comment": "Malware payload (GuLoader)", "value": "81520c39e2e3db8f5b0126ce6a33c9287d27d650ffe91d6d99c2def8a2150636a59d40977e015118d42497a1196f7337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521134, "uuid": "3f257641-64e5-46be-8b82-6c6a2fef3ab2", "value": "36832933A0749271FAD28EF05768996C4E176D7E0F8DD8E730496A192BB1F4197303EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521134, "uuid": "a8de7c2a-fead-4056-ac76-220a9010ffee", "value": "460f9cd83bcc5d612a8fc7838b465d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521134, "uuid": "419af545-a195-4903-80d8-5e09f6fdd0d5", "value": "1536:9ZoWW/JVs1tT7pOalilHY0NgYFSTL52ubQODd:9ZFJ79UlHY+tFSg2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621521134, "uuid": "44427cb1-2395-4cc8-90f6-b02af1cc8930", "value": 87768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621521134, "uuid": "921696a0-ff07-4967-9525-7de4aca618c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521134, "uuid": "25d30cef-49a2-42d5-b239-3deb67b46867", "value": "405fb8aa2e5c03fabef74abbbf331192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50999b2-b990-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531672, "uuid": "3ac45f52-9ad5-4898-9076-432c43233eaf", "comment": "Malware payload (Dridex)", "value": "f9ff54458f1b05253a40893357422da1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531672, "uuid": "735c5533-c277-4143-ba6f-5ed7e8cd322d", "comment": "Malware payload (Dridex)", "value": "0b649ca56f6405e052d9eecc45470df28c70aa89df32559cb5648ae23421fea4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531672, "uuid": "ee63009c-5d17-414d-b619-3aff1b335969", "comment": "Malware payload (Dridex)", "value": "288dadca4ebb845b4272a6a638eb6a0c12fd92d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531672, "uuid": "caa932d3-d3ba-4a4f-b2ff-2e0339b72754", "comment": "Malware payload (Dridex)", "value": "18d92499989104033d0a5ed5d30cc6cc847d7a81fc894bc6ede7b5beb0a32eab3ee2919a3638699c541efd6e11d3729d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531672, "uuid": "3180e969-98fa-4b6c-9dfd-e385973dabcd", "value": "C804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531672, "uuid": "f814f882-0db8-43a4-8b82-3b58a2ed3716", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531672, "uuid": "4b3307e6-6cdf-489b-8451-c10bc2cc3059", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531672, "uuid": "8672ef3e-5bb5-41f1-aa1e-cda4c595d412", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531672, "uuid": "f5a1534c-6d7f-46ed-8b16-772b36759aef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531672, "uuid": "1371e0f6-f50c-4ef1-b976-a84e066c489d", "value": "f9ff5445_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787c1d55-b986-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1621527276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527276, "uuid": "09b21743-6293-4b75-936f-09cfe4e7de54", "comment": "Malware payload (IcedID)", "value": "9818c6bb49c1f308412ff0b0ddd698c7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527276, "uuid": "1637c6e7-d3c3-4cf5-bb2c-e528eaff1cda", "comment": "Malware payload (IcedID)", "value": "0b65390f46e398f97782a7f920d7432cd0df1f8e07aed49487bb0b1b24a2dcae", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527276, "uuid": "ce1bb35e-fb53-4213-8da0-e8f011c70451", "comment": "Malware payload (IcedID)", "value": "39d7cb4801eedd73000b9685733993abfccdfd52", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527276, "uuid": "11838918-0cd3-4230-b204-b5a4ded3cf56", "comment": "Malware payload (IcedID)", "value": "a3c430cd79ac95bdc1cf0b661749150be0365535d253d59a5d80dfec4a4badf8004c869b0b1eb7ea7f2c251531588a5e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527276, "uuid": "121fe487-c68b-47b6-8e96-334b9e16d743", "value": "C104123CD0764D49C2D5543BDC58C2999C262162ADF8B49D658C7998EB237F30FAFB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527276, "uuid": "a104ad74-80ba-4c19-b50b-003cd2164bcb", "value": "3072:cgKAXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGRL:cgK4E5SDvbXAyHbVt15wTQDYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527276, "uuid": "fdb124ec-c724-4a9b-8652-6ac73d028f27", "value": 178240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527276, "uuid": "d20b92de-93a9-4490-8662-c4e243b657b3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527276, "uuid": "ab53abc9-44d8-4096-b1cc-f5b9386ff040", "value": "9818c6bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd65932-b930-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490432, "uuid": "e13d8aa8-4cc6-406e-95d1-f71148d7c260", "comment": "Malware payload (Dridex)", "value": "dc1e950e11b1f7a31bb16b159a9003de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490432, "uuid": "cce9af5a-6a35-4221-8ede-374e40f6c0a8", "comment": "Malware payload (Dridex)", "value": "0b8ad8249a10e3099dd9c092aef36df4f875311c9e330f2c5f002dc72ec745a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490432, "uuid": "fb83c572-5a33-49e3-a587-2c94dceac794", "comment": "Malware payload (Dridex)", "value": "7a2d5584b94fe76f4d55c9d819841805fcaf3429", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490432, "uuid": "981e12cd-adc4-4f99-91b0-181795672572", "comment": "Malware payload (Dridex)", "value": "31d366fd7788b84a8382fcdb332377c253d3285d24e6158df25bf9a2fc85e60c2fc446d016d8f72ffcd6e8c46ea2e992", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490432, "uuid": "5d992c0b-d80d-4a5e-b3f8-bbdfcc5661f8", "value": "71F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490432, "uuid": "543ecba2-7b4f-4172-9900-c7be062a8b96", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490432, "uuid": "552256ba-a66d-42a1-9b5f-dfec92590414", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490432, "uuid": "07e477a7-66a3-499a-bff1-1a54fcaadc72", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490432, "uuid": "782a5fc3-77d5-44fa-b904-eea25775b2b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490432, "uuid": "b82e8200-e6d5-42c4-a08a-466b324c87b7", "value": "dc1e950e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb714a6-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530934, "uuid": "49241805-bcd9-4ba4-a138-ccbd20387982", "comment": "Malware payload (Dridex)", "value": "49cf496ad2a91b72890f5b4bf6910946", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530934, "uuid": "198e3a2a-1822-4607-bf0b-471b5712dc94", "comment": "Malware payload (Dridex)", "value": "0bcf0718757f8442a00dd67e369ad83689decd540a24004d656cb9215c944de6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530934, "uuid": "f2870750-6347-46f8-9fa3-fb16effbf1b3", "comment": "Malware payload (Dridex)", "value": "d4c46abcd10b6c17be378aea20e6cdfc17fe4d56", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530934, "uuid": "398c2bca-9b7c-4d92-ad7a-83335cef9c58", "comment": "Malware payload (Dridex)", "value": "de3e439381df8f728cfd588a51f6f2877b957c4f15632ed28aecc20f0ffa1d02f72cdc257ca178738dc5ac89f1a60494", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530934, "uuid": "bd5c532d-ccdd-4427-9167-c22522f08ae3", "value": "E004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530934, "uuid": "44a38c41-5bf5-4a3b-b3b5-ac6376dc1c9c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530934, "uuid": "2d7a68de-a49d-4607-a6a9-1e6d621f20ee", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530934, "uuid": "e1b693e2-3f76-460e-be0b-e8899ccf1765", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530934, "uuid": "8dbb2b1c-b12d-40ef-a5d0-1e8108d0ca38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530934, "uuid": "da6fbcf4-8965-46df-a7df-5f5be50f35ca", "value": "49cf496a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de46d86-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539338, "uuid": "07a5b959-a9d9-4411-a291-8c8c71cc24e9", "comment": "Malware payload", "value": "007a5bf6cffef08078301481a5bca2f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539338, "uuid": "716659a5-da9e-41b3-af17-43fc2bfc55c5", "comment": "Malware payload", "value": "0bdf934414425cdc5086f4f733ad16de7c0563307a76bc3c938f3fd6229a3829", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539338, "uuid": "fe7c7c06-b7f4-41c3-b6cf-6bbd4f0be8f0", "comment": "Malware payload", "value": "8c8445813a04b4ef6faa56f1c25573e155e29c8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539338, "uuid": "13337819-149f-42b1-8263-72efe70d2429", "comment": "Malware payload", "value": "a3043f9c6dd98078fc304cc40a0bc68ce7a00d1e910213e679be75f7ad95b2ebb40f96dd6fc82b3e64498ce5c34aa6f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539338, "uuid": "002f0739-f177-496a-865e-c87f3d5ed767", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539338, "uuid": "9a7022e2-7e3e-465e-a661-ec2f31c5fd08", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539338, "uuid": "96dcd8c2-34bf-4ea4-a620-639063510a7e", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539338, "uuid": "febe81cb-35fe-4a56-849f-0afd2c5feffe", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539338, "uuid": "bed01b2a-98cd-4707-8a4a-d7112c5fdd12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539338, "uuid": "a2f3d8ae-0fc8-4edd-82c0-54e85e50b461", "value": "007a5bf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d18332b-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533350, "uuid": "0595c9e8-884b-4754-b2d4-919d541a6862", "comment": "Malware payload (Dridex)", "value": "5113792942291065d3526ee1e3f23ccd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533350, "uuid": "d96d65f8-db8d-420a-b856-2c3d5c298dc3", "comment": "Malware payload (Dridex)", "value": "0bf03b1b34fc770140a1e894eece163b546ebf6470559503e1bd94452f9d4cd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533350, "uuid": "6402191a-e795-488b-8d79-745c4e19da17", "comment": "Malware payload (Dridex)", "value": "481806e27d658e42aea5eac274121327b6f1a213", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533350, "uuid": "139e93b3-c94f-4766-87fd-1516c93507e5", "comment": "Malware payload (Dridex)", "value": "ffc214d487701b2e74798110c2eac8c796f2215443ce0444a11adc450ecd2950de6c810903af252876cc7619640892da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533350, "uuid": "d6924cbe-8dfa-40e9-857b-f7c253eb5470", "value": "F704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533350, "uuid": "66ae3ad4-54b8-4639-97cd-d15eb3ca7a4e", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533350, "uuid": "b99e8dea-429c-42c7-8e75-7ce771807dda", "value": "3072:Ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:JH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533350, "uuid": "3052779f-0b83-4328-b1e9-fac6d46e22e4", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533350, "uuid": "b2436df1-a3d7-437e-9c24-6ec978d06704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533350, "uuid": "6c576089-a9ab-4dac-98a5-cf9e7b99e8fc", "value": "51137929_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17c1696-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552336, "uuid": "00e27855-b15d-4fbc-895b-5065a85c8447", "comment": "Malware payload", "value": "ec240f10d5104a0116184d91ecc72fac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552336, "uuid": "0bb25ad5-b738-45df-adcd-1c67cc0e0de8", "comment": "Malware payload", "value": "0c51a18e72e3b7091259380c21db4338da87112c46698e02821242f250a181a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552336, "uuid": "c5384303-bb27-46ae-b705-2ae3a53d65b5", "comment": "Malware payload", "value": "060877fa266ace446a8309f46acbc5166c891048", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552336, "uuid": "ae212df6-0064-47af-8176-f606daa42268", "comment": "Malware payload", "value": "4d8f23a115af4d289f4a96291e50ea9059beeb0f0d7306ec5e40cadcffe17bac559e2ded40e68e70433036ab883a7e63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552336, "uuid": "2dc4e9f6-937a-4092-9d4e-36c61798f392", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552336, "uuid": "d1f068c1-843d-402e-88c8-09e66d9b56db", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552336, "uuid": "3247453d-5dc2-467e-8ca3-792bc4266447", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552336, "uuid": "33532403-5927-41d8-b1d7-b6fc198fdc8d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552336, "uuid": "204ac955-5102-481d-a4a1-3e6a6a72a1a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552336, "uuid": "794a9fe9-d2c8-4cdd-8101-c16847862208", "value": "ec240f10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ad3447-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538123, "uuid": "aa1729f0-8c8e-4a23-99f0-911d5251dff6", "comment": "Malware payload", "value": "f228daa5647666d29fd8a3450293867b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538123, "uuid": "1b6efc35-3645-48e4-ae91-19dc6c1be612", "comment": "Malware payload", "value": "0c63172bdfe14f19a76c34ce3d9528761fc2e3b7e39d9a10ad5ee8a64cd79f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538123, "uuid": "b265c3b1-4085-4e33-b9be-a40c1d0ed385", "comment": "Malware payload", "value": "71a0babceaa1cbda858383be9daeac2dd0ab0d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538123, "uuid": "65787ca0-c46d-43db-82d7-644eded32ef6", "comment": "Malware payload", "value": "6704d70ec64af6a64674c55545658e96d57667fe8f120650b435fab26272a26556d455ef8da44f719ee80ca1ed73cac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538123, "uuid": "6142830b-daf7-40e7-bdd5-e865df1c5a27", "value": "7CD4CF23329C5B5DD6BEA7B53435013007FAEF539721FA0D7ED5EC9E0061A4C8A62AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538123, "uuid": "b718cd94-9f9a-468d-9dcd-8b1b256feea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538123, "uuid": "7c5f7911-8471-4e63-a71c-b974122b9016", "value": "12288:qJWxDJPTHjI9fGd9N6Z/13nIm8Ab5wnGMHSjJQbqIB70SKz:qs7jmE0N3nIuwlSjJKqIQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538123, "uuid": "65d6754b-b865-453c-a343-2fafcaa85f86", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538123, "uuid": "7ab93a4d-0727-4d69-9040-635578f3f070", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538123, "uuid": "ebb704ec-4537-4df6-8a6b-0373976f4a98", "value": "PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5830cde-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527781, "uuid": "6e86694a-6edd-4d25-9372-76d606317e53", "comment": "Malware payload (Dridex)", "value": "d14b9873f7b8fe7c1f9f5013a11d403f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527781, "uuid": "f45fa296-f104-40bf-921c-dce77464fa3f", "comment": "Malware payload (Dridex)", "value": "0c9fb11326e5b4bd6b3106f7dd6cb612f314345f99e7186feef6d9bfea3e6c41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527781, "uuid": "61eaa7c6-0946-4723-88eb-0c173efca458", "comment": "Malware payload (Dridex)", "value": "91d9a23ff70358f8b0cbedc0cc9b219475a09e6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527781, "uuid": "cc41af6a-1c01-4d3e-bbd3-12e61e7eac70", "comment": "Malware payload (Dridex)", "value": "f9ac506695281e182644a46031462a23e684d2499b862f130088aa32b4d0bd57552868769048b8915559104f3545d9da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527781, "uuid": "171f06e9-8b9a-4c92-aa4d-4026c4d3b935", "value": "1C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527781, "uuid": "f2395ebb-10aa-4f23-a98e-726e7d02dd5f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527781, "uuid": "9de256d0-5c34-42a1-b58a-3b0a4647f348", "value": "3072:8i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:8H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527781, "uuid": "114db839-4e32-4a59-be25-175eda55921c", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527781, "uuid": "699ffe7a-4d29-44cc-8277-d277000923fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527781, "uuid": "7e835ef0-8ca6-4b0d-aee2-8c148016f2ea", "value": "d14b9873_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f016da-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541683, "uuid": "53fa9136-112f-4b91-9de1-fd3501cb6758", "comment": "Malware payload", "value": "2efe2460af065195b2df7f60187a0bb6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541683, "uuid": "95dcd462-e547-42b5-847d-55b8cf49628c", "comment": "Malware payload", "value": "0cf58fab8c91a02288ff7061ab0dc9940078bd4e877be38fd9f11e9ca8c68f98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541683, "uuid": "5700a7a6-9819-4059-adcf-69a0d76e23ad", "comment": "Malware payload", "value": "eaa8fe8b5e79c3716c48c0c5793202a064d60019", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541683, "uuid": "786aaa42-8697-4f32-a77c-da116c4d8974", "comment": "Malware payload", "value": "e62330400d38247d59fcd97ff54cadece5a1e71dd667f3e8d45bcc1731dd7cb3c9e0738bd9f5c4852326873cc83bb044", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541683, "uuid": "23c904ab-2ee3-45be-b057-1426ed86c0b9", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541683, "uuid": "f764b622-691a-483f-98ec-4d3b7ccd0cad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541683, "uuid": "572b0d76-5e24-46e9-b07a-434a54b49d28", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541683, "uuid": "3389a508-fee2-4778-a38b-52850a41eee5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541683, "uuid": "a383727e-09b9-4e8c-8600-a02b07d11cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541683, "uuid": "04c1a30f-d8ee-4e63-afe9-2603ebb85a9e", "value": "2efe2460_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e158abc7-b941-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621497816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497816, "uuid": "1fece560-999a-4ee3-9816-d40e9eb5aa28", "comment": "Malware payload (AgentTesla)", "value": "e56bfe79944bcf12723189ce58d7b21e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497816, "uuid": "3a028900-aa29-4ada-9abd-8be46d4b1420", "comment": "Malware payload (AgentTesla)", "value": "0cfa8f4e2f2be3c0f075c860206c27daa3b185c05eb1f1b413fdf8e79dceba26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497816, "uuid": "6163ff3a-5e05-4abf-9cab-225cf80a48cb", "comment": "Malware payload (AgentTesla)", "value": "2398d252433d9f387a9ffad07a98120b53db9d0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497816, "uuid": "53347b81-55f2-401b-8aa4-88759c38d336", "comment": "Malware payload (AgentTesla)", "value": "05208408e34ce426ed6a8e841ad2fbb29237dddedb6e52da8a8f35c31f20d75fd225f0b21542b5e53d92ac8d41b5fd6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497816, "uuid": "cc2f8dd0-262a-4183-ae2e-7e98d3c260b3", "value": "92E4234681C0385A8D3261472F751E865847FBBE58FB98CDC14B3A2B3C996EA40DF9DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497816, "uuid": "6adae88b-db61-43ab-b83c-4cf0a84ff3cb", "value": "12288:6COIuUHkRV2ynsWAJP+Mxwle4ylYOauD6XMh99ILFd3qWjerIkrwEouWVyFvB2:6CO9UEb3sWAJP+1zYs5FJe0kpCyFvB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621497816, "uuid": "1455a4a7-c1f1-4cca-bcd0-541f57139242", "value": 714579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621497816, "uuid": "7f61ddb5-da59-4c40-ba83-304af877a9f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497816, "uuid": "e251bac9-e26d-4bb8-8691-a1c34afe0aa7", "value": "e56bfe79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8741c826-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "0881eb8d-0c8f-491c-9d28-ff8c5656be41", "comment": "Malware payload (Dridex)", "value": "a256fabb976fab47a4e4924f0303b4a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "810afeb1-b357-49cf-b206-02c24f7b9881", "comment": "Malware payload (Dridex)", "value": "0d159ebfc62ad240bc628eec1bf13140f71443ab1214f21b8a5d088542969465", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "263cc82b-3411-4237-9546-485b174271b4", "comment": "Malware payload (Dridex)", "value": "03b4602a412ef20507353a2748bc95359174f038", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "b2298dbd-4eeb-4d5a-94f5-bca84c8135ee", "comment": "Malware payload (Dridex)", "value": "f754cbd6e4fcb3c16dd9832950ab8a8be5ef1dd34d5e63c568cae671bd3f522be87c4861701763edc08c0c82eeec490e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530737, "uuid": "b78b758a-04bd-4caa-88f5-97e2336bdd5d", "value": "6204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530737, "uuid": "d5b7528b-44eb-4b85-b538-5c4f33431e7f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530737, "uuid": "61278c40-924e-43b3-b1f8-a8641eff4c5f", "value": "3072:UV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:UV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530737, "uuid": "63b26c72-f39b-439d-8afb-3c4d46faceee", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530737, "uuid": "82ef8c5b-dd64-4032-80dc-1a7533de7d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530737, "uuid": "0c6fcde6-936d-49b0-aa6a-697fbbd18ece", "value": "a256fabb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36597bf3-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535755, "uuid": "b0005d43-497d-4df4-9994-48df42bc5140", "comment": "Malware payload (Dridex)", "value": "b6c86f4a1d4329fb80718f7ed5371786", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535755, "uuid": "53be58ae-81cc-4a81-8e66-73c1a8e20956", "comment": "Malware payload (Dridex)", "value": "0d332da99836f6c244db9f5284c02dac91596565c233cf80fe242fc48949e083", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535755, "uuid": "10254fe4-7b1e-4048-a234-477c81e6b011", "comment": "Malware payload (Dridex)", "value": "3ad6cb9ba24f08c8de5d2e9746d011e160d72acc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535755, "uuid": "3564e756-e343-4310-98ff-6e9bf284ced7", "comment": "Malware payload (Dridex)", "value": "291c10d99e214aa585c2da97087d95036d8b39a7f7c926811eaf16a773131c2ee14cdb074d45cdbea7d31ee3236f8158", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535755, "uuid": "7b96391e-4329-4b5a-a912-1485551c3eed", "value": "C204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535755, "uuid": "d320e920-0708-4b49-8928-f20927b7f0ed", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535755, "uuid": "ba04a294-916f-4650-803e-27662bea2e21", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535755, "uuid": "c8388b21-2e5a-4c69-bc41-088163d77c19", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535755, "uuid": "df48728a-e671-476e-9fbb-8bda492e3e97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535755, "uuid": "73791856-2ad9-4603-802a-3c5b5b9d82f7", "value": "b6c86f4a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12d8f5d-b9a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621538538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538538, "uuid": "07dce50a-62cf-4703-89f5-7d9f77b9a000", "comment": "Malware payload (Dridex)", "value": "9db7914308c23f9db68dd84528963456", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538538, "uuid": "1191ef8a-3aca-4330-976c-84b752c57b6d", "comment": "Malware payload (Dridex)", "value": "0d34ee41a1089ff9458b3960adec3a7aa67e46f4321c0402c0e48ac5b5e6d5a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538538, "uuid": "9a14980a-ad10-45ab-9669-4acf5d2244d0", "comment": "Malware payload (Dridex)", "value": "d099ea1394ded732d0e76dc25548928d43f1e2d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538538, "uuid": "334cd4cd-50c0-4c4f-878c-b107dca3100e", "comment": "Malware payload (Dridex)", "value": "d927525d8e9c06668c6cb6da5644ae5287a16978b2ec2cf5e8ec1f87072fd4bc8e0621bb10ed538d52acb8052a581ff5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538538, "uuid": "dd47f7ba-0c9a-4135-bb41-50105553ce29", "value": "AE04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538538, "uuid": "5c713b19-280c-4f1c-af75-cc42f0f1d4cd", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538538, "uuid": "93bcfe5e-9345-4f3b-b909-114a3d56dc25", "value": "3072:3i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:3H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538538, "uuid": "ec066675-ba50-41d4-9935-abb4c62de973", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538538, "uuid": "4afff104-4c6e-4e1a-9bc3-b2ffb8bebca0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538538, "uuid": "6d2afdb1-eeb7-4735-849d-759e120f58de", "value": "9db79143_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15ff939-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535934, "uuid": "17c6c8f8-33bf-4cd0-95af-ef2dc555733a", "comment": "Malware payload (Dridex)", "value": "4a3c5f716fec7c0cb4f716266402ce2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535934, "uuid": "94bb298e-7320-474a-b13f-4f77c019b588", "comment": "Malware payload (Dridex)", "value": "0d530bcc1ae8a705d38382123d01371a20c9fbd26f5ae85208fd6f5a9d72a386", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535934, "uuid": "2fcf17d0-593e-4a70-a843-634047778934", "comment": "Malware payload (Dridex)", "value": "b0f44214d79ad3d1edf5d7d4be47fdaadeb15d7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535934, "uuid": "51890a14-f6b1-41b6-af52-3d6d87048c71", "comment": "Malware payload (Dridex)", "value": "073f39649c7f7169281df90e47c36ef841f2a8b05095642a3f231454827099520b840db5a64f46a765789cbe5b061672", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535934, "uuid": "94ef7528-7c08-4335-911e-a682973deb24", "value": "4E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535934, "uuid": "379e9e90-fcbf-4479-8e15-8265c5310c28", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535934, "uuid": "eadd2ab4-b6a8-4420-8a6d-bdff45c20f5a", "value": "3072:Xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:XH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535934, "uuid": "b47c161a-9443-49c2-b1b7-fbdaf0c45351", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535934, "uuid": "433ca087-200b-4f73-9c84-61156ee03e69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535934, "uuid": "e65ee25d-eee3-48eb-92f7-9342cdfc1da1", "value": "4a3c5f71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75aeba65-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540586, "uuid": "3aa1df75-fea3-45ec-9098-e6a36c36fc73", "comment": "Malware payload", "value": "948bdbde38f148629d2762df5fa26455", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540586, "uuid": "19300e8d-e1ac-42c5-b593-d93251d26e3d", "comment": "Malware payload", "value": "0d57a8fb6565cead22506bd128e3285934b0114ae02ec7ef01d625c0834d0668", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540586, "uuid": "88f663af-1607-4247-a751-6fc8047e4db5", "comment": "Malware payload", "value": "4d38de259f231310c73dc1661dc7e7d642bedae4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540586, "uuid": "93874727-63b1-428b-91b9-f41473e8d894", "comment": "Malware payload", "value": "0c7820fef223cbbf6f5c995d9b519428039481ec1bc1e8647b380119468963954cf5693a08932aad35db470ca8c3500a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540586, "uuid": "aa43b197-0418-47a3-b506-2645169d4a84", "value": "A604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540586, "uuid": "f1708d38-5228-4653-a9b4-974399f322d9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540586, "uuid": "335febe6-8033-4d69-9cc8-9be462620e9d", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540586, "uuid": "df571c2c-23b7-427a-ad17-aab24999ebb5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540586, "uuid": "c58f86f9-8148-4e3a-b67a-8a72ce22caee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540586, "uuid": "09e95953-2d17-4d71-918d-8a41bd74070e", "value": "948bdbde_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb187b8-b986-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527337, "uuid": "80a28492-6994-448a-9d82-f4dd6ee24ea2", "comment": "Malware payload (Dridex)", "value": "e73038fe7ffc8970b143f3471213ecfb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527337, "uuid": "119abe64-c61e-4ace-919b-7d26056a0ed3", "comment": "Malware payload (Dridex)", "value": "0d687c9d027f38e5b89a483771a0252281615a4e524eb0de567de40223156ec9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527337, "uuid": "917e3774-57ab-42ee-a48b-8b7796725233", "comment": "Malware payload (Dridex)", "value": "2e54f68705cf6f5edb338994585463beab4399f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527337, "uuid": "750b616f-4d23-458b-86a4-cd4747f806fc", "comment": "Malware payload (Dridex)", "value": "00b27af91b2e5e27c76cfb2343a5d5a7dadf6786bcc4d345d4b7e9fbfb81f5f004a3246c8e264eff650f2ef77fe4f9f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527337, "uuid": "0713e32d-e93a-4331-8db3-2699e5af0e31", "value": "4D04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527337, "uuid": "5d6e4bf1-e97a-47ec-8a73-d2c7616f66e8", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527337, "uuid": "2272fb24-75c3-43ac-93b8-bb382a0f90f7", "value": "3072:ai49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:aH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527337, "uuid": "a984a236-89ef-4661-b677-a1072ba8082b", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527337, "uuid": "6f617831-b4a8-4c88-8c58-73b21948e18e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527337, "uuid": "524be71a-aaba-4653-9f7e-0e78693d7652", "value": "e73038fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f89cc56-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529918, "uuid": "4e643890-4b69-4099-b661-324a2c1586ab", "comment": "Malware payload (Dridex)", "value": "1480a15691f6788d381b45c0a260036f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529918, "uuid": "bfc8b3d1-281f-40fb-994d-d7fbcc37a80a", "comment": "Malware payload (Dridex)", "value": "0d7482f534412a9d9f9bd0118a5945fed353c490931d67e8f5612deb2fff3cd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529918, "uuid": "aad3beaa-cf2c-4f63-9996-b2168e98334e", "comment": "Malware payload (Dridex)", "value": "b8ad85ee4ab3a9c2a1cd0c981db085269b750913", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529918, "uuid": "f063e8d5-cc79-467d-8820-f46812a5699c", "comment": "Malware payload (Dridex)", "value": "41518bcf758d0f45d3429a9d52ebbe0ca7b777e0ee95830f3677ae9360827833065637dd8cefdbf3b0b7e2c45dcc064b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529918, "uuid": "dd321d09-7905-4dfc-92e4-4c1d7fe4b8be", "value": "5204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529918, "uuid": "014a1631-f445-4b9c-99fb-a9a85c51c6cd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529918, "uuid": "f767a674-aad3-4f3d-b0dd-0f10bc483d31", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529918, "uuid": "44853a3e-3b92-43af-8dc1-e9d2aa0c5935", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529918, "uuid": "eb79b74a-6781-4a05-9ff8-53ba7d95a486", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529918, "uuid": "deb691f4-18d8-4127-945f-36b7eb5a06ae", "value": "1480a156_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b0e628-b955-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621506340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506340, "uuid": "5f5cc41f-be9f-41af-afa3-1a702f909ca9", "comment": "Malware payload (RemcosRAT)", "value": "97aeb99ca82049add85417ceacf05b7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506340, "uuid": "0ee004d5-ad2d-4540-8d95-41c18b48c777", "comment": "Malware payload (RemcosRAT)", "value": "0dbc7401908f4c77ba9380f1f1d04ee61734a6116331745cd09d88ac368a2736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506340, "uuid": "af90a805-03c2-4933-9c95-f19e2c9e9b9b", "comment": "Malware payload (RemcosRAT)", "value": "a307c6454e7e8c11693fcbeb2ebaada1884293f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506340, "uuid": "4b657a52-5ce4-4845-b094-e920e18f7fbe", "comment": "Malware payload (RemcosRAT)", "value": "aa7309b97015121d3080a5f5085811b93856fd271e273f6b549c03ff3ec17eaa1c7f9ab3b40f1455116c536012ab7d2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506340, "uuid": "a20c3e62-0a6c-4c8f-9d15-028bb436fbaf", "value": "C114021271EA9CF7E52E0FB251B3D375BB769D2412420B0F67913F3B65702038A269A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506340, "uuid": "f3d46a45-151f-4c14-9f5a-dcd7a5ddf740", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506340, "uuid": "c9e4742b-311c-4a81-a46f-e5201e71daaf", "value": "3072:MQIURTXJV0kuMmZULl8kk0pWRfp03ZMLGlfG1sc80mdF8KWTbqgRGAbH:MsxjFukkxeu1sc8XgVTbD/bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621506340, "uuid": "1350ad44-62db-4a47-9aac-a57bb892fff2", "value": 198804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621506340, "uuid": "bfc10235-9a9f-4dd4-9633-4c4e57e57fed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506340, "uuid": "235396fd-d41e-4ddb-9ce6-54c6fe0ff69d", "value": "RECHNUNGSKAUF Bestellung-46509008.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b8b72a-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539196, "uuid": "f37ff495-feb9-4d7a-b07f-0c6cdfb31ba3", "comment": "Malware payload", "value": "cfa301a0ec8a1889eaf6bc7ea2ea745e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539196, "uuid": "cd2436a9-f164-4456-b60a-d392b9e3182a", "comment": "Malware payload", "value": "0df05fbd3c33a7fd2af1c79d6e83ede261b0ba612d75504db6b4a2b372960500", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539196, "uuid": "7b50e0f6-d564-4033-92a8-e100e07d49c5", "comment": "Malware payload", "value": "1a41a3b9b50681a201992b1feed99c42319a76f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539196, "uuid": "125787a9-a208-4554-9cb9-287fa93dbb1b", "comment": "Malware payload", "value": "1ff4eb47ea7cc1cfd259594d4ddf9ece5ff584435a12ecb09d4737e2cc925f724518bf20aba9fed7b0e7f5771037db4d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539196, "uuid": "ed335206-d926-4c6c-b4e2-544d43d331ed", "value": "0E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539196, "uuid": "7ca63833-8707-494c-84d9-fc292a390762", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539196, "uuid": "71a6b968-1280-49f8-a9fb-3679cf6608a2", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539196, "uuid": "21e26698-a3f5-4a23-bc42-4f3bfd2b4c3b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539196, "uuid": "cd44f7d9-f589-4565-ad6d-d09ee7755054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539196, "uuid": "0b9b85fc-8cd9-4ba9-883c-f617abb789f3", "value": "cfa301a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7de1e82-b93d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621496109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621496109, "uuid": "a27229c0-1937-434d-9aa8-eb8c01699629", "comment": "Malware payload (Formbook)", "value": "b37d7a3617d864a921fed66446cf506b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621496109, "uuid": "93b2104d-5c4a-4468-b430-c9f20612114f", "comment": "Malware payload (Formbook)", "value": "0e46a3b97231f644213f60744bedab18b175663564f26462a3bc5e07e096edbe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621496109, "uuid": "577bb989-1658-4310-998b-30957d82131b", "comment": "Malware payload (Formbook)", "value": "1e7ca314fcdb1efb00f43f716004392df60496e2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621496109, "uuid": "0bda10c8-3c52-4971-aa83-2f0ea586deb5", "comment": "Malware payload (Formbook)", "value": "de3c8ae6c4db50b377b8f7001ef91a442ba99942080f51f48d627ebb2702774857ba6acc16302109f3ba8d0d3e609c51", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621496109, "uuid": "25cc09b2-a648-4d74-94e2-d506abeb3a94", "value": "4BA4E3CD44801A4AEC123B3C02F65871516BBF5C3FB6A5DF4A9576923A33DD2A31AE0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621496109, "uuid": "9647f418-5f12-49c1-9674-2bd6c452a5de", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621496109, "uuid": "a3d1b0fb-106a-4033-af1f-6e90674503a7", "value": "3072:nQIURTXJjYaBrdMj7n0Q+84APuWH2Fd4uWbzQGNB1pSk9x2LoM/ygjkeX9Ypz:nsV0/0QVuWeRsh7pVXMn1NUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621496109, "uuid": "30d67524-bd55-4b58-8e2b-45e9962d9f26", "value": 483609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621496109, "uuid": "719d5b5b-1b3c-4c5b-9687-23e663785db3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621496109, "uuid": "5d860352-d01c-4c3c-9bb7-3df17ee143dd", "value": "catalogo prodotti2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8aa11-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546366, "uuid": "f2d7a3ee-db10-4e0b-84b6-b038cc3f865d", "comment": "Malware payload", "value": "83f738d210adc9a2018934bb10908b3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546366, "uuid": "ce005d9b-63f6-49f8-a7e8-b9d61a077b9b", "comment": "Malware payload", "value": "0e7ae259f8d36eeb3530f5bfb671fdfb312c3fcdf0378e9ec4bad07b8adcc743", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546366, "uuid": "770d3158-335b-4921-8668-ac6a89ed316c", "comment": "Malware payload", "value": "4254d3c9c9597a94359f5d770db804e7aea109fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546366, "uuid": "bd4e1e3d-80cf-4c70-b30d-5534006b8493", "comment": "Malware payload", "value": "26eb54f1d684dec0d8e287c243ac3d1b53ccbdf5ffaa71bb701703466c2334ea9f3666993ceb2a7969e3d73445215efb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546366, "uuid": "6c5c17ba-29bb-4eda-bf38-809b198972c6", "value": "72F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546366, "uuid": "dacb3b98-f2dc-4c2b-8a08-56cc3ce479d7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546366, "uuid": "77045ca0-5df5-481d-bd84-fe565f6bc039", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546366, "uuid": "525f7786-4336-4a9e-b325-36e71fab47a4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546366, "uuid": "3c944765-102b-44e4-aa1a-70ef6c2d95d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546366, "uuid": "12cc766c-b90e-4de0-8883-23efeeb9d3c6", "value": "83f738d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699613bc-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536700, "uuid": "7587be00-f3b6-47bc-b027-2657d7d0b902", "comment": "Malware payload (Dridex)", "value": "527004fcf6c8bc0ed3028bf424ef50f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536700, "uuid": "c6b8407b-f68b-45a4-9067-e9573b63dd84", "comment": "Malware payload (Dridex)", "value": "0e87f4aad39f616be58e434dad6ed18bffd4a6facc5908e80a013f9ffac3b6d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536700, "uuid": "30f0cdf5-62c0-4d57-aba6-1d3c61f20c14", "comment": "Malware payload (Dridex)", "value": "fb992207d41311c95a49b32ddec8501bf4d5a1ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536700, "uuid": "f972160d-2550-44c8-9fda-1a88602eb985", "comment": "Malware payload (Dridex)", "value": "1b79d041113589678175dfe0c7cce1120b374e406102cd208f78125b6a7cbbc60540a893033d784d1dc481c51583e2c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536700, "uuid": "beeefb00-c1b0-4bc2-834d-813f563d6d95", "value": "2404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536700, "uuid": "d691714c-4b80-4f58-a6e8-fee246a893ac", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536700, "uuid": "f7bf38a7-de41-43cd-b36f-ecc3ae2d87a0", "value": "3072:VV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:VV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536700, "uuid": "afa2665e-4439-4d81-bf07-f7971821aed0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536700, "uuid": "0157e837-d666-4054-bbf5-0bdbb75442f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536700, "uuid": "cc5ed5aa-b188-4b52-87a0-266228d0ace5", "value": "527004fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753faf7c-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532424, "uuid": "04f4b953-ee0f-4229-a081-334455b9b576", "comment": "Malware payload (Dridex)", "value": "4db2c5e52baa2d97a96489cbb908ab9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532424, "uuid": "3a5a8945-6243-4628-9bb2-2a118df6d104", "comment": "Malware payload (Dridex)", "value": "0e8bbbcb9949979242c2735d243b511d80c6c4aacbc91d151bcb0a2ab5dd709b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532424, "uuid": "c7ca3ce6-3c2f-4dae-a70d-689aad9fda4f", "comment": "Malware payload (Dridex)", "value": "6e3ebeafbdc6b31d2ed70f195dd043db9a041081", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532424, "uuid": "0971919c-6185-4642-a4e5-803e6398e02d", "comment": "Malware payload (Dridex)", "value": "4cd05cf99063be25d69243a38d1f88795e51fccc734faf88c70f5be8b81894b83f1af06b529f11a2b092072095f90944", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532424, "uuid": "971f11d7-f5b9-4a11-a849-7f964494d734", "value": "E604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532424, "uuid": "aca733e5-8867-40a2-99e7-90361092695f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532424, "uuid": "53b694fc-1a5a-41da-a622-eaf52f1c3fd0", "value": "3072:5V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:5V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532424, "uuid": "7fbf4cf9-7c06-4a57-9c49-5c27465ba9ce", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532424, "uuid": "0144c52e-0532-4965-bee1-eb4a0c749198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532424, "uuid": "8d6ac6c1-0723-4675-84a8-00e950c44d75", "value": "4db2c5e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a42da5-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468826, "uuid": "4dd4b61f-baa7-406c-9864-6863642d7050", "comment": "Malware payload (Dridex)", "value": "65df625748a6cea0db097951e0e95069", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468826, "uuid": "22f5fe37-c909-49d8-8825-c098f0447453", "comment": "Malware payload (Dridex)", "value": "0e8edd41a3277d9320fc976aeb6af5c212df46030a04abfe239bde313e977e10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468826, "uuid": "09ca1f8f-438c-46b2-b7fe-635c27d75863", "comment": "Malware payload (Dridex)", "value": "f4f012c75fc30a6e6134323a15d5eb864236c38c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468826, "uuid": "b92d91f5-3237-4d21-af3b-96557cc247e0", "comment": "Malware payload (Dridex)", "value": "9d641fccefa256f169de8f79962b8c0777f1c824231bb144dc66ab3f2e822c15f248b408fff0ca7b54b64511dd97ebf1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468826, "uuid": "05d75248-b102-49df-af38-2e1b150dfb48", "value": "4204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468826, "uuid": "fd75367c-ca86-40c7-8260-66fb2a6bc0fa", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468826, "uuid": "478096b5-ed3c-4d3c-b8cc-4523225f22b7", "value": "3072:/i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:/H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468826, "uuid": "e6ab3f50-82bb-4274-944e-3c99ce79f5f4", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468826, "uuid": "45f4c9a3-6254-458c-bb21-e428c32a9f88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468826, "uuid": "3c2bcfb6-e212-4d9d-b95f-0e3a9db45ecf", "value": "65df6257_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25703ca-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530030, "uuid": "f1a54044-1704-41c6-85fb-9aebbdc06de2", "comment": "Malware payload (Dridex)", "value": "3a9353fd665a7d8699caf7632a264e21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530030, "uuid": "d1465434-ac3d-44dd-915b-6cbf1cf37ffe", "comment": "Malware payload (Dridex)", "value": "0eb28b62fc93cf3d711ec202314318d3d62a8c2bca07e254c7375380d408e438", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530030, "uuid": "7f01ed47-c060-4769-88b9-87e82c2083ca", "comment": "Malware payload (Dridex)", "value": "0c96bb497cdadca97d6e39113f020b9fd0382588", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530030, "uuid": "e6868b12-7ee4-4b4b-b948-278411c226e4", "comment": "Malware payload (Dridex)", "value": "97e71eec3c83281d96f04150b03dd174b926f03c88b3eb1916254307402c7cd4ebeb9e42cda88df410d9a6e740bb0664", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530030, "uuid": "14b9cbf6-65f6-474e-a926-61a161ce34e6", "value": "7504E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530030, "uuid": "a9a25e16-9af7-4446-a79e-0876029088e6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530030, "uuid": "8446b23a-842c-4f5a-92c6-79f82de02ccc", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530030, "uuid": "261956ab-74cb-475b-854d-cc322d95f3a6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530030, "uuid": "559f65c6-adbb-425b-8b88-4943da56633b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530030, "uuid": "fa17556d-5d71-4d04-b219-3c957f67fbc8", "value": "3a9353fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c023f453-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552307, "uuid": "f1939b23-5f92-461f-b787-9e9d1ad0dacf", "comment": "Malware payload", "value": "3521f6a638e39ddf9b83abfbe5e062d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552307, "uuid": "e862ac54-3244-43d2-8d6d-3a99242e11ff", "comment": "Malware payload", "value": "0ed458c466676594e5feaee03cbd536339dc28c162a266daaccbeaaa7afdb887", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552307, "uuid": "beebd5a8-cd48-4b3c-b3d2-c2098a41f829", "comment": "Malware payload", "value": "6b3d06ca8cae93194c6d46cf775c862bf9e632d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552307, "uuid": "d1c8c114-1f02-4f9f-a84e-1fe0dbc035f9", "comment": "Malware payload", "value": "157d5035f2c31c7c9a08e00ca6e7a3221e1f92c16041fd0c9a150795545b22530fb2c82ab23d435aaddcbbcfbcf68fb0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552307, "uuid": "9c707eed-bc6c-42b1-8b03-497476b53a22", "value": "5F341274E8F0C8A3D4056A321D72CB46CB35E72C1715116F2B610FBE79637B2A99328A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552307, "uuid": "80a07c6a-a710-4426-b7bd-9681f1487b13", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552307, "uuid": "0e366d9e-5306-41f1-a711-3cc139afb47e", "value": "6144:Ds980XuNY9s4j4NyE37j6hwD4QvcqBR6kMJgUPqARKou:y80eNYs4MMELj6hZQRB0FiwKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552307, "uuid": "02937fb1-6953-4d5f-8f3b-0327b44ed234", "value": 235257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552307, "uuid": "e7901504-0caa-4dc0-922a-e779d1c86c4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552307, "uuid": "cdd9d153-1f38-4e0b-b8f7-864576996c7c", "value": "SecuriteInfo.com.W32.Injector.AIC.genEldorado.3990.32484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80edc948-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534591, "uuid": "75421daf-81ba-4586-a1d0-6aeb1c7ace8b", "comment": "Malware payload (Dridex)", "value": "dd415819a1c1e2e75c898a2b0dcb3ab7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534591, "uuid": "ed6e76ae-51c3-4478-a348-67ab91308d9a", "comment": "Malware payload (Dridex)", "value": "0ed5b69284b1ee355ed004098804c3c1373d5250d84d354a502ee520e3f5c657", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534591, "uuid": "84fd4a96-2fe2-4258-8e08-563942773dad", "comment": "Malware payload (Dridex)", "value": "baa4bd121530ffbfe48cc6df760855c865c40458", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534591, "uuid": "bcde0351-6b35-4d2f-aab2-4e29848e6132", "comment": "Malware payload (Dridex)", "value": "366d70165b19138c516c7a082f3ec6e748769a2bba3f0ac38f04d27cea0a46afd809bbcdd72281399eed0b20b783b126", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534591, "uuid": "629846fd-ca9b-48b4-9a0a-89f2cb71caa8", "value": "4404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534591, "uuid": "32924c69-da05-4141-82e3-f2d520d00b68", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534591, "uuid": "23c686ab-9f68-45e1-a079-26e846f385a8", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534591, "uuid": "3e7cf207-8704-40c1-8295-71089edb16d4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534591, "uuid": "d095fdef-d5a9-42b5-8f19-147d2e49a9e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534591, "uuid": "cd62da10-4038-4f3a-b6fa-c99fbfb37293", "value": "dd415819_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7678eb7e-b9b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546600, "uuid": "1b25df05-5827-43ee-a53f-00cc0f104358", "comment": "Malware payload", "value": "fae987b210529735a85dbefd2fa23521", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546600, "uuid": "bcc6c107-33c6-4676-917d-690b4f078a0c", "comment": "Malware payload", "value": "0ef31406662675ee19d52c09b54c7a803efb554f688858ba5d9c1cb41fa13db0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546600, "uuid": "b14e2274-9159-4c79-b7a8-f9010e5b2a90", "comment": "Malware payload", "value": "c2aed10ade929d086af5fcc29561a880a566ea26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546600, "uuid": "904d0c61-21fe-4da0-82e0-dc8790767a2f", "comment": "Malware payload", "value": "fc5e7966c7573ec91710d777fcc93596c26795594d29a5dcbd5acd98a6b3608c5c168b309f203ed55237a677e1e4c47f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546600, "uuid": "c95c3009-b62a-40c5-8117-adf43134a614", "value": "CB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546600, "uuid": "979749f7-b87a-4b19-8431-d84f76d9335d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546600, "uuid": "e9ccdb1a-de4c-4cd9-b1eb-6694446d5888", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546600, "uuid": "8492f066-5258-4894-94cd-edee959f5121", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546600, "uuid": "1aa5dd56-9df1-4396-8cc3-af4f14a2ad30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546600, "uuid": "557205b2-96fd-4301-a895-b48ff068489a", "value": "fae987b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d543ac09-b9ba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621549765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549765, "uuid": "bf011d03-bdbd-4277-b1ae-b0e3f240a62f", "comment": "Malware payload", "value": "5010ec60b6340c9e20966c76e7aa6c9d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549765, "uuid": "6c9330cc-675d-4cf3-8890-1bde1dc55cf1", "comment": "Malware payload", "value": "0f23ee35057415e75d7e72c708a5148bb665f7e3fce2ce7a14036af85498011d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549765, "uuid": "2d34f753-e191-462e-8ef4-e9db2a38d59b", "comment": "Malware payload", "value": "6a7d37ad215f89f76c37bb59fe16641534885689", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549765, "uuid": "5010b8cf-8fd3-4184-9eed-48b64ca28193", "comment": "Malware payload", "value": "bc6f1fac0131491a0ea050d91c93b2d5f16d57871ef3bd129288135cb1c258f2e2e8a3e55d062a7d12fcd4cbbf3fc2c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549765, "uuid": "03a638dc-4b52-4d69-9581-6a24195f67f6", "value": "0404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549765, "uuid": "b59784d2-bba7-4569-b1bd-f56e77eea577", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549765, "uuid": "7c4a7079-47d4-42c2-b774-1b32f23b8ed6", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621549765, "uuid": "7c64c241-3b1b-4932-ba74-32be9a6b924a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621549765, "uuid": "ab7fc4a5-63d7-4cc8-a8c4-c49a66e04a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549765, "uuid": "9042f827-f46e-45fd-847e-850b5853c4c8", "value": "5010ec60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1621b15e-b998-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621534842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534842, "uuid": "5659f848-347e-4a39-b2c8-12dc04f7eea2", "comment": "Malware payload", "value": "67b4a56fcfb3888836e7a560e564a018", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534842, "uuid": "7f93e6f8-d19b-4bd0-8f97-40d95b8b5288", "comment": "Malware payload", "value": "0f2ff60750e50fdfd587c1f4faf1d597571c0c37ff840365daa652011ceab860", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534842, "uuid": "e8e3be62-1a8e-41c7-bdf0-bca295a7486f", "comment": "Malware payload", "value": "93651f02488a51e8fa37b3985eeed950a6fee37b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534842, "uuid": "f2c25ca2-506d-4aef-a481-da7436fc2f2f", "comment": "Malware payload", "value": "65fe2faa7545105d8aac7ab7a35a8246361dbeab9d848f8722732357023bbc08a98e7728e2f7d715fad574d0f87fb44c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534842, "uuid": "4ec6968d-dba6-4bcb-a07f-2a29d8f3b5de", "value": "FB04125BE9E3C6E78A969CF0CE4863657FB272C904C145CDA1344278EFB4F0A50A261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534842, "uuid": "c60d9198-1bc7-47ac-aad0-76799f57970a", "value": "3072:/j9fL7EB2+Ona+quEzXWmMmg2Mpv84B1yqFKaOpkh8gk85qNLJF9tKau:/RAinMzXP3LMpEylFEpkt5Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534842, "uuid": "4e2b46dd-722c-485d-a0a4-7d1fdd4f039b", "value": 173720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534842, "uuid": "35e840df-4e6a-47e8-a5d0-fa2e3eb59dbe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534842, "uuid": "de36c9eb-c0c4-447e-ac33-5de82d74c715", "value": "67b4a56f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc814db-b9a0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538401, "uuid": "9a4e833b-a6c6-45e6-9d7e-d8aaecae7470", "comment": "Malware payload", "value": "414a2ed6e6db7ec25dc4a4fc43ddc4b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538401, "uuid": "0b7ae505-a616-4651-924e-b55cf20a7408", "comment": "Malware payload", "value": "0f38cb8fa913e0dd474a142779fbe73656e37c2158787831feff01da488bf250", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538401, "uuid": "fe4f5b95-0499-4042-9fb9-a0d5df1e3db5", "comment": "Malware payload", "value": "771595cdb644dcb2cd3c4eb3ac8be2917048a158", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538401, "uuid": "8063fab3-526a-483b-a820-81e43c9e1b38", "comment": "Malware payload", "value": "54890b64641c90edc6ba859b936f2d37d9ded78717b829ff911828012f9973d82cb9474869d2dc6df493704e967d34f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538401, "uuid": "a2bc1c7c-974b-4b66-8a40-60622757815c", "value": "6C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538401, "uuid": "810f9036-8e01-4866-8acc-0720275f0701", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538401, "uuid": "67e4a6fd-5e7e-45e6-b097-882899384120", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538401, "uuid": "021bda3d-9e7e-4adc-8dea-c6d2a79fbad2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538401, "uuid": "115f6aa5-9c18-427c-8f20-e94cd005764d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538401, "uuid": "e176c32c-4e35-4e1d-9ead-1452dc8cf92a", "value": "414a2ed6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b323280-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621520382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520382, "uuid": "c490e5d3-7868-479d-bbb0-7b9c1175d11a", "comment": "Malware payload (AgentTesla)", "value": "9f5894fc929c4c147d6ebb4c49c1447c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520382, "uuid": "8b48026f-b7ca-4850-a2bc-51ba22bb3a32", "comment": "Malware payload (AgentTesla)", "value": "0f6af6375055f4d2caa277a6cd81dd329c707d28ba14f867ee7af5b426e4e7d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520382, "uuid": "ccf7d1b7-b4df-4c41-9edf-8ad14c0272f8", "comment": "Malware payload (AgentTesla)", "value": "6e3f499e833bc0453d7d4f638d2324a7cf791692", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520382, "uuid": "adf8eabd-e7f5-4f5c-81b5-9ed86ea364b2", "comment": "Malware payload (AgentTesla)", "value": "8d725a252936b241f4da0f2be271de4f3084adea45466d61c82e277b18f195cb428af42f17c33d201ff1f75015abeb04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520382, "uuid": "6f081eec-e17a-4616-8a4f-961e1d0a3780", "value": "6005F133724A9F99E03F5B799070204857F0E907E7B1E72C7C6060EC2E91F56AB95A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520382, "uuid": "53c5ee02-f860-4ac9-be54-7e1412c6a123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520382, "uuid": "75886895-aabb-417f-a4cc-b4d7732a5130", "value": "12288:Bz5Kzi++++++++f++++++++vGKrSO/hs/B3vg8MtJH0zgR37DafXek6+4354MRDE:BzUzCX2OIRv35ocOkD4J3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520382, "uuid": "b056c369-eae7-41a1-a8a1-14ab1c837f24", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520382, "uuid": "11171c15-ee76-48e3-9bf5-22894edabf58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520382, "uuid": "09cf52c1-4729-416a-b5f8-c57787e64f5b", "value": "9f5894fc929c4c147d6ebb4c49c1447c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50bd9a4-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539028, "uuid": "8a033930-4083-4f22-9741-632335b856a0", "comment": "Malware payload", "value": "a8ee49d10309897df9664ae4323ad87a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539028, "uuid": "7acdc1ad-044c-454d-baa0-10c670e83d6a", "comment": "Malware payload", "value": "0f9c0e4fa56501d46822cb78bcad852c4459da2ca7be1d81be94ee891aaadb81", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539028, "uuid": "44151a02-d1ea-44fd-8e8a-1ab20228acea", "comment": "Malware payload", "value": "917879c8e8952bd00c3b0d4b19a8847acdc56e4e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539028, "uuid": "1f66e224-53f8-4fbf-bd94-7e5c677546c5", "comment": "Malware payload", "value": "9b454686a0f2187b7ef90496d889c9bee7c0cf2e1f9c8051126fd23355371011fe92345b86d5d6bb095af990f2d6afba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539028, "uuid": "68027676-5214-4d25-a660-b0ea4db9305c", "value": "6C04B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539028, "uuid": "8db81e05-7c15-4361-9024-88a219208bd3", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539028, "uuid": "79458d06-301c-423f-9c14-7494cfe85f63", "value": "3072:HWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:HWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539028, "uuid": "66c5faa8-bc50-4ed7-be1b-21daded8915c", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539028, "uuid": "8a068139-36de-4c64-9589-8c9015745a59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539028, "uuid": "ab977eea-7274-4d11-a0dd-4a08b2f8c250", "value": "a8ee49d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9eaed1-b983-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526132, "uuid": "80ec45d5-ea7b-46c9-8c62-43338e368b26", "comment": "Malware payload (Dridex)", "value": "3ed1dab5f5ff213050fcdd862a40b653", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526132, "uuid": "6e0a3f28-e48b-462a-8b60-c2719b4ca4d6", "comment": "Malware payload (Dridex)", "value": "0fdd1970a4c96164ce3723fc902f9dbca2adbab1d6c7c941a568857b37254a1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526132, "uuid": "705aa8fb-bd98-43fb-9375-6da77c6ea08f", "comment": "Malware payload (Dridex)", "value": "c1b997e450fe29b7a4183a605951b42c2f1e348d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526132, "uuid": "2a18c01f-86b9-4789-a1c4-768df2a85be7", "comment": "Malware payload (Dridex)", "value": "9abfdee9d0fa469235cb4b4d6b4743cb71f7283202dc8da6d2d7d3f2dec85b2404682b3316c9d311cd45a8e82ceda982", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526132, "uuid": "7eb9713d-87ce-4ac6-9578-2e9857b22aee", "value": "DA04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526132, "uuid": "98199357-338a-41dc-b9a5-a978b5f84a46", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526132, "uuid": "682b9054-8aa6-488f-b1bf-9e80ac9c9d30", "value": "3072:1i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:1H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526132, "uuid": "c2284aa0-e1d7-46c2-93f6-823262eeddeb", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526132, "uuid": "36ea7896-4ff4-4c21-b23a-1bda275ae21d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526132, "uuid": "caecee95-e1da-4564-8960-62a7196263b0", "value": "3ed1dab5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414064f7-b9ba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621549517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549517, "uuid": "6fe75b9b-ecb3-43d2-afef-7b5aa2f8d938", "comment": "Malware payload", "value": "825715f4d5058cbcd7cf6566c5c577e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549517, "uuid": "b3cba8fa-a89a-49b0-9916-747bd6d08279", "comment": "Malware payload", "value": "0fecf5b32ae83c5ff6049117c0aec82f3087a20cd09bb0d2a884f1397ccfb5e5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549517, "uuid": "21af20bc-6317-4d15-ad0a-30d42f765c07", "comment": "Malware payload", "value": "b84249aaff832161240a4a6743aea426e764640d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549517, "uuid": "848aa2e5-7ba2-457f-80a8-6a6d498928eb", "comment": "Malware payload", "value": "3d070170d7d27cf3fb4e8490abe1072ca1e0f4e9f337986c64d2514b0a076a20dca6ad8ae633bf2a1a2f0d69ff5d69e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549517, "uuid": "98092037-fa2c-440e-9473-2d5286e59037", "value": "9FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549517, "uuid": "2e7012a7-b7e3-427b-8af8-f0ee5f6e3c4c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549517, "uuid": "7eea360b-7e1b-4de6-8090-b4b2639f4ae1", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621549517, "uuid": "48311dbf-2e25-4257-8c87-c3fd6661b5e6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621549517, "uuid": "240f8820-7c89-4eee-b4f7-54ae5fa26132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549517, "uuid": "e99efa71-8512-496c-91d0-21ae3e3405bc", "value": "825715f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484e23a7-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544804, "uuid": "92539fdc-4746-4a3e-b305-527221d5e66f", "comment": "Malware payload", "value": "734c1440632d8ec7d3da311b688d9391", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544804, "uuid": "ca277bc8-ae4b-4c6d-b56d-c7cb1d795240", "comment": "Malware payload", "value": "0ff6fad0ed3938f633471c04040f8f6f17097408883eb574e030a3fe816e1e40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544804, "uuid": "713a79ae-fc13-4640-b6a4-c643b4cedd50", "comment": "Malware payload", "value": "144311bd5719dcc9b04debd9c44deaf60d093da1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544804, "uuid": "f4319d60-4298-4d0b-87bf-7abf6537cc79", "comment": "Malware payload", "value": "dd9f0695d4e7b63142da8a960ea3d40be7c33d6399db944030d9d76e64855ccdf88b8d20a2d44ff6933b9014e510a3e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544804, "uuid": "37389ca6-bd65-4460-9ef7-a562f2edbb35", "value": "C204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544804, "uuid": "07dd6cb1-f4d8-4d84-9cfb-74842d55cd45", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544804, "uuid": "c856fded-02e8-4dd1-a816-45f704218cbb", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544804, "uuid": "1d6d6d2f-04f4-44f6-9192-f4a918fbdac8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544804, "uuid": "c3c7072a-68ad-4e54-a566-116e2b86449e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544804, "uuid": "8d614359-be9a-4898-ba18-12a622d99721", "value": "734c1440_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcbe54e-b9bc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550561, "uuid": "cf0784a5-52ae-473d-b4e1-3a6818552d3c", "comment": "Malware payload", "value": "5f9f2c06165bd2d25162847e1c6e3dd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550561, "uuid": "c498e4e3-5b5a-419e-9746-44582983ceec", "comment": "Malware payload", "value": "0ff95151ba234939f748eea42b5e11c3e373b1a4243fb9aada93c155b431f303", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550561, "uuid": "236c314d-e22b-4c92-9681-4cdb55ff4c8f", "comment": "Malware payload", "value": "3421f145669c5f002b411cc519d19fb7933a7966", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550561, "uuid": "e715afa0-78f8-4d49-bb7c-b4d7dd586e67", "comment": "Malware payload", "value": "11d5cf4364fd29de02c052428c20c5d9fec011e7cebf9425a2164bfe7b8b5084a2de078efcfa48950b516dee712517a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550561, "uuid": "1103f8bc-6dd2-4240-bf81-8f22b799fe5c", "value": "0204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550561, "uuid": "a275a104-0c0d-43e3-a809-f9548821f0fa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550561, "uuid": "e75c8fd2-a4bc-4932-a46e-d7e1c3e04a2a", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550561, "uuid": "d6dcfbf6-88c1-4d92-862b-e96fc09db556", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550561, "uuid": "03b328a7-2621-40ac-abe8-c833488faf35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550561, "uuid": "fbcf6ab9-a127-4d76-9999-71c0d5f8c6b3", "value": "5f9f2c06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262b361b-b977-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520695, "uuid": "dff877d7-efa6-436e-bc7b-84842a797a3a", "comment": "Malware payload (Dridex)", "value": "08b4b607452839f79698a5b6085c4e34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520695, "uuid": "144c2b1e-a9c6-4647-96df-5c18c01fb5a6", "comment": "Malware payload (Dridex)", "value": "10228a3af5daa7185be4d6f87dcd045ab98fccb7ab880c44e1ab18f4c5970951", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520695, "uuid": "239d38c7-b28a-46d7-935b-1662a8d6d831", "comment": "Malware payload (Dridex)", "value": "f92ef4afabd097a862997f728fba91ecfae211fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520695, "uuid": "9f0efc07-b21d-4e4f-9b8c-099565e7135c", "comment": "Malware payload (Dridex)", "value": "90882acb07b783109d961a69b90fd642dc83e2c239cc15f755de7ebf0d737aa24faa5aae8edab2bbbdc620a6973e36c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520695, "uuid": "8fc1115c-1df7-4311-a4f7-3fd58592e9e8", "value": "21F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520695, "uuid": "3f1fdb82-9895-462a-a2b6-7c0beab0799a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520695, "uuid": "19a2b4b1-c139-4ab5-bd2a-dee438543224", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520695, "uuid": "96fc5cd0-8156-434b-8d66-a7e2f2d58002", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520695, "uuid": "bb3c3385-40fe-4f88-a1b8-23b4be207d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520695, "uuid": "756a2797-cf13-4311-8b15-01451d7fc58f", "value": "08b4b607_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9be4451-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621529640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529640, "uuid": "30502481-f3e8-41a1-8f41-d4ff77b4d9c4", "comment": "Malware payload (AgentTesla)", "value": "21c46c5061a47b864ecae4cf88aacb5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529640, "uuid": "49ed5ce4-bc9c-4075-b58a-d58a5a695fd2", "comment": "Malware payload (AgentTesla)", "value": "1022ffe3ce2f487998998dca1ff3a71f382068f684d277fe2795660f6b0698f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529640, "uuid": "74ca3104-383c-4cb9-9493-c445beef3c2b", "comment": "Malware payload (AgentTesla)", "value": "25a988de8b313471721d90675cae750504bbff2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529640, "uuid": "de35225c-b17b-4767-a404-ef11bddb83c5", "comment": "Malware payload (AgentTesla)", "value": "5c7c47d7512fa37988e416263b1b69dc79876a3a5f547582479abd3f9a321c3c3268334d089443e3c5b16d35daceb721", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529640, "uuid": "92900002-2094-4224-9e0b-e12f651abbfa", "value": "DAA423C109E599ED1F74430B9AC0A5C5A2D64DA7E4FC882E361D06BEFDBE7E0C682135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529640, "uuid": "b8a663be-d29e-420f-99f0-64ff0b270a3b", "value": "12288:BiGtN+mvymdGoFK9+a4Eo7voORuyXoSA//0QFQ44w/8PCky88cVjig:BD58UK9+aczoOASA0QFQ4llkKcdig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529640, "uuid": "d062123b-0064-4793-ba76-0f3416be3724", "value": 481849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529640, "uuid": "083e4dc6-2ed8-4166-83a9-87bd93ae4be7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529640, "uuid": "6f91cbcc-99a1-4f41-a6c3-e257ac2b9eb7", "value": "21c46c50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10bf4f7-b9ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543289, "uuid": "ad0704d5-5954-4bde-b8ee-38ad65f68fc0", "comment": "Malware payload", "value": "8657b23bd86103d3be921c3cc2ab0628", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543289, "uuid": "243607e7-4932-403a-a445-dafc9efd4648", "comment": "Malware payload", "value": "1045399e64ddcb32f0a2a991cbda19605f81419003fbaa75148dea768c93ca26", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543289, "uuid": "24a3477d-9b7e-424d-bfe0-71b69a248e21", "comment": "Malware payload", "value": "243fef84dc5e32f7487e62e43349e78481ccaeb8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543289, "uuid": "ab9bf69f-8a2c-46ed-b057-ae4b3944efa2", "comment": "Malware payload", "value": "f2ce5406b56f8c795ab65a95dde2895acde7ce1f92169723230c260c5c992093b97cebe8b6287bf97b88e51eb8e64e43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543289, "uuid": "5d3e0987-a7bf-4347-bb15-f5a017b6b23f", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543289, "uuid": "8740be7b-289b-4aa8-bf5e-a5bb76141701", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543289, "uuid": "af1ab360-5354-449e-a94c-abe92f427ebb", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543289, "uuid": "6268e234-c172-48b0-8e21-1b0369876d6c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543289, "uuid": "9cefccd6-7157-489a-ba35-e6689140dd11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543289, "uuid": "5f2e6d7f-c5af-4e49-b082-123d35dfa7f5", "value": "8657b23b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce6f6a4-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524491, "uuid": "171ae492-4b9c-43cb-bd9c-eefa0745afbc", "comment": "Malware payload (Dridex)", "value": "c3a5d1943fd7d8b6c6b018ff07a1e06e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524491, "uuid": "be32b6e7-7310-456e-a1be-ffcc30d2a8fa", "comment": "Malware payload (Dridex)", "value": "107ed7322683a89961d97d1282b8a11256e8857bb6eab5d957f0a730bcfa8c4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524491, "uuid": "b32e6a19-c455-4701-a6be-060a18cd39d0", "comment": "Malware payload (Dridex)", "value": "6537e4d41a317b0f3873a23290359e5504eb45f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524491, "uuid": "045812da-eeec-45d8-946b-593ca5e0c344", "comment": "Malware payload (Dridex)", "value": "cf7994b2e037c7c10d87b202a9dd533094e200ec5c28d4ac36ccdf3a6b0feb2f6656625549995af1fa1a2d79a9ed5bfb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524491, "uuid": "5158c708-730c-4253-8a0c-970f398111cc", "value": "1C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524491, "uuid": "4d23151e-1f07-4760-a98d-992b63bb0b1c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524491, "uuid": "1c7330fb-a75b-4425-8f32-e198e112207d", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524491, "uuid": "75390f64-9a06-47b5-ba65-f011bcb93c0e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524491, "uuid": "57cd8e2b-a302-432e-ae50-ead0fa3b7043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524491, "uuid": "69cbd7ac-b11d-4796-800f-913d16d7f7ef", "value": "c3a5d194_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de99d3b0-b96e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621517139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517139, "uuid": "767b0c8c-8298-4e10-a841-7657240ef147", "comment": "Malware payload (RedLineStealer)", "value": "39100933e1baf545c2261eeb4c9f076e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517139, "uuid": "7c38d679-ae58-4a72-a52c-54a2398c878e", "comment": "Malware payload (RedLineStealer)", "value": "10a71390221a09999fb093ce2f276cd0aaa7eb8c525eda1e9d1a72d256d14a07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517139, "uuid": "dd1d10db-6c18-40a1-9f7d-d0eca49dd0a3", "comment": "Malware payload (RedLineStealer)", "value": "c441573b99e41eb108abb6ce4990924cc125398b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517139, "uuid": "5919f20b-a45e-41cf-8dac-feaeb8281555", "comment": "Malware payload (RedLineStealer)", "value": "26654e8b5d37730ac4c92107a8165cdf2441489e329297c48526e34e2783a8b2b1fb3b9baa7195637889600ced7f40bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517139, "uuid": "641de06b-bcf5-48bc-a1ab-b003804fc4e7", "value": "6D046BAC23C86E44DBAC0A3FC6D0551883B6DD6B4147E71B699037E935AFBE6710370A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517139, "uuid": "09a195f4-51ba-4b75-867b-c8ead3276db9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517139, "uuid": "d38faff3-ddc6-4128-930d-24fda090253d", "value": "3072:6HgolOv+JeJlJfErh3hqdMpEsnJvPfGkFl2SEj:AdJelJfErh34dUBvP1Fl29j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621517139, "uuid": "40f9d2a7-c99c-4f83-ab81-d2426566b57e", "value": 189312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621517139, "uuid": "4fa09601-8da3-4bc6-b26d-54a23d757782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517139, "uuid": "e3bae2a2-8278-4780-a6b1-861c8b36afab", "value": "10a71390221a09999fb093ce2f276cd0aaa7eb8c525ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81f8d87-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "6d2b25bd-cb8e-4f54-859a-32f12e4d270d", "comment": "Malware payload (Dridex)", "value": "6b881645d3dc1d59900599661268ed72", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "88b472ea-71f9-4f7f-9c10-09fda40f0db1", "comment": "Malware payload (Dridex)", "value": "10e4c304420703cc1ea6176b7ecff79e39c8affa71ac336dc30538d898162c74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "2071beb0-b29b-47bd-8db2-ce8caf711376", "comment": "Malware payload (Dridex)", "value": "e387dbce8fc822e56776e5c8d80f71fba85435a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "8caecab2-63b3-4ee2-aa74-660b089b1407", "comment": "Malware payload (Dridex)", "value": "7c8090abfaa114f0d0021824fbbc893994f7617db09bd4df597e0e9b5a4cae9b2b691fe1efd681447e920ca422fe91f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "b6545fa5-3668-4a44-940f-c4d2e3691ae5", "value": "4C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "57cadef5-c6aa-485a-966e-7330bb74055d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "7aace29f-4114-44ea-a256-b0fbe6789cae", "value": "3072:ei49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:eH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535624, "uuid": "4edfb520-135a-46a2-b6fc-d359710f49ae", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535624, "uuid": "b84a68d0-5335-4f48-8fa6-3a7604cbf9c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "221308e3-5818-4dd1-af53-0d845145db1d", "value": "6b881645_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349356c7-b9c4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621553791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553791, "uuid": "70640fb7-82ae-4528-9afb-d32b8fdfd5c4", "comment": "Malware payload", "value": "a92fdffe99a1df80882d821cb49f0382", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553791, "uuid": "b60deb3f-6822-4d40-9c88-cf2d38363c7a", "comment": "Malware payload", "value": "1185672f4751c92645dea622ea2e824167c044a7b62084e9b052ee2b552b76e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553791, "uuid": "0414ae45-7786-4cc1-b36e-9ceef198ab59", "comment": "Malware payload", "value": "d028305acbb6e6b057be767b810cb384d464943f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553791, "uuid": "4035eddb-2497-4d1d-92cd-d2cb88a90b2d", "comment": "Malware payload", "value": "dc44225998ed5ceb25688875a35a54eec824370d9002b4f8ded0029ff7ecfbc593a70546af22aac4a50dc8106614040f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553791, "uuid": "bf6e567f-1587-496f-ad76-5a69833ab019", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553791, "uuid": "5aee7010-8cbc-401e-9365-ed0a29709cc0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553791, "uuid": "75438cd6-de39-479e-96fb-79f23ac8e403", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621553791, "uuid": "2f6d1e68-58fd-4f40-9cfe-e29189a59761", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621553791, "uuid": "a2699735-ffbb-4e5e-86f5-c02366d56b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553791, "uuid": "ef37c31d-5aaa-4a70-b233-979fbaa5f642", "value": "a92fdffe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8046a606-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529866, "uuid": "a454f540-9de0-4e04-9423-9f896fa03f70", "comment": "Malware payload (Dridex)", "value": "93f422d60ffced98e19d9cb032c2cf86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529866, "uuid": "5ea7ddd7-d1dd-46af-87ec-50a9856f1683", "comment": "Malware payload (Dridex)", "value": "1185e33ed57f6f2fe504ee3d1a6f048aaa13460e028b8c1a4ee499e7034da714", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529866, "uuid": "eda1b384-9c64-437d-b640-582ceec661a6", "comment": "Malware payload (Dridex)", "value": "bc276797dcf1ad26310f52cb52ae6bbd38d2ec78", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529866, "uuid": "48f2b8f7-36e7-432b-a904-3169a415b378", "comment": "Malware payload (Dridex)", "value": "9d86d1fcdc69e6be7e42cb04615d33304b0e783a019c86baedb414da50b2b819535df197951c7434ca9b003abc9b0b36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529866, "uuid": "ae50230b-e300-463b-ae2c-75fa6045f1f7", "value": "5E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529866, "uuid": "3cc59d63-10e4-484c-a634-d5aa1954381b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529866, "uuid": "2f4c2fee-bf5d-4ce2-84ba-b27be4c17e6b", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529866, "uuid": "8bd0b733-f58f-4238-aa8a-b395fe6e00e6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529866, "uuid": "473250dc-a949-4096-918e-a11545c17ac4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529866, "uuid": "15bfd855-6d68-495b-8dc3-38273e4cd651", "value": "93f422d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f127e968-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527908, "uuid": "60ad8ef2-1086-44b7-8798-27fd47cf3433", "comment": "Malware payload (Dridex)", "value": "8bfb8edb1f69146b7af47a0ffcc92561", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527908, "uuid": "3fb98ee0-4be7-43bc-acf3-ca52362430fc", "comment": "Malware payload (Dridex)", "value": "11a70fee1b6c41b80c5639b3de1b5ca3db5c76382b303fb1ae39aae1d61b159c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527908, "uuid": "35fe3e9a-fece-4211-aee0-617ef7bb4ba9", "comment": "Malware payload (Dridex)", "value": "3f8d8e8f5e660584b8c7e8e423f1764676563fd8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527908, "uuid": "28aaafff-61c8-4a92-88bd-998976152eab", "comment": "Malware payload (Dridex)", "value": "2b5dcae8559dfd42134d7d1fc8f2ebf28edbb518eddb2389a47f7f785972d420e1459e4ff3eac953ecae2588ef95236b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527908, "uuid": "6e052e32-e671-44a4-a13f-6d422715249c", "value": "6004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527908, "uuid": "e80cb227-15c4-4789-ad43-b56835542d9d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527908, "uuid": "5f5ce82b-179b-4af7-a522-9450525a478e", "value": "3072:Li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:LH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527908, "uuid": "28e11ad6-8b0c-4576-8312-65fae811175a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527908, "uuid": "375f185d-6f42-4264-b5f5-eb15f53fe911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527908, "uuid": "8f3313aa-e8ef-4b88-8287-5abb11216718", "value": "8bfb8edb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c361cffe-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552312, "uuid": "151a73dd-bb20-4b26-8eb0-44d0636e0fb9", "comment": "Malware payload", "value": "819a5251d3176114106ea6dd1a3ba17f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552312, "uuid": "a0179686-da66-4ea7-bc52-391e6c513ca2", "comment": "Malware payload", "value": "11ba32ca492462fa1b5eabd6179e1f7d8a29d97e9bad1c1f9ef47eacdb134790", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552312, "uuid": "bea37760-95a0-4eb4-96fc-7cb7265801be", "comment": "Malware payload", "value": "116d3fa1f136cbf29604bd18af9f73cf1fe2ead5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552312, "uuid": "b80433d1-29c0-473b-9230-57e30626e52f", "comment": "Malware payload", "value": "061de0519282477025e7a4e7a31c51d8163ad6d452ac6ae454de3eb918c84678ab471ecfc83d485b7d79889999280552", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552312, "uuid": "ba10d087-3798-43de-9bf3-9e825193728b", "value": "9EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552312, "uuid": "88f87f51-ed4b-4b32-8ac1-8a057f41ee55", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552312, "uuid": "412c3997-974d-422e-99e0-175f90317467", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552312, "uuid": "203def59-4dbf-4e00-9d2a-2dee855c9b4d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552312, "uuid": "548938c2-5031-4d14-bc95-0510c0a678b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552312, "uuid": "dbed3833-537b-437a-b790-1280330d730b", "value": "819a5251_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dc52d5-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545693, "uuid": "ae6272f3-f52b-42f7-b93c-be0d33fb714c", "comment": "Malware payload", "value": "ae4489407a603eb7f9ee4ee0c7cf4025", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545693, "uuid": "35fbba79-db68-4ecb-a8cb-ff81c083c1e6", "comment": "Malware payload", "value": "11df81b37521da2d70f2ab573eb4ba4914fd5a21b83546e05214189786d30df4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545693, "uuid": "a0a317e1-5175-4de1-95dc-66e6ca056e40", "comment": "Malware payload", "value": "23358a49c0f073d7128bc60f31a029f7937b28e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545693, "uuid": "3bc66bc2-7a7f-4784-aaf6-5cde211c9072", "comment": "Malware payload", "value": "7fa025300154e6ba423ed0370cd7a99406fbd2bde54b37d11a324bb756a33499fd46eaaa2e7b2b5ad343cacfb5ceca19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545693, "uuid": "c7a91056-5032-4da1-949d-f3db3eb1f25a", "value": "CE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545693, "uuid": "f14d002b-af6f-4555-8171-6af70bf2fd50", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545693, "uuid": "2f7c25a2-5c3f-489f-a61c-9a9c5c68fd54", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545693, "uuid": "586e8a7e-c13c-4914-9c78-3a3bcde459ca", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545693, "uuid": "7b268e94-ed5c-4b5f-a2f0-e1cf13b896ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545693, "uuid": "a9e7d08f-69e9-4795-8221-a37e9eb31fde", "value": "ae448940_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbf6529-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539284, "uuid": "83aa75a8-bada-44ca-a45e-25d3db3b77c4", "comment": "Malware payload", "value": "d60e07a015e50f4378eabc42d1e8a989", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539284, "uuid": "a191279e-8876-44e0-becb-e113785ca406", "comment": "Malware payload", "value": "121f4720a630958e35eb566d2d658cc146cb21e5fc7faec91554dcae1725a520", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539284, "uuid": "b8371997-aaca-4af7-93a0-6a61e61ed63d", "comment": "Malware payload", "value": "724614ef7332b44298910df89705b1ed5950da11", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539284, "uuid": "6e4b8987-a975-4750-b26e-19a8b7690d2e", "comment": "Malware payload", "value": "6a5c0a23a49f5ff887b84fa6df87ee4ea8dd1c5a09f206a56f669636d38639d58264c0b782963807a9c7cb65388066b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539284, "uuid": "b73a9629-4001-40b8-8033-494c09b715ac", "value": "1104BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539284, "uuid": "1e769275-a1a8-41ab-9490-5e5c6199a18c", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539284, "uuid": "fbd535b4-ebcf-436b-b572-cb3ae13e2252", "value": "3072:9i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:9H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539284, "uuid": "67336cdc-8f44-422c-a72f-546d5eb6e03f", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539284, "uuid": "5c284c41-f203-42e5-8235-7d1b3abc636f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539284, "uuid": "1c1eff54-eb19-40a1-89b2-94db656c0967", "value": "d60e07a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4642f9f-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621486977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486977, "uuid": "bdf0a61d-3aad-4e94-a6f8-f41b9b2ce7e2", "comment": "Malware payload (Dridex)", "value": "3f8823cce333c087368ce297bb3fabcb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486977, "uuid": "7eab2336-ea37-4e46-bba1-9e0a0371872f", "comment": "Malware payload (Dridex)", "value": "122209ca3c779944595ee5854c8feafe96074d1df4518e19cdb5bb8ae4709659", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486977, "uuid": "5913a9ac-9a2a-424f-aab1-a3d961ecb286", "comment": "Malware payload (Dridex)", "value": "d4d4bf0471f8a99e08aa4f4f2db802909d92c899", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486977, "uuid": "1dcd6aeb-34f4-4a20-894e-f514d2781f27", "comment": "Malware payload (Dridex)", "value": "3b79e6ad85be77cb689127f22cdbb7df0528cefd81d0b09d7292c8ed732d41d6cd51d5d27c450f0900954c746c433916", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486977, "uuid": "81653d0f-52e4-42c2-b0f4-d44c57a0239f", "value": "F204D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486977, "uuid": "4e6942b0-ce21-4e9b-907d-6e34cd3f9e28", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486977, "uuid": "b06fe91d-f073-4a31-8fea-c402ce3b5df7", "value": "3072:eqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:QVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621486977, "uuid": "7d4150a8-92d8-4397-9fd5-f0820bad78b1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621486977, "uuid": "699fc690-663b-430e-a1d1-51983734a433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486977, "uuid": "8ee68a8e-99e4-4e2a-b6f1-6129f7d6d633", "value": "3f8823cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811fbad8-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543611, "uuid": "a3dd4819-f903-4951-b5c1-6d54c5b777dd", "comment": "Malware payload", "value": "f9741f805207b579af4072cc2a48fcea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543611, "uuid": "32cafb7d-cafa-4289-a86d-b8d8439c4020", "comment": "Malware payload", "value": "12696cfe931f611a3d1b43946c0b000d1d03885100389e4147c676c1a9cf9df9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543611, "uuid": "0229d983-ac74-4786-9e9b-b2305e9f1b3b", "comment": "Malware payload", "value": "df6ccc5b91400c60cbedcbd8a318f04266ac6833", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543611, "uuid": "c344730e-df83-41a6-ae80-282ab93e6c48", "comment": "Malware payload", "value": "a9d21de82f0ac5408d4bae6b879519a59379b82a9bfb5d8bde47a1944d02ef2c4ea30d49938c4e7e9062364a18f05b10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543611, "uuid": "aeccf9d3-53e0-4ac2-acac-20ffc7e2a524", "value": "F904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543611, "uuid": "927d12b5-604a-461d-a2c9-1fb6c3135768", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543611, "uuid": "1fed873b-556c-4e99-8fbf-26119cc79850", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543611, "uuid": "a28c0686-1104-4af5-b98e-4f688c1c081c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543611, "uuid": "9d68f186-45c2-48a9-96eb-f0c9ff13f3cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543611, "uuid": "8f339535-1a9c-447f-8aee-1065bce23e3d", "value": "f9741f80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7eaf985-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540804, "uuid": "5037fedb-2215-480b-b4fa-91e49a890a20", "comment": "Malware payload", "value": "987ab423b444f7d1754785902e95d7c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540804, "uuid": "f3a6a143-5ffb-4216-a17f-2b58319bb98d", "comment": "Malware payload", "value": "128991904d62c084fa25dca3891e9ae00144e98ea3b2dc405c7a1362c5231dce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540804, "uuid": "af92d7d2-b5b4-4ecb-98eb-e67f0a70a9bd", "comment": "Malware payload", "value": "88b482dba599704a966545109f496f5b4797686f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540804, "uuid": "a8613362-a129-4bfb-aed7-dcd76ee15d26", "comment": "Malware payload", "value": "0ca96b497f81ded82fae9febd08f3450419285f01d32edad5405cff64514b03be45299034e70adaea95f2fa8c654daa0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540804, "uuid": "3447ea94-910e-493c-bbc3-5e2b8bdeb1a8", "value": "9327333BB66FA020F8C80BB0D1FC956DC793AE684C45179DA5B1B99CF83680EC647B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540804, "uuid": "da7c32d4-ec92-46d6-9c83-eddd5b60fa8b", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540804, "uuid": "6dd4558a-57bc-4e71-9279-941aa7431bfa", "value": "393216:FGRHLBeZGeF9+clm0XCxN5F+igalbTbCacDI+mvSjG4pao/uSRRCgzKEqc:FGFLoZGeCMKZ1TbjsI+Hy4pa5YzKEqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540804, "uuid": "a53a58da-a2a7-4651-b571-581b4629b4c0", "value": 21899728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540804, "uuid": "96b5a60e-1d54-42c6-a983-c578ac8460e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540804, "uuid": "01f3114f-d96e-47e0-8ab8-deaba34baa9c", "value": "987ab423_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4fec20-b9b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548836, "uuid": "cf4d3b9b-9fc2-42fc-a883-5ee60a665caa", "comment": "Malware payload", "value": "e87e74fee70658ce45c48d9b8ec7b06a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548836, "uuid": "42af3c84-3f9e-446a-a0ff-47763974f9f0", "comment": "Malware payload", "value": "12977b0c2e3745fef4503b54f1da3bd2004d498cc864843c4eab5eab776d4825", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548836, "uuid": "a3423d98-9884-4f1d-84ed-04d1f8bfe9c8", "comment": "Malware payload", "value": "01c4d630232d42cf40125e75abfd1c1a017028eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548836, "uuid": "974992c4-e46f-441f-bf01-00594db3e62a", "comment": "Malware payload", "value": "825157b469da55d3c3f91e212cc351df3962793412ff0d035e157d83940574846ab5487ea094e2df64f5d528d3d0ffe3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548836, "uuid": "c34123b7-af00-44f8-a74e-031af139f96b", "value": "D4A42399CC8C4F5A635AE6B4AC5BDCC9CE1914BD1BC218A0CB74A8FC9F97D4264112FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548836, "uuid": "321c7027-2ebc-412b-b9b6-ee9ba78fc6d0", "value": "6144:HXpZmIjAtpGkX5jMnPdiQ0GgxceXivA/G2iAmmtpWWYnl0MojngUh8XdzIkFDYWP:HfAtT6mdsaGjDmTYt0np+XdzpFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548836, "uuid": "69e143c0-6ae6-4e2b-a284-9e0ca1ef5f04", "value": 480281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548836, "uuid": "37c14c58-fcde-4499-a0bb-38e7cc12757a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548836, "uuid": "f3e452c5-8178-4ba8-91e9-12bf54cd13ba", "value": "e87e74fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f765aeb2-b956-11eb-abe1-42010a9c0039", "comment": "Malware payload (Glupteba)", "timestamp": 1621506873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506873, "uuid": "c256a64a-6eb1-40eb-a86d-9e46aadb4f14", "comment": "Malware payload (Glupteba)", "value": "3734a387298e5ff71c18a6e11aabe363", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506873, "uuid": "a0490195-1a97-4984-b71c-2b0d85195cb7", "comment": "Malware payload (Glupteba)", "value": "129da3e565d7ab1c5e5c3705be3811b629e058be9af50d354bf7949605062416", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506873, "uuid": "d6349c98-9160-49d4-8205-cc955b9779e5", "comment": "Malware payload (Glupteba)", "value": "f720ffc609aa8b4e2943ddd481c5fccb938695ac", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506873, "uuid": "ea76f0dd-a1ef-4f91-99f4-68b3163cf73e", "comment": "Malware payload (Glupteba)", "value": "6ab43d2436e7eb2e9b840dabec0b7421f5766c8c27f422b737ab0edba285c564bd0cbd9bcbfbda65c64d7d8b8a3049cc", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506873, "uuid": "cca416ea-9a2c-4ab6-a287-66060619be36", "value": "6B263300A666D036FBB756F50D79823D9226BAE29F2602DF63D54ED687603F05C3132E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506873, "uuid": "7b1946a2-6e64-4fb9-b33a-e3858da5f3f3", "value": "d3fbd7bb41bdf846bb2ad781ea78ead8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506873, "uuid": "829351ff-ccad-491f-89f9-8c01ac99b489", "value": "98304:0olU4Tlt6czjbKyjyQkiQTQpmJnE8bxKAFe/7M2plQvovpMWCceShFUMmYancen:05UD6gjyQkqMFbx7wvHQQhThyJYance", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621506873, "uuid": "007064e2-7234-4038-971b-bb66aac148c9", "value": 4643840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621506873, "uuid": "651f85ba-95c4-41a4-962b-aac4a9f75143", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506873, "uuid": "17204a83-ecc3-450d-9a76-d694f5594821", "value": "3734a387_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48d1b45-b982-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525632, "uuid": "49ba024e-b851-4fc3-bb3b-a54d5c6fc676", "comment": "Malware payload (Dridex)", "value": "108ed15ff1065af4091cafa2262de510", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525632, "uuid": "5d0ba19c-0d87-4141-b710-adc820a2df7f", "comment": "Malware payload (Dridex)", "value": "129ded149b0771278670daf77c2431d2d83252eac5ba1f731dc8f90be4c6afb4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525632, "uuid": "e0d70448-9801-4921-9466-77041526d0ba", "comment": "Malware payload (Dridex)", "value": "3ef4e706f861b48956f350c28a8494dcb4c50df7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525632, "uuid": "da3897f1-20dc-4b78-9530-cc3152ae94a7", "comment": "Malware payload (Dridex)", "value": "788e9bb20ec3f8dbedd1879b4f28451458a975b3c7af8a84861032bb8101ac9242ad9403fbcf24ceb6599750ac5b9caf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525632, "uuid": "a8d59046-0a48-4528-90d7-06e99f39b769", "value": "6904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525632, "uuid": "003f4747-bf44-47a4-94f6-c94fdf3dab9a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525632, "uuid": "e2fab68d-36c9-4162-9178-3a39a52f5dd1", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525632, "uuid": "0b67a1a4-a197-49de-a72f-56959918a4cd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525632, "uuid": "5c52025c-3c2b-4e0f-8251-a395e7f47874", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525632, "uuid": "9bd65c00-175d-44af-bc9a-4d0d1a95ec5e", "value": "108ed15f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4318850-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472508, "uuid": "c14df758-bb9a-4db8-969a-1c98425a63f2", "comment": "Malware payload (Dridex)", "value": "bf7e3aa82c65cbd54a2db4634e8844cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472508, "uuid": "142bafe5-eeb1-4be5-9979-f68a991704b9", "comment": "Malware payload (Dridex)", "value": "12dfcecfe9c2b3c0e64ab270e5771197eb1a716c9138d1c5e2eb4dce7de272d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472508, "uuid": "aa82e191-5708-48d3-a8e0-d00be62447e3", "comment": "Malware payload (Dridex)", "value": "679d40b3ecde4626bc29d13783ca46a1cc0b2efe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472508, "uuid": "b1a866cb-7dd3-45e7-bf6e-465e76b31dc3", "comment": "Malware payload (Dridex)", "value": "47fc9d3cc644a5937ecd4899c7f8b84c01b14a8351aa0ded6a1cef52005c37c20fe9de3e5320fd89e3d0bcc0ba9a8a1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472508, "uuid": "f66780b2-d5e1-4948-bfc5-d148deea553d", "value": "12F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472508, "uuid": "55830311-128a-491f-9370-8cf95e0ffb5a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472508, "uuid": "6160d68e-f2c3-4c90-a0ab-3c785c4393ec", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472508, "uuid": "8e78131a-9965-4010-aafb-3158a7ec22b3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472508, "uuid": "7d1fe8aa-747d-484b-ad4f-7829cab9ab0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472508, "uuid": "7be37c5c-aaa2-4ca6-bb95-3a4fc7e2f524", "value": "bf7e3aa8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a4c74a-b9aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542570, "uuid": "a74ce664-6d61-4716-ab82-62b78772a253", "comment": "Malware payload", "value": "4623d822852a97c812d4be022438c49c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542570, "uuid": "1876ec5e-2c51-4637-a131-eb9d74ca534d", "comment": "Malware payload", "value": "12ec9aee949413825d62f1d9d5dc7dffead0a82e8d4a9877af0280b851771a1d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542570, "uuid": "546abdfa-a904-4b95-86c9-8a242b2cd655", "comment": "Malware payload", "value": "4c64317c172f9dfea03ed9f4cee6fe809d8195a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542570, "uuid": "da5b3ad6-57a4-45b3-8b3f-8485745aa1f2", "comment": "Malware payload", "value": "c8a2338b481313553eed4d93f66efa93445d757329d75bcf0b71ceb2509d7da56d8317ff5827c3355c58be5864ea5fd3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542570, "uuid": "2bbb66b9-99cd-458a-8217-ea4f351d1813", "value": "ED04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542570, "uuid": "273d6874-9bb8-4445-b687-2778105f3917", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542570, "uuid": "1f124ad5-a6c2-4908-ad53-d56adbbf8a87", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542570, "uuid": "7357a49e-4a72-4124-8a51-8c5ae119e5d3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542570, "uuid": "602b3f4c-de2f-4d88-9716-90e9968a4a06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542570, "uuid": "17b51230-b2bb-49e4-865d-3d52d9b8b72b", "value": "4623d822_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ec17b2-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545975, "uuid": "a9c6e57e-2223-4f16-ab3c-6e0e9de141c5", "comment": "Malware payload", "value": "6f5cba95cbf1c1a742f8a5071fad6113", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545975, "uuid": "ce0b1ee7-2b30-4dcd-a09f-0f50b8f28961", "comment": "Malware payload", "value": "1349af48c7e4760324a1bbbf5812f5388d53bcab3575f1b647a9d960911ab453", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545975, "uuid": "8d719dbb-f53e-4911-abe3-bd31feccdbfb", "comment": "Malware payload", "value": "6f44244cf35973d7474a97996eef4df53740cf2c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545975, "uuid": "7ca31843-435b-4501-a33a-a288b66e7029", "comment": "Malware payload", "value": "e7402f9adb0830f68c148b561867061da39c06156e7d0474abbc6e55d2e65e3ee0b660a0d826ccf0c34a025d33923c17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545975, "uuid": "ef0d5925-be9b-4b25-9b88-b81a36eea7c0", "value": "B304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545975, "uuid": "e39e28f1-406f-4d94-8b06-bda0c7e105f5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545975, "uuid": "aa6608b3-eb88-4186-859e-2cf436d8425d", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545975, "uuid": "b308a035-e2c4-47c7-ba6d-b48eae61ba7a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545975, "uuid": "0d02ac08-06af-432d-a255-fc5b54201b19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545975, "uuid": "a730ba6b-0f41-42d9-a3aa-4916ca7617b9", "value": "6f5cba95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234a03ab-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540877, "uuid": "9cc22988-dede-4410-ad41-f54dac88b8ba", "comment": "Malware payload", "value": "605e966f13b8d6b184968fc062af3fc1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540877, "uuid": "9f4d1ba2-3631-47a6-8a87-7b80f04d14e7", "comment": "Malware payload", "value": "13c7e84674c90227b6aed828cbe8fbd82606b2dc876adb1d3b9090fb6485a508", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540877, "uuid": "20aada6f-f17c-4e5f-b07c-425d5b18da56", "comment": "Malware payload", "value": "3ff9f923d2fa17ce6444f5f52e99c5391e05b776", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540877, "uuid": "dacaa945-1496-4be8-b850-0ee99a40484e", "comment": "Malware payload", "value": "0ce64d41d70bb5f9df2eba9ccb1607cf6673d6c21648c2fa200c0d70e534211744b4d504d16a594e667379ac1d517a5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540877, "uuid": "c0ed360f-c70d-4fb2-a3fd-06df5eddb940", "value": "BE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540877, "uuid": "ed360edb-c599-47f4-b03e-b0ee45339aba", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540877, "uuid": "5d3a97fe-9ce6-4aaf-909b-38fb6573c5de", "value": "3072:UV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:UV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540877, "uuid": "c5491e07-61d7-4ffa-ad22-d2cdad43cc0d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540877, "uuid": "687eac53-eb88-4d47-83d2-84061bd8ee0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540877, "uuid": "7df85751-fa9b-4be4-ac10-57ec0c41f9bf", "value": "605e966f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52ee1a3-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529552, "uuid": "598a1fef-68d3-4ff1-bee6-45e859209e7c", "comment": "Malware payload (Dridex)", "value": "c074c315f321143c8027042ec901a077", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529552, "uuid": "da87ceae-fbfe-4b95-a794-ea7f6b78e03a", "comment": "Malware payload (Dridex)", "value": "13ff6fffb16923050b52ccf86d43298216b60ba7681f871c86142cfc1a41e26b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529552, "uuid": "ffb9018e-4bb9-4a0f-99da-aabcb1a97274", "comment": "Malware payload (Dridex)", "value": "caa860873743b4b24368c7b6bcbf872c289a5d72", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529552, "uuid": "5177ca2c-d9bc-4ba5-95a1-7ce70fd26a29", "comment": "Malware payload (Dridex)", "value": "4b481e7a9249f1e29b0c3c86a1811e9ee91a1357c1a67f093db8cc8ea061bf795e777f5d0c4a1e387296696419f681a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529552, "uuid": "2420cd23-8cff-40b7-ad2b-eb8778a68917", "value": "E3F3E141F9278CD9E893167DC33A173B51332F2E921A87F4FFE5DAE1A63492B4914881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529552, "uuid": "f3eec5a4-98ea-4c6b-b9a5-ab5c322e277c", "value": "fc47fd76b9a60699eeca15d304e88a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529552, "uuid": "69ccc27e-d263-4eb2-8524-b62554aa655a", "value": "3072:5BefihU8fQ2Sob/xg+eNV1A1I3aiI8i3GdVAzuECtNjP3/3ioP7y11a0E:5Befiv/12+2A1AIpFzxCtNjHSoPm11J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529552, "uuid": "d180a4bd-9527-40b1-9c90-0d3c1308ae0e", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529552, "uuid": "83e58a63-ca3d-4205-9f91-b4c6d6157d4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529552, "uuid": "c7db8e91-54de-401b-a738-19c47d6ea323", "value": "c074c315_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707d7a9d-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528121, "uuid": "a12db9fe-48a6-4b54-86db-59c9628414e6", "comment": "Malware payload (Dridex)", "value": "c84a5d9adeb1070df19553935107fc77", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528121, "uuid": "eef23f5b-b614-4e37-8150-c797a4bf6d3b", "comment": "Malware payload (Dridex)", "value": "1407ed16a477052d1c92143137f2f7d8803dce0e95ab77f3390ba8ff78f2a58b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528121, "uuid": "3f2001e0-7e45-4495-8b76-f3c1984c592a", "comment": "Malware payload (Dridex)", "value": "5f66a27a4f97d2c638cca7248fc79a9b987acf95", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528121, "uuid": "9049ed2f-9ff9-4264-bee5-ff7835105ea6", "comment": "Malware payload (Dridex)", "value": "37ae527e845dc0a89e551ae95cca108ba1c40e7c53c35fb28f73dbceda865cdb1ff7e4e93c6dec6a21f9aeaabc3497ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528121, "uuid": "02f4b91e-8564-4099-815d-c16cf4e85bf1", "value": "9604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528121, "uuid": "41330cee-2276-4687-bc81-5b671c2003b6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528121, "uuid": "bdee0bfa-b868-4e1b-9b9d-9d82bdefbfcf", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528121, "uuid": "c3eb7feb-64cf-43b0-8c72-fb5f7b58581a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528121, "uuid": "f945327a-e1dc-40bb-b234-e7015cf0b6d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528121, "uuid": "88fb0ad8-bb5e-49dc-b490-c2b07bc24b74", "value": "c84a5d9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227307b3-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "d4d2f078-04bf-4cba-b3e1-714f2dd2c725", "comment": "Malware payload", "value": "d61b315bdaab58241eb723afae605554", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "132cc804-c03a-41d0-bebe-78dcaabc0cc7", "comment": "Malware payload", "value": "141287231af06444c9af08bc78f1b47e3857bc2eea4d66aad298f53d20fae9e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "2c378b87-4206-46a7-8d86-15eb6c084833", "comment": "Malware payload", "value": "defef2565596dd76855d5e0e70aa3cd26f92d4ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "ffb0e7d3-a64c-4b8a-9a2a-98e9df4b4e15", "comment": "Malware payload", "value": "a93283560de9f776a4740900384fd330fc9a3016890031fb940ed997ff152c0e34f14fd5b521e40d9c3f4a65def72324", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "3e7c4465-1d1e-44ee-86f7-580ef2626bd3", "value": "1004B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "ccb522a8-a4bd-41bb-8c89-f6039b989fe8", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "38cbced4-4213-4c00-b7ad-899bab4861ba", "value": "3072:BWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:BWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545600, "uuid": "de24aa9a-5d25-489a-90bf-dcd799ca33b3", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545600, "uuid": "51e80c6f-a627-443c-afae-d407f7f11b5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "3c25ea08-9ace-4109-bcc9-ba0248ade429", "value": "d61b315b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2408b25-b9b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621547156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547156, "uuid": "37dc51ca-7012-44aa-9ec1-27e8cc317be3", "comment": "Malware payload", "value": "8060ffc3ad7bf159dbde01a77e5642e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547156, "uuid": "4ba1fd49-4f94-4add-8db0-961e9c7709ec", "comment": "Malware payload", "value": "143d475f35064e1f291c2ae156ba4302a0664c623b8707c1d0c9fe2967734f41", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547156, "uuid": "85ddba00-0d96-4c64-814f-8788335accee", "comment": "Malware payload", "value": "0a0e9de207c26a19a7e451b4b5f010829dc64d8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547156, "uuid": "075d7dd6-1dde-4bf6-bca3-dc62a66f6de8", "comment": "Malware payload", "value": "6770401a9433e07459e3d49b8ec99dbc55bdbf005928524fc3c08ae20f10c42292225caefa640265e164575a76345478", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547156, "uuid": "0fa08f34-be24-4b54-b8f0-d83bcab3e04a", "value": "EB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547156, "uuid": "b8e892d5-ed8b-46f2-b7f5-b09676cc29d4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547156, "uuid": "3042f7fd-56e7-44a2-8f2c-6aba613862c3", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621547156, "uuid": "8d7b3522-4dd1-4acc-b0e3-a27ef7c39714", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621547156, "uuid": "1db5cc45-40c0-49ab-90d4-11183a9389c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547156, "uuid": "6a456f8e-fc20-40a7-9a56-9ce177fce536", "value": "8060ffc3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3558d7d7-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533176, "uuid": "59f690ba-bf75-42c8-b83d-42692e53bcf7", "comment": "Malware payload (Dridex)", "value": "f66cf8eb77506309e3d37dcf18e071e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533176, "uuid": "af5d7911-ef41-4222-b6a3-ada0e9efbcbf", "comment": "Malware payload (Dridex)", "value": "149fa04a34aee53319e457668dc757d9782734c4f5dcfc1537399d9d3c1fa026", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533176, "uuid": "81464e8d-fc4a-41d5-a898-e8e8b72acd6b", "comment": "Malware payload (Dridex)", "value": "cc49ecdb8363babdbf513e92138f765fee16804e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533176, "uuid": "7f24015b-3346-4c6f-9fa7-47120851ab97", "comment": "Malware payload (Dridex)", "value": "5e472a456eeebdc96713ae67798b2219154ff89ec8c723f4a73386a1461a55df582af3b27e7032d3ca60299674f9cf72", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533176, "uuid": "20e34074-2198-478c-b491-1ed58f14f1fa", "value": "2A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533176, "uuid": "2bfd46fa-7445-45a2-a6ff-91e67e61983b", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533176, "uuid": "62da5854-1efc-49a6-bfe2-1f145c38c784", "value": "3072:fi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:fH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533176, "uuid": "edc58ef2-3e6e-436f-925d-d6356ec57b5d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533176, "uuid": "b8c35f22-0ada-40fd-9941-a4543547cb89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533176, "uuid": "5a2352e6-2799-4226-9497-06521cdb2e0a", "value": "f66cf8eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e6f59f-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540076, "uuid": "8c80bb92-57fb-4f71-aa05-91fdd7db1a06", "comment": "Malware payload", "value": "b51686492c264c72327a88d13147606d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540076, "uuid": "6c531c7c-d197-4060-9caf-e4309d269a8a", "comment": "Malware payload", "value": "14c91e16a043798728bd288ec4252cd35a443af797b69b33f18ec8d6ae39fb9d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540076, "uuid": "821de93f-3163-4263-9a82-57c90b48510f", "comment": "Malware payload", "value": "263b2a3a3797e61d55ed16c659f0df0cb3dbf091", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540076, "uuid": "280b4fe4-7e79-41eb-bee5-4508dbc24b65", "comment": "Malware payload", "value": "29c8f6966797b084c7aa02361ac8df73ffb3fe03ac413c883db9508a3c05964f3e6596bb6525a227eda33d444f468836", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540076, "uuid": "7ab9d31f-b4a8-487f-a301-5d941bf8748e", "value": "D704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540076, "uuid": "c4e294e7-5b30-4da5-ae97-63001096337f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540076, "uuid": "fe26251d-0dca-4697-bc63-2dc05be8a9ca", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540076, "uuid": "49c60908-61b2-4a3d-97f6-486363ec9e75", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540076, "uuid": "5c357c05-14f2-4fd5-a9be-5d8dc81904fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540076, "uuid": "ad6a52f3-1331-4547-ab91-93614ca8df69", "value": "b5168649_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce5f85d-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621523955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523955, "uuid": "719f6b56-b59a-48cc-b674-927c6582b594", "comment": "Malware payload (RedLineStealer)", "value": "d119ff15dcdd36ccc4cfbe62b39e5e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523955, "uuid": "64d5a39c-51ec-4fbf-8c34-bbcd94bc4d66", "comment": "Malware payload (RedLineStealer)", "value": "150d707cc2e9d784f0fbd252163607d356f8e0895f5780fb592009f276d44cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523955, "uuid": "b9ad6aec-8a5c-4269-bb5d-a765bea74619", "comment": "Malware payload (RedLineStealer)", "value": "fa10b151d7a3444e5471aed19d110918641a90ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523955, "uuid": "90c478e2-c8e9-4610-b76d-cb0d7d43fbe7", "comment": "Malware payload (RedLineStealer)", "value": "5281cf7f9bb5698139d940bf5a953a65e024424eae3a17c0439141b86b32852a86f3a45ef3ed2353f794f03fcf97e1bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523955, "uuid": "3932bdb2-b09a-4cfe-8c02-8c420dc479fb", "value": "23849D01F691C034F5F3D6F54ABA92B9E53E79A1672490CF22D42EEA5A746E0EC31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523955, "uuid": "d6d082ac-fbb3-4cc1-b0d9-9e67089c3d0b", "value": "63b5f22f46dd8215a05df479a97ff24a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523955, "uuid": "aa609407-b48c-4e47-a45d-775c978fb8b0", "value": "6144:cSqmNu1z39DEnIWwTBXPw4bzmPEzfesiYumlrHdbsaXRLVFNoQmhMkCEvibmM/G4:cSVNu1T9DEnKX9zfFemlu0v0CfKg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523955, "uuid": "91bf80c6-7473-4e9a-b11d-16f94ba210db", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523955, "uuid": "511222cd-1135-4073-943d-a5eb572be2a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523955, "uuid": "1d022a9d-ce07-4a0e-9b63-e22d1aa0369b", "value": "d119ff15dcdd36ccc4cfbe62b39e5e1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12cf095-b92d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621489146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621489146, "uuid": "714cbfee-ebd5-4fc3-94af-2edb9c77964d", "comment": "Malware payload (Loki)", "value": "eec552f27ba857346b4069e02f8c21bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621489146, "uuid": "0e101a08-5287-4dea-ab86-1c400d0edfca", "comment": "Malware payload (Loki)", "value": "153a9c93c97635b9e91b6423cb01914c6a12a52e5aca08d0728bd9f2e06fb59e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621489146, "uuid": "a7f1a1c3-fe88-4c47-94c5-0778a5bb4b3f", "comment": "Malware payload (Loki)", "value": "beefcbd5cd91cb64006b4d12e6225f08bfe564bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621489146, "uuid": "a48e9fbc-e6b9-409c-b7a7-034d53c43e99", "comment": "Malware payload (Loki)", "value": "f92c95b8abc4777991f7af930ef468b7f78754001e902f01fe5046e5a306cae7c86aa255716939e2051d7ec5a2086c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621489146, "uuid": "7b11b41a-2ed7-4492-aa55-da5d587a09f4", "value": "EAF3F1AE32E198BBD10605711E339B67F37FE602630186236F205F6E66112D3DC1929E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621489146, "uuid": "4044341c-f579-4330-9a77-e7033bfd855c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621489146, "uuid": "621a726e-a967-4d6f-bde0-fde9792d1ade", "value": "3072:LQIURTXJvgjMHzgPvTcnYbsYON0CPahu1y9QF+uPrp/oH2z27:LsBTgzcnysYOb8U/Prp/gm27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621489146, "uuid": "abfdf3fe-48b0-467b-99ea-76a1b7b56e54", "value": 158364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621489146, "uuid": "34c035bd-d5b3-44a4-812c-833ccab65465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621489146, "uuid": "45b8189f-8b3c-4597-bce7-e9d525cb6e3a", "value": "Swift Advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cae964e-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535443, "uuid": "782387f4-427c-4b11-ac47-4abf53db3626", "comment": "Malware payload (Dridex)", "value": "414a25ace67fd803907cb597bb03be8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535443, "uuid": "e4f3f3a0-e134-450b-a54e-3f28fdbc5adf", "comment": "Malware payload (Dridex)", "value": "153ed8b0f1090a439518e9591a63c4748fea3ca63922f826dab8a5288dfb7e2e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535443, "uuid": "1af294f9-a4c9-4240-80f3-31d042fc6441", "comment": "Malware payload (Dridex)", "value": "714e7bccb89f74f70c5ab70bd7c07b1725f72e40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535443, "uuid": "545ba822-6b95-4d6d-8212-707f1f6ef121", "comment": "Malware payload (Dridex)", "value": "437c051a7c682faf6f472462ef40593d1a71426ea71719f0662fea3ddd89b94ac3ebbacd7d7c318219754609f0045087", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535443, "uuid": "ad068c1a-8038-447d-be7a-8b594c94115d", "value": "1B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535443, "uuid": "82897a49-b77c-4d73-9924-59f3c8caed0c", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535443, "uuid": "c24a34b2-02aa-4e60-a617-3d02e8013df2", "value": "3072:Ci49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:CH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535443, "uuid": "dc5c7c9d-4cfa-4294-9482-a5fd10511142", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535443, "uuid": "749ece33-c58d-48be-87fa-a6d17775b506", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535443, "uuid": "957fd05d-4f7f-4846-a06c-e24eb555e5ff", "value": "414a25ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8526af-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621487121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487121, "uuid": "05b5be2e-98e1-4114-96b1-0bd2d6066c77", "comment": "Malware payload (Dridex)", "value": "601048128bc4a8f8685517e78d6bb63d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487121, "uuid": "0c48d2d1-b38a-42ad-9806-0781feca464f", "comment": "Malware payload (Dridex)", "value": "154e87c510e14da90f7195734be877e4fbf44b801afd591c03ff3a14883d8121", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487121, "uuid": "71989a5b-497b-4113-9879-492145d015e6", "comment": "Malware payload (Dridex)", "value": "b48d8341220cfb583d9d2c3b91b754637da9438c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487121, "uuid": "47fa553d-8a94-4cb0-b5c2-6af5ac046a36", "comment": "Malware payload (Dridex)", "value": "53a90a74e7034cc9b3d0916cbad18ded65b862c5dc3b47b1123e29848227ecf2fae0256b5d41795e966d8a7cff0da2ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487121, "uuid": "eb7053aa-cab1-4194-b5ba-581621da6b7c", "value": "A4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487121, "uuid": "5dcf5878-ed16-4e7f-b91c-c25350d5dece", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487121, "uuid": "ecb09cbe-3f5d-4907-849c-4a851f0ecf2e", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621487121, "uuid": "ceb3f971-dbda-4f92-973b-ee1ffaa92e9f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621487121, "uuid": "e50ff153-5eab-4c77-b776-77e7e8edf38e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487121, "uuid": "ab53506f-5f00-4b63-85f9-66d7a1733026", "value": "60104812_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b71b0eb-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540005, "uuid": "594f6154-ade8-4a01-b5ea-6429cb18bd6e", "comment": "Malware payload", "value": "5f1a8a18a4377d9e5b710266b26f9a9d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540005, "uuid": "e5b4879e-05dc-4997-94ea-dc9dfa9e3a43", "comment": "Malware payload", "value": "157bd823df3ca33b9d7162a5e6bbc7bd37e47b29cf59996ef5f28a21a9a76c42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540005, "uuid": "0c05a53b-3049-46b5-a5a8-848ee4e87802", "comment": "Malware payload", "value": "496414d19f111bb67f891acbae6b84b4c14ac057", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540005, "uuid": "d95de0c1-57f3-4996-9803-3387235534bf", "comment": "Malware payload", "value": "ac1141256b05362af40c711512bafbadd6fe681af31bf6445e2b0d4e47a048f3a9c5b658f95f461e197bde8cdaff1085", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540005, "uuid": "5f0a0a12-3aba-4e0f-b5da-71f2d9a770b6", "value": "2404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540005, "uuid": "32abacf1-e90b-40b7-b83c-4f126e9fb8aa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540005, "uuid": "45353c53-88c8-482f-8dac-f1ff6b48afdf", "value": "3072:AV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:AV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540005, "uuid": "1a6f6254-80b5-44ae-b43d-10fb9699a997", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540005, "uuid": "3db08ba6-1c6b-48cc-add5-5db4fd1e8869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540005, "uuid": "86c9e40f-6760-41c6-a3d5-3dfa35f6ae05", "value": "5f1a8a18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bcb4fc-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537651, "uuid": "d8da56d1-79cf-45b8-a2b5-d39da4918b9a", "comment": "Malware payload (Dridex)", "value": "108812a2cc8e8e1d354d407d34306925", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537651, "uuid": "16b8b3b6-abe5-401e-bf58-b93280a7e82f", "comment": "Malware payload (Dridex)", "value": "158ba373e8000099a2084d7106d976f0e2ddf6c95b5390ca80e35bdc7f4dcd11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537651, "uuid": "b9627fde-eb4a-458e-9cef-4acd55976bc8", "comment": "Malware payload (Dridex)", "value": "4753dbecc41cc44385078cdaabba0a554d28fd9e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537651, "uuid": "59c23588-1719-4153-81ee-d3ecead67bdd", "comment": "Malware payload (Dridex)", "value": "595b6c92bfa3fb9e36e85d8871a1354b24a1af5f6b24194de284fbe3e733e0913268cd442fdab32a3a043e4e1ca46a89", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537651, "uuid": "1a5b95cd-7c84-4dd5-9512-dcde2a9b567c", "value": "7404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537651, "uuid": "f73e2f64-c9c1-4523-a901-77be37e40322", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537651, "uuid": "45255d1f-be82-4a08-8546-9564d0a36946", "value": "3072:ti49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:tH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537651, "uuid": "a43a143b-a4a5-4500-9171-67cbab869199", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537651, "uuid": "7ec7b47d-14c4-4350-9074-296ce95bc4ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537651, "uuid": "0168f998-0e46-4728-9fdc-a296fb5ae343", "value": "108812a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342838a4-b942-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1621497955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497955, "uuid": "c9833686-9661-4383-9ccc-4567351eae2c", "comment": "Malware payload (NanoCore)", "value": "51a9db78041e0546e9223204c3206626", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497955, "uuid": "f82bc10e-ba61-4ec4-9b77-6f3c89c99514", "comment": "Malware payload (NanoCore)", "value": "158ee72846363fe9636cd7afea38400be56d8be6cea2453a77699903fd5fa046", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497955, "uuid": "cc30dafc-6198-461e-abb7-21ac0487d91e", "comment": "Malware payload (NanoCore)", "value": "fbf2110db3f2e0897096cbcdc16d79c806f08001", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497955, "uuid": "db757a68-d712-4544-8b8d-6113bbaba6a1", "comment": "Malware payload (NanoCore)", "value": "d35c6c34314e208914d0b57c4f782f77e831075e85b6f9fabc4992ee63e560574bfc6d93c8c849a4673e14556e985cfd", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497955, "uuid": "3a8b0443-aa84-4e1a-bd77-fe4a47245087", "value": "1E053350D371EE1AC14D41317482F64A0DD06893A880DF2E96FE51BCEA6367E8D9FC9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497955, "uuid": "9790aefe-9fca-48be-b9f2-b96f17285ea3", "value": "24576:DfW5TukoEA1zlcJMlJkg2H4b66jSatV3BJLPtp9H:DwCkoNzlc4Je8GatNl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621497955, "uuid": "f79a7851-32b7-4470-a599-98b3be9016c1", "value": 804485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621497955, "uuid": "644f7ce1-3ce9-4b28-b1d6-0b80e723ad1e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497955, "uuid": "6012aa90-8202-445e-b70c-a17d95877d05", "value": "51a9db78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce4227f-b977-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520760, "uuid": "99a3b64f-309c-4ee5-9b9c-54850490cdce", "comment": "Malware payload (Dridex)", "value": "62e9ba8950a180112494a2280e4b46e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520760, "uuid": "49ea9cf5-f1dc-4eb8-8e9e-e3a1a95aa62f", "comment": "Malware payload (Dridex)", "value": "159adc6d00d88794c130de30555ba7b4d16fee501fcc0fdd7eee89818f68905a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520760, "uuid": "0117afd2-f992-4ad7-9297-bd3de1b91cda", "comment": "Malware payload (Dridex)", "value": "576da933b0a81e4c801375cdbbf2ae72e55a9e32", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520760, "uuid": "6fb6f27c-de8b-4c1f-a5f7-7c9827166ea8", "comment": "Malware payload (Dridex)", "value": "2400c3db68f322403d6dcf240eec97ea94b8e3761f5404f3a8c427d7bbddf5baa19d44a259aba7374bc3299bda84d661", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520760, "uuid": "4a67de40-935c-4679-a9f5-d216b028ed78", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520760, "uuid": "415edf75-300c-4db7-8c67-2588478a2909", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520760, "uuid": "1bf456e5-a03a-40fc-9eb0-88e39aa1b6bb", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520760, "uuid": "bfba0951-18a2-431e-bfc2-204153fd78fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520760, "uuid": "9d4397c6-7c38-44f3-9d0f-b790d7ce5afc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520760, "uuid": "4086f497-2c14-4aaf-ae84-eb097006fefe", "value": "62e9ba89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe71e78-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "2732afea-72dc-405d-b35f-10c9d088063f", "comment": "Malware payload", "value": "85d02f13fe9d94477308972c1318772f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "cab74449-a93c-4404-a89b-b3614b6e8408", "comment": "Malware payload", "value": "15ec34a8e2340b20689411324b61c3d365894f49c1f070aabc4fdd3c8b919fb4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "8828e405-0514-4857-8b4c-b4fe2bd1c66b", "comment": "Malware payload", "value": "0dc412359feb5189ed89365bc8f6a50b2bd14ac0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "dcd98869-032e-4971-8d21-be12b7073bac", "comment": "Malware payload", "value": "1afe6d467e26836af502e4cff2eb69b27830fe9b76ce99b517fdbe3c41a95a3a71a59e1337fcff7340d56ee0682fe79b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "584ac75a-09c6-4869-92e5-31be39dd70de", "value": "3F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "2046ca88-292c-4167-9369-db15f00b7242", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "6dd6bf88-df09-4e06-bd45-82444edb6b27", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542186, "uuid": "bfecab02-b66f-49ad-bd4e-03ccb1001b0e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542186, "uuid": "945d4e22-67df-40bc-94e1-208033073202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "2278701c-03f6-46dd-8015-c5db6c49f36f", "value": "85d02f13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cfe027-b944-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621498785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498785, "uuid": "ca9e41c0-1030-4ca1-a7cc-72db5c1ed50f", "comment": "Malware payload (Dridex)", "value": "c9cb50d555c48d4879020a862b855b07", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498785, "uuid": "dbb42b54-ee82-4a4e-92c7-0aa986cdaa64", "comment": "Malware payload (Dridex)", "value": "16824bedfadf6e61841ee5d6360dd196b73c04817bd66ef98efddd02e8c577fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498785, "uuid": "1bae6459-2325-4ce5-b0fb-3ac92d5d988e", "comment": "Malware payload (Dridex)", "value": "6bcb26a4e975b3467e9dc2ee57e430a69f24d52f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498785, "uuid": "912e1b06-d22a-44ce-93b9-41ba068e559d", "comment": "Malware payload (Dridex)", "value": "f48a6aec96f58ea0c8971b01c204323152bccc36ebdb7850c103e5e0e0d5426a2cc60c87da2736b4a876fca11caf2d36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498785, "uuid": "de1b0ce9-2b33-45af-a3f1-948f1c75de2c", "value": "BBF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498785, "uuid": "9330bd83-cf02-49f4-ada6-5b8d61f43355", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498785, "uuid": "6c24189d-f43e-47ff-8072-5651c0a46b0e", "value": "3072:UIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621498785, "uuid": "cf8b2d75-f9ff-4713-ae27-009bb76838f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621498785, "uuid": "4b8d2760-b4ec-454d-b19d-f237b9eae916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498785, "uuid": "7c9e65a0-17da-4a2e-a62e-00df3691a459", "value": "c9cb50d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a0726c-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528940, "uuid": "70f1a679-77ce-4604-b973-3ff0324ea3eb", "comment": "Malware payload (Dridex)", "value": "91b633e0a2a03afd6b0d4049b8df1807", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528940, "uuid": "e41d8c34-501d-4bc9-95c1-cc56c5f34b96", "comment": "Malware payload (Dridex)", "value": "16c194023ce637a60343eae2bde9ad94c5c21f8edbaae93a6dba64768659e31f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528940, "uuid": "2e6ded68-22d1-4de3-b1fb-05705545507f", "comment": "Malware payload (Dridex)", "value": "65f34f4a1c352f65dc71c57600846ddb9b3e2e82", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528940, "uuid": "748c1673-a7e4-44ba-b090-1cc330a6e9b2", "comment": "Malware payload (Dridex)", "value": "bcac9bbf887855eb64a886dc59651695f907e43ac7a66a2f77543c678fc6469df200f0959b665424d116027cb575a36d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528940, "uuid": "dacda2e9-7d55-41a7-9a64-4499711f0eb2", "value": "AC04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528940, "uuid": "b00c2aa8-3947-4e2f-81d7-dcb0e785080d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528940, "uuid": "dca60ad5-db91-4bbc-b846-1502be851eb5", "value": "3072:Ei49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:EH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528940, "uuid": "95457d33-01a0-4698-ab94-388a55f2c7e6", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528940, "uuid": "58d7adeb-3fc8-4645-bab8-746f4b7faea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528940, "uuid": "bf104aac-4369-407f-ad36-60cdc9814b9f", "value": "91b633e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccedca4-b9bd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550879, "uuid": "1ea9ff79-93e4-4e7f-b13a-16175f44b1f9", "comment": "Malware payload", "value": "0e4a0fab0f6f049588b35cf43498f8ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550879, "uuid": "b9a12421-acae-43da-8e75-b346da0c0af1", "comment": "Malware payload", "value": "16ca69bd33957a2d1694cec9a281fae56e8617910cb9096fb81b4c3252367ab0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550879, "uuid": "562b0d9a-e184-4acc-be81-02b3639e6d0e", "comment": "Malware payload", "value": "4b0c3648ab5e391718685509a3c374b07fd62f97", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550879, "uuid": "f55d454b-cfd3-4d74-a3c3-a5c4709766ca", "comment": "Malware payload", "value": "55c0c0318b3dc3f8bcd964d54c5c60749dca052d6b471805678b432961e9382b7c0f7ec4e309ecb9be52d9795317bac0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550879, "uuid": "a4389081-af37-4438-843d-023925f5c22e", "value": "5C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550879, "uuid": "8cffa09e-ab91-4890-bea5-ca88128dcec2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550879, "uuid": "e0752f2a-762b-4585-bb93-5c6fa89416f1", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550879, "uuid": "7ddb0dcb-deae-4141-b737-da2e16f14baf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550879, "uuid": "84913d29-2974-4b1d-b5ae-879f97c7874c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550879, "uuid": "1c4049ef-71e4-4c29-9fea-96a342548be8", "value": "0e4a0fab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07e37c7-b93a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621494728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494728, "uuid": "7a3eeb64-51c5-4657-95e7-dee6f7997af4", "comment": "Malware payload (Dridex)", "value": "656d43563703d7feac95c84353be01f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494728, "uuid": "eb9e2430-6024-4aad-b23b-64971b1b901f", "comment": "Malware payload (Dridex)", "value": "16e2bf7edb627de2ee454c2414a5d9efb654dc2934e8454bee6c5a6a86031b1f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494728, "uuid": "b2e4a1c2-4c42-4373-9928-18a3cb522653", "comment": "Malware payload (Dridex)", "value": "1e3809f9124413211205c9d3741363450ddad0eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494728, "uuid": "5e9fa779-e223-417f-85c9-8e2dcf015407", "comment": "Malware payload (Dridex)", "value": "03ebd2ae26005b077d1b75c6af4229fc383dec56081689855400d8144de18f9d7deca7cc8e7ab9c7d4499cfcddbb3c66", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494728, "uuid": "f95d3f02-4296-483a-9a5d-eeb096ec3df4", "value": "4DF3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494728, "uuid": "8a14ed21-286b-48e3-af84-789cff7e1906", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494728, "uuid": "7e3e3f86-d93d-417d-a745-e61d20bd5d0a", "value": "3072:y9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:y9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621494728, "uuid": "749f8d1e-fccb-43db-80ba-8edc12772401", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621494728, "uuid": "63fc02a2-4a85-4e5f-804d-54011758e981", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494728, "uuid": "809be929-6349-424f-b4d9-ba7a57b6e1b5", "value": "656d4356_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fa9249-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483785, "uuid": "ecf16cdd-49b0-4cf0-b2da-a8fc3060f6c7", "comment": "Malware payload (Dridex)", "value": "33ce5ef0f6a26e48c065e2c4f3d14b97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483785, "uuid": "7ef79f92-7bf5-4031-b301-472467d14ed0", "comment": "Malware payload (Dridex)", "value": "16eeda4c3171e84609427abdb1d873183f9ba47529be327ee00be69cfd4e4e5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483785, "uuid": "b12ad476-4648-43ba-a671-60f93a576ff2", "comment": "Malware payload (Dridex)", "value": "931ebc766a67cf7513e0e6a68facec954c680f50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483785, "uuid": "2d7589b1-f715-4a19-aae6-107a49fef8b6", "comment": "Malware payload (Dridex)", "value": "0704d804012f7f03f631b3e0c332946957bf0bcf9a2713db8fb4dcaabe7335a9edb72a50d4b4f9a7bc1e7b0d1c67d8f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483785, "uuid": "dad2c360-45df-4955-b291-49b12130f13d", "value": "33F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483785, "uuid": "78d13501-88b1-4df1-ae39-6f8fac379857", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483785, "uuid": "6efea899-e557-4dd4-9d1f-898f561d25f9", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483785, "uuid": "31a41d05-927f-47ea-8601-cd2b6221b1f4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483785, "uuid": "63eb14b0-3a9c-4616-ad5d-8ffc9b2eac33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483785, "uuid": "5296e232-9535-4972-9a6a-ae0b0902cb75", "value": "33ce5ef0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89611f0a-b981-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525157, "uuid": "c222c558-5707-4aa4-b6a7-263f803aae50", "comment": "Malware payload (Dridex)", "value": "ec9147259adde11148b1b7ad26072fe8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525157, "uuid": "0deaf281-8e4e-408c-9689-4f933976ee23", "comment": "Malware payload (Dridex)", "value": "17861120b97e620127eca1652c7572b486bb388a32673941b36341dee1b4e81e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525157, "uuid": "a4999633-8079-4014-b33b-40f6d4143460", "comment": "Malware payload (Dridex)", "value": "2177de3d23026a583963a092bbf8e53e3a88f02b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525157, "uuid": "aef2ac8d-135a-415a-b18c-bbe15cbb3e65", "comment": "Malware payload (Dridex)", "value": "eb08a8f3e22a542185ab796bdb7d69b30636dbf093df66e623ca0be6e5bac04a1bea78f326251ab4c54c22a1394b570d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525157, "uuid": "66728819-ac1f-4903-b37d-1e2dfa1c6838", "value": "A404B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525157, "uuid": "72bb1a3e-7307-4ca4-b6d2-50f6997be8be", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525157, "uuid": "a9e5237f-a5d7-4ab5-a7cf-605781bbefb3", "value": "3072:7WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:7WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525157, "uuid": "f8aebf4a-ef08-49ba-ad6d-073b73cce7a8", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525157, "uuid": "f3eb0d28-a7f0-4d4e-8168-ee18b7dafa16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525157, "uuid": "27959dd9-d1d1-4c26-b84f-9f23797e8c4a", "value": "ec914725_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8848a4d2-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476192, "uuid": "2ce8e6b5-e866-4f95-aa2c-af3e7754f28e", "comment": "Malware payload (Dridex)", "value": "855b214e121441f4df3744dbcd05ac79", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476192, "uuid": "a25f2994-6912-48d2-b640-cf424d76cea5", "comment": "Malware payload (Dridex)", "value": "17ac08667da66cb849ba0e9842763bf287a06a06d581439b34587636b6c04689", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476192, "uuid": "b61d488b-305e-41d6-8d0a-2178c351cd03", "comment": "Malware payload (Dridex)", "value": "3209bfa897791133b1604ef2e21f240562329807", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476192, "uuid": "348cd1da-ca69-436d-bc69-ea30939d7d4c", "comment": "Malware payload (Dridex)", "value": "022997a79d8cace15c7020855dfefb31abb31331719bb2b8abe0d5ca9780fddf8dc65abbd1adaa94a21d807ff721fe87", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476192, "uuid": "3474a6df-723c-49ad-8757-ccea7376ab85", "value": "4FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476192, "uuid": "930cbb21-ba55-4dc4-8f32-0646d2bdc7d1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476192, "uuid": "4021a5fb-8308-4df7-af25-602892df668a", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476192, "uuid": "758e4cb0-4a7e-4326-91a4-7f4ce91aa815", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476192, "uuid": "c88b40c3-2b7d-4097-a304-d9877fcf97b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476192, "uuid": "d026a769-b8a3-41f0-963a-9229392c38c9", "value": "855b214e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d7ffab-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539425, "uuid": "04b82a0d-68a0-4e59-8439-74788a83d8ba", "comment": "Malware payload", "value": "ac1d4ccb566b035fe39eb028eb6e5a6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539425, "uuid": "8127f9b1-bf56-44aa-85bf-ddc110c82527", "comment": "Malware payload", "value": "17bee81acc9e4b434f24cab8794cda34c80cb52b58610dbf2e00e288d1b9fa3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539425, "uuid": "821d72b8-2708-4224-a804-0538f1f4b1ab", "comment": "Malware payload", "value": "05c1327545d8638f76c11eb7b47fcd39d7ad4f45", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539425, "uuid": "7cfea5c8-d412-43cc-95f7-306b5bb2a457", "comment": "Malware payload", "value": "29f2a7271ff4843e305bd2a14197ef1137b7b8a11282873fdb209ee58772cd9fd5434d78fdba7a9c532629dcf6542802", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539425, "uuid": "1174d601-04f3-4685-ac36-6375b8a02fa9", "value": "C404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539425, "uuid": "64c94889-2b10-45b4-909f-e2b10ccd98c9", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539425, "uuid": "1819cb2e-c64f-49e2-b271-6c5a15a09617", "value": "3072:Li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:LH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539425, "uuid": "06c97cc0-a585-48cd-99ae-6e9395c76f29", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539425, "uuid": "81a75f9d-d7c7-4545-a7bf-0128371245f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539425, "uuid": "b9010eab-a6b1-4e3d-abc3-1698f345b1ca", "value": "ac1d4ccb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c750fc-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536754, "uuid": "f358ec88-9443-43ee-8941-e3639bc43fc3", "comment": "Malware payload (Dridex)", "value": "d3fe5ca45fd709fa7a1eee31320b5a67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536754, "uuid": "384e414b-2528-43ed-856c-46f70bda1245", "comment": "Malware payload (Dridex)", "value": "17df127b2402fe54f46801afdc596249bd0d0321224a5a08412de6b454e2766a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536754, "uuid": "cb00a310-a68c-4630-925d-2f0443573020", "comment": "Malware payload (Dridex)", "value": "ba5e4482c1c608c1889c6f01481b28d7af0bf65c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536754, "uuid": "3abd84c7-187c-408b-89f2-d97cac312a17", "comment": "Malware payload (Dridex)", "value": "83b93f082348f4112df2a63048733008786073439c273fa967f08e411941771fa1bb4dbd51314e8166f2be0dbd333805", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536754, "uuid": "45b8cf2c-4126-4560-9558-384abdb32c29", "value": "2204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536754, "uuid": "92460c7d-f014-4983-9040-737e6e346ffe", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536754, "uuid": "ccaf2244-be50-4f38-8b78-a6481f2185fa", "value": "3072:ii49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:iH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536754, "uuid": "c5b85fd8-c3c4-472a-b2db-40ddef415e7b", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536754, "uuid": "b7c60991-2c3d-43f5-8b06-c10b2ea85cb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536754, "uuid": "bff6fd51-4c1e-45b7-905f-cd7f35de44bb", "value": "d3fe5ca4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f338a6-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540126, "uuid": "81092ae4-2ced-449c-939c-4fbf3cbbfb3d", "comment": "Malware payload", "value": "49b583390f235992e825718c3b48778e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540126, "uuid": "4b2471fb-4722-4b4a-a57d-a02e9169ad34", "comment": "Malware payload", "value": "17f15b328e67fbe85bf24e60bb3870f00fe00a0ab4ed677c6a33b4f158c2ef08", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540126, "uuid": "92f6d809-676c-4634-b026-e98a6107b28a", "comment": "Malware payload", "value": "8d96922c8c38535fa14225e13aaab0a289ab6dce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540126, "uuid": "4b24eee7-f443-47ae-b9fd-fdb963232729", "comment": "Malware payload", "value": "130a21af42718dfb9f0893e4e38b387946e485cdcbf167285efd6e7b69bdb5ce3a76b298582c995270f8a682b5aa5a50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540126, "uuid": "62917e78-ea3c-4763-aad7-920b92a8c5a2", "value": "75F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540126, "uuid": "3f1c69eb-deb8-458d-b9a7-92bf9b69ace2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540126, "uuid": "e481555e-7faf-48cf-a24c-0f9b058e5d12", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540126, "uuid": "847a32e9-f1b2-458b-a7e3-92f27ea6f0bd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540126, "uuid": "75615c57-480f-457c-ae2a-d41dc0465c69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540126, "uuid": "4ceedfed-1210-44b1-b24f-7f314617356a", "value": "49b58339_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4178ceae-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530619, "uuid": "586ad739-05a7-49ed-8be5-5e779c84a337", "comment": "Malware payload (Dridex)", "value": "af3cb145595e912dc4c5059934d844ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530619, "uuid": "f46abda6-1bda-4d99-ba86-598d5c7dcc24", "comment": "Malware payload (Dridex)", "value": "18383975a5d272f7faf4bdb58a2a0fc570a0dd0cebb27deb9999ca82059b30d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530619, "uuid": "72f9ac53-d9a4-450d-8e9e-309f09b169f9", "comment": "Malware payload (Dridex)", "value": "f4b0a8cb093754c5625fce088a63df52569a9a27", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530619, "uuid": "78b386b2-c45d-42d9-a815-6b2fac3bb206", "comment": "Malware payload (Dridex)", "value": "b9202e8143157a278302ede06df2fd065c6f4c43d938ed8e6c17482fc5eb44c668ad640de9f41e352c725b5e9f34e24e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530619, "uuid": "de9bbb0c-e937-42e4-8fc8-ef5e662af19e", "value": "C604E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530619, "uuid": "4e6a5952-e1b8-41e4-b8ef-c46d221ef382", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530619, "uuid": "01f25edb-caf2-4a52-a4db-b9cf58a6e248", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530619, "uuid": "d6ae2e16-eb6d-46e9-b9d0-61dfad2cbf14", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530619, "uuid": "fbdf0620-5eac-4d9b-ad0a-35fc7dbb53cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530619, "uuid": "7e99d29c-0bc1-4370-b275-2419af0d4a2c", "value": "af3cb145_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e17c429-b9b9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621549243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549243, "uuid": "c71cd1c3-16f0-4b37-9db4-15536e446d9f", "comment": "Malware payload", "value": "4ae7c2113bac4f1efd244e3997133543", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549243, "uuid": "8d64c998-8963-4eb8-9a81-25be5366aefe", "comment": "Malware payload", "value": "183888b92e0d1cf3867ed0af9ac72362e228f8136dcc5772d1c7f8368fa22be1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549243, "uuid": "cded3dc5-85b3-425a-80c8-4bf569cf8bf8", "comment": "Malware payload", "value": "ed753cc5453ba7e5ac63429fca3c45edc3eb5b49", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549243, "uuid": "154ecfa6-2a80-4a3c-a4e5-5124502915a0", "comment": "Malware payload", "value": "655d576be5d72399671a4497bfe1301d782866b424dc2ebb22de3362ccfeab0f827182b69e0a4544aca8b1ba3d4ab43f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549243, "uuid": "cfd3befb-78ef-4da1-8e1c-cd0b0df3b5e3", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549243, "uuid": "e98358d6-365c-4d2a-ba16-4f587e3aa375", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549243, "uuid": "bb2d53af-1e69-458a-9693-2c71003f7c9c", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621549243, "uuid": "bb6e776f-1726-46c8-af66-426936519964", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621549243, "uuid": "31b6de31-b3e0-4b26-84df-5d767d32fbb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549243, "uuid": "df82581c-10d8-4d40-8e0d-6a59782333a4", "value": "4ae7c211_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fcc9a7-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539964, "uuid": "4cc61681-3cef-46e6-aa2c-b635607c27d7", "comment": "Malware payload", "value": "a791a6fe320c84b1e97c3c3b37841b6a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539964, "uuid": "335aa4d4-e20c-436e-ad86-81d8d0dcb80c", "comment": "Malware payload", "value": "18979a16181f3526f7cd43dd417e1bf933c8a66c9f2667c017d476296e8ff722", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539964, "uuid": "efcb1ec8-0594-48e7-baac-bf4ef25f93c4", "comment": "Malware payload", "value": "c6faf0a30d2906f92ad2118a85af8b9d09d00874", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539964, "uuid": "2d834f2b-3d62-465d-9ed6-388f55b48202", "comment": "Malware payload", "value": "1611aecc87105ea0e2407c3fd8cb35d96ec7dcfd82fa6781f40d6419ccdacf01b5b6d73393758085a4571cda17308997", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539964, "uuid": "23514f34-789d-439b-bd7f-601e3e239a08", "value": "9704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539964, "uuid": "da7f22fe-d2ad-4e90-be88-54ba19745622", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539964, "uuid": "e5bc4a78-a213-49a4-abd0-59d9bd0a542e", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539964, "uuid": "aadf0565-3680-4291-b7fc-4feaf3ae1fa8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539964, "uuid": "8bea66d6-d417-4555-bfa4-8237c31bf7f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539964, "uuid": "713e176a-deeb-47fd-8ae3-496a480a7c2c", "value": "a791a6fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c435e5-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528395, "uuid": "0d93e410-3c57-4213-b7ba-dff42350de45", "comment": "Malware payload (Dridex)", "value": "5e0ac9c5ebd55d6c9235d284a1433078", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528395, "uuid": "0be22061-fd49-41f5-ab87-14ceda63ad77", "comment": "Malware payload (Dridex)", "value": "1897a9013eb008da601c45e9595365beab3a00bab3038e6549034def82c178aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528395, "uuid": "86e7e27f-ed07-4a51-8cbc-63db584b60cb", "comment": "Malware payload (Dridex)", "value": "5b2a1e36649207bc6c3f96fb7ae5ccd084bcbf3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528395, "uuid": "5bf51485-9469-40b9-abbe-7e529608f73d", "comment": "Malware payload (Dridex)", "value": "1467850dbf907babc7649b449f67528a518dd6fdbcfb09e49560b61b7da74532bc676a97a0ebb62093338d2d5b9ca13f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528395, "uuid": "41e5fb59-108d-4268-97ad-469585105825", "value": "F404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528395, "uuid": "33236fc1-c351-4b7b-8957-f0b38b7a875e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528395, "uuid": "f144ec3b-8816-4e21-b1af-ff00fccb13a4", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528395, "uuid": "4d1d7dc1-3069-4615-85ed-70c285b63944", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528395, "uuid": "5e2aac1e-a894-4214-a552-57b210af2214", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528395, "uuid": "513445d5-370d-4d7f-9738-ca1e7d6c3d8b", "value": "5e0ac9c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7355235b-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483888, "uuid": "ed6d8ffc-f049-43de-8e55-f068b1e7d7d5", "comment": "Malware payload (Dridex)", "value": "6f58ba4e88f3b8c4211b54c5875ff62a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483888, "uuid": "e497e920-209a-4b5d-a9ed-94b18299a14c", "comment": "Malware payload (Dridex)", "value": "18e0f2f616b0a5fd60829b208b391d3fe73d7a4b3c37d6aa196284675083b465", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483888, "uuid": "377f92ff-ce65-435f-910b-e8083f9bfc8f", "comment": "Malware payload (Dridex)", "value": "61fadf11adce9aeb6185558adfdb4d88535747af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483888, "uuid": "0ee9474b-d2ce-483d-bec2-eb244e6409f8", "comment": "Malware payload (Dridex)", "value": "b3a90117297d4d742e73bf4cf4180a468970c95873602d101e746d8294ca237b431d77c22bec3a076829e314f55ffbe9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483888, "uuid": "c1bfe32d-f56d-4c47-af02-c3e78afc11de", "value": "DAF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483888, "uuid": "b36c7165-d4c7-499d-ab0e-146776b0cf74", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483888, "uuid": "a063783a-c0d5-48fa-ae34-c760e270218b", "value": "3072:SIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483888, "uuid": "4e85901d-302a-4b00-a01d-2e8ffba5c74a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483888, "uuid": "e29a9bfa-495d-4b71-be08-530a00d0f3bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483888, "uuid": "373c2284-97d2-4e89-8980-cbfa579306b0", "value": "6f58ba4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce31c301-b9bc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550612, "uuid": "7f0e2da6-03e6-4fd8-8d64-8867adcd7d2b", "comment": "Malware payload", "value": "04e38bf9de1fb1dad6909c0e99619b37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550612, "uuid": "608c98ce-401a-40c3-929e-50ebeb56fc24", "comment": "Malware payload", "value": "18e26c55189a47757b5619d10fa8050e3909882197affeeddc8151a5762b3269", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550612, "uuid": "db575d18-5fcb-4827-9c22-c2d8580edb8d", "comment": "Malware payload", "value": "d9c789191df52a52fe172a3fb35a3c7b830f83fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550612, "uuid": "91b5c325-ec67-49b9-bca2-767ce02a3bcb", "comment": "Malware payload", "value": "3075c1006f0e5a3b5e17c5ffe29957ba03fc47c556c92b49f9741cf3107a41ea0485bb30dd00cec872bfb3d351022200", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550612, "uuid": "2c6b6aca-c7c5-4fd4-a7ad-4e5be580beff", "value": "24F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550612, "uuid": "f317972c-a923-4e6c-b162-8de61aa9ead7", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550612, "uuid": "b10c8ea3-3fac-49b2-a5e3-c0ec491b9688", "value": "3072:99F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:99F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550612, "uuid": "b0738047-e210-4d29-a515-dfa2611f12ac", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550612, "uuid": "7f6753d3-d51d-4428-a576-ef947b795322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550612, "uuid": "565c4580-d0aa-42cc-a995-8fd8bdd50dd8", "value": "04e38bf9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168e7864-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537419, "uuid": "44066427-892b-4e48-a505-b2c55261adc4", "comment": "Malware payload (Dridex)", "value": "827bc2130b68b8a4255d9ceaa72b4951", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537419, "uuid": "31a8b780-df2e-4d94-87f1-448c187546dd", "comment": "Malware payload (Dridex)", "value": "19087c2ad922131f83c1dc8b85e966ef94705bac909c7b940c0643be3e644450", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537419, "uuid": "b95ea85a-0d48-4ba9-9935-e8414b106df4", "comment": "Malware payload (Dridex)", "value": "837d56ad816d230add081bb30e5e66bfdc62119d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537419, "uuid": "ecc85f9a-9176-41fb-9448-466c20517f5b", "comment": "Malware payload (Dridex)", "value": "087c7aa6fff88c528c41704b233df3dc5a05d70f748dbebb896f72c42da6544d05480bbc93df8c232bf27571443ea7e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537419, "uuid": "9cf5c89f-5db4-4164-82bf-4fe9edcc3fcb", "value": "EE04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537419, "uuid": "0f6359d4-327a-42e0-ae52-f0f5e4eceb96", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537419, "uuid": "a70c1490-f235-4776-a4eb-050b973d2803", "value": "3072:0i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:0H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537419, "uuid": "146790e6-b38c-4fec-bff9-d5f1cc5e6948", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537419, "uuid": "1fb734af-7be9-414c-b954-37483562311c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537419, "uuid": "b4e0871c-20f7-4e9f-895b-d1c1c25f9ac0", "value": "827bc213_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffa720d-b94b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621501948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501948, "uuid": "b19b5e3c-c001-4c7d-ba3c-9d79d578c310", "comment": "Malware payload (Dridex)", "value": "f21c4995c3f1a03affa987396bcf1a49", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501948, "uuid": "8eecead6-ae47-49c7-9a49-a1309cb403af", "comment": "Malware payload (Dridex)", "value": "1927595952345ed5a758f7c824c77ef62441dca887a4c83cea7aff8256abbe92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501948, "uuid": "92f4100d-0f40-4629-8845-28df412a80f2", "comment": "Malware payload (Dridex)", "value": "4d3e28d16e36f8dff30d4c703d67bf5955291daf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501948, "uuid": "6b90f4e8-069e-4c9a-8413-9cf6bcc98bc8", "comment": "Malware payload (Dridex)", "value": "896a3ec5abc5cc77d32e2a98f9b9ff2dda9e9b4cf5f8d5b52401fa05c34edfd7a2136db55facf669809596c3db2d20c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501948, "uuid": "97fb5718-22e8-49b2-89d7-9811655a33e1", "value": "EEF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501948, "uuid": "263888f9-85a0-4333-a8c1-7035b176dd6b", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501948, "uuid": "0f6c2f54-e11a-4060-befc-66f43b920a37", "value": "3072:t9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:t9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501948, "uuid": "149b9a80-a560-4686-a5dd-bc4220c478c7", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501948, "uuid": "790ba407-4f23-4894-9d08-a3a811f7768f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501948, "uuid": "6d8a3094-5e50-4f1d-babd-776f02e7228d", "value": "f21c4995_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1c2046-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621533003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "b4bf0405-a6cc-492f-b613-e6f0967e2f60", "comment": "Malware payload", "value": "a5ce20a1bf2a43261393809aa7812325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "c7592ac8-bb2f-4510-ae4c-24947df75e37", "comment": "Malware payload", "value": "1998231fe9d428231ee925203c4f13aaf9de0343a2a5190ee40a69bb272a71ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "3b0af881-943f-4998-9bc0-a3d0835df9af", "comment": "Malware payload", "value": "90c9f226d82a8b9994e0e957e8172413fbf60f9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "d9b263b3-db8f-47ab-b2e3-7f55c5dc1410", "comment": "Malware payload", "value": "d7fbdf01b6b1743115f18e910f8cd11a46a2bac68ae2928114eb3c4af118c5136b42e91296a691d844a130a7db40570c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "97d87483-e24f-42b9-a968-a9aec30d9262", "value": "85B4F16122E56B46E0BEB7B9187150101BFAF865E732F70D7E9520CD45B6E008BF2B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "e7e3026b-659e-4d3a-b0ae-6b710ca4e02e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "2380490a-f788-4158-96b3-53b4db9c5343", "value": "12288:3XUx5MY2F9ae0w2kgMmtElHtW5a6ZZ7QmwRtYY07o4gSmeyKz:3fY2LaaiM6EnW5aGQjklmerz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533003, "uuid": "ed26c0a3-401a-4385-8871-17e1f41917c0", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533003, "uuid": "cecf6fa3-5659-4bea-862c-d0479c2c0955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "5171f860-839f-4511-b7ef-e29f6a2715d5", "value": "PAYMENT COPY .PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743473bb-b94c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621502358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502358, "uuid": "8fdc5001-1b31-4d38-88c3-12874f4f81d1", "comment": "Malware payload (AgentTesla)", "value": "a95b8ef8ad51a00880d147b020d65eb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502358, "uuid": "2f2a11cf-8405-47d6-a254-e6235dc2ab1e", "comment": "Malware payload (AgentTesla)", "value": "19aa079c6de34eb550070aa69f98c741aefd04d8b83b1c7e23bf89576ba1b69b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502358, "uuid": "149e1549-a869-4b20-9688-ba3ceae9eafd", "comment": "Malware payload (AgentTesla)", "value": "f800a107b8f150430cafb552d9c3a813e3158cd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502358, "uuid": "1281dd92-36ac-4b1c-a45c-467d561e8e9b", "comment": "Malware payload (AgentTesla)", "value": "22b99245039206f646679ba2031300dce1090da52a7a51f6e5e892786dbe4855b896d0573dfb7491520416d282987353", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502358, "uuid": "b73d90e4-5adf-498b-85bc-b1170cbf7fdc", "value": "1F35E4EFBD1C719ECCF68831F9E41EA499157C7642079303707F3A99AA2D59E8F440A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502358, "uuid": "d03d2cb7-6406-4471-91b0-65238baacf2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502358, "uuid": "c79af680-1264-4067-88f2-75ebb1cdc64b", "value": "12288:ilnV2zYqAafivqYcOlxsckPeqrXRKc7TBtKHFMxx2XNZfULnzpGVSNE2SJFpECGK:i94z5AQiCKlxygGCNZ62KDe6M+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621502358, "uuid": "d0835fa1-99a5-4a75-a6cb-a5f75e527285", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621502358, "uuid": "0faf9d08-2d74-4c24-91f8-3087e7f3d62a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502358, "uuid": "9b6b7388-1382-429f-aef8-92f43f61aea8", "value": "Hlengiwe Moepe 20-05-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19065a9e-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527975, "uuid": "62138ef7-a85e-433d-a946-2d4d859b1004", "comment": "Malware payload (Dridex)", "value": "8d37bc55357cb977fd864a516ad4fa4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527975, "uuid": "20c04073-6972-4ef6-8f7d-930cfbe82ebd", "comment": "Malware payload (Dridex)", "value": "19c2e82afe6203e12039f6192149f64378ba0b7c2062eacf6d532cf4b8e56a5e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527975, "uuid": "67de9977-e382-48fb-91eb-9e3cce2406b2", "comment": "Malware payload (Dridex)", "value": "958f2e06e8e7d1e66943d43ceb66bc5ce9543025", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527975, "uuid": "1c49976b-ab06-4351-9056-8a005691cf20", "comment": "Malware payload (Dridex)", "value": "401061c49b352a786d830f088f386b84c987b8fbeb2adf22573c6122e581a04bfaf0f3e9f49770b6de824c61d10bafe3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527975, "uuid": "6c0ef754-f4d9-4491-9a50-bba0cb76875c", "value": "9004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527975, "uuid": "a8e81259-8ae3-4d8f-8212-d335f7247223", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527975, "uuid": "987e7ac3-4d7d-4523-bbba-3867f69873d0", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527975, "uuid": "43759018-c6ae-417d-bca3-88e6618b0ad6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527975, "uuid": "eb386437-e2ad-46fd-b750-81570fa93f02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527975, "uuid": "792c0a01-b26a-4995-9b3a-5baf3d663713", "value": "8d37bc55_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff10a28-b974-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621519718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519718, "uuid": "60922ff5-0c38-474c-a3aa-c21e546d2d46", "comment": "Malware payload (Dridex)", "value": "2233bceefed25d3cd4d3658f521798c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519718, "uuid": "acf94a9b-af9e-42cb-8cf6-937d4ddd747a", "comment": "Malware payload (Dridex)", "value": "19d4d8c2805cbee63024a827c42da5a2d5590bb42dbd5637712eb1b87b2022c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519718, "uuid": "4059b909-44ac-4ddf-9a64-7771cbb5755e", "comment": "Malware payload (Dridex)", "value": "73d7062a402f11ea3686d3d90afcbf0b6320936e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519718, "uuid": "0a5521a7-91d7-4419-9694-c0723df64d5f", "comment": "Malware payload (Dridex)", "value": "c28dad1f74d7193707b54f7e175022c8970e14fb5eb51e26ffe80e664812bdba099144bce2c537547f42845ae9f339e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519718, "uuid": "71dcd432-8296-4324-b109-e2fc27dedf1d", "value": "85F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519718, "uuid": "f991a5dd-3757-4220-b259-adc6d687ae5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519718, "uuid": "95a79549-afe9-4877-84d0-4f338a57d7db", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621519718, "uuid": "8a1affa9-65a0-4219-83df-1f1c591fa385", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621519718, "uuid": "f1309627-8cb0-4d51-ae11-f3cab47b3d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519718, "uuid": "ac5e94e1-2d28-47e8-82f1-4859965e1e30", "value": "2233bcee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281bb947-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552052, "uuid": "e573fbcb-0c69-4c04-897c-bdfa3aa442eb", "comment": "Malware payload", "value": "066570f71f003083fcb89c9f7399483c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552052, "uuid": "268d7d27-33de-48de-bced-e4394110769c", "comment": "Malware payload", "value": "1a23d5b997a3691ee094648b3ab3ac65fb6b1a87cdd30f8686285bf5eafde2bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552052, "uuid": "d6efe598-a902-4594-8ca2-f11198add021", "comment": "Malware payload", "value": "74b8b325016ddcfc93e6cf2bc6d3a579601251a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552052, "uuid": "d035da77-fc4f-4699-8c4a-051dc81fac8d", "comment": "Malware payload", "value": "1e9c296570214173c4b60f76544bb6cf3d2d389a8d011f32d68a6110c6f5504ac8c8320eed1265e7d024476f9704d160", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552052, "uuid": "51329e34-4922-4a13-8a63-0cf0e2ed2ac2", "value": "4904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552052, "uuid": "acc62544-3948-4a9c-80a4-520efdd7c24f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552052, "uuid": "8059957a-3d6e-4ff1-ad40-5ca55312e530", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552052, "uuid": "5e2b90ce-0859-48be-8b9e-65d32bd1e293", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552052, "uuid": "f83f815d-87c6-469f-b5ef-d403e4d2c044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552052, "uuid": "7b9c2cc3-474b-4181-b8d6-15b2ed00730b", "value": "066570f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f7c683-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533439, "uuid": "3d06dbd1-e2df-4282-86dc-66d44ac0296b", "comment": "Malware payload (Dridex)", "value": "9c695bcc96ab3d6f05b256e4b3f2b00a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533439, "uuid": "d597b354-cf26-45b7-afaf-712bfbff1f95", "comment": "Malware payload (Dridex)", "value": "1a5eea26130a6a137f4b64546b4c673efa17537a6ed7b5e07ab7f046f9ad8188", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533439, "uuid": "32531912-a2a5-4108-9926-b79004948194", "comment": "Malware payload (Dridex)", "value": "2752f65c1733896df8fcfff84070a129929ff6f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533439, "uuid": "4c00fb8a-1ce2-41ae-aad5-c05c4d356a59", "comment": "Malware payload (Dridex)", "value": "ad6c959bc9e3d82069c4fd512ab630331113ca9ffc8eec2908cc1dcb642ed11fce308941398e407ca1b1e7f66dea9ed0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533439, "uuid": "387642ba-6d84-40f9-ae5a-9ff77045a3a4", "value": "7B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533439, "uuid": "5d1b0373-6e2d-4d23-923d-a93382057682", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533439, "uuid": "6f78a085-54b7-4bd4-ac59-cb52c74c6387", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533439, "uuid": "27d355c0-63a5-4f77-9504-bea25a2323df", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533439, "uuid": "45cfdc1e-be2c-4322-8450-328dc7129eb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533439, "uuid": "d4cbf9ce-ac34-43ec-a819-ac23933ebd7a", "value": "9c695bcc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99c1f45-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526929, "uuid": "8d92bdec-077e-4732-affc-d5b61189b357", "comment": "Malware payload (Dridex)", "value": "f0203565db8beea284814ed65cc4c7cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526929, "uuid": "06042321-4ca9-446f-a53d-2eb8de2b20e6", "comment": "Malware payload (Dridex)", "value": "1a92b206d53dfd68da037fed7cd985f625271c55c02838fb373c6247917f56e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526929, "uuid": "3477c36c-61e3-4b30-ac9f-10eb504ad666", "comment": "Malware payload (Dridex)", "value": "d53497b6382f2d796d989ac29d2a5daea4a442f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526929, "uuid": "dc306c83-73b8-4a30-9b8b-e8d7e49e375b", "comment": "Malware payload (Dridex)", "value": "801bdc0c3c68cbeefbf30070521008f633ae2b5828b1893cb5e9f9b2e52d59e17aeedbd7beea812b84426220630bd895", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526929, "uuid": "a29a5c38-8d6f-44e6-abb8-64e3209bbe72", "value": "8504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526929, "uuid": "e18ffb49-4c56-4d09-abf5-70c4764c7001", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526929, "uuid": "ca9f3096-beed-41d2-8caa-3ef49ec23eeb", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526929, "uuid": "97bbff7a-25b4-428c-857a-caeeef1eb8f8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526929, "uuid": "ad5e6558-9e0b-4c2f-9800-2fe3e0ae4bb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526929, "uuid": "154d70c6-bd76-4602-b9a3-ffc48b8e9e46", "value": "f0203565_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4542fd-b968-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621514612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514612, "uuid": "d97a3757-2b31-4bef-99ca-93faf8fb4bb3", "comment": "Malware payload", "value": "8978e01416dade3b6e6ed2ab2b178e3e", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514612, "uuid": "28b0941e-6090-459c-994f-ac8db46d77a7", "comment": "Malware payload", "value": "1a9633b148ef8d1dce830ed9b9b849a2e7da2cc35bed3646032cd9eb1eef4f39", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514612, "uuid": "2271d7c4-79e2-40da-b6c3-232bd47f5eeb", "comment": "Malware payload", "value": "13494691e4ffff350328020c5c9f222c76c321b4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514612, "uuid": "3d474e25-19ba-4b9f-9b63-a72bc25d22f2", "comment": "Malware payload", "value": "2114fa2825d8a189de15a8d6928a3fe893a15407fb10cdd0a1c377af9058d9f5c6df755663fdc3bf7f2857a74ba86019", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514612, "uuid": "9fa0a03e-e492-472f-83ff-c48e8b5a1243", "value": "A3227E2CD215FC1AE11146BDD11442F4F26B6016A651BB2E3499F3DC1EE01D7C38FAA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514612, "uuid": "85eed62f-1240-44ff-a5ea-110c1ac7338e", "value": "192:ScIMmtPQXG/bA0VOQS8miRwT+3QDE/93kl38Ej5:SPXoyJVO76RIEV3kBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621514612, "uuid": "75494733-22a5-4e4b-bbfd-5e2a171f4e97", "value": 10319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621514612, "uuid": "de07b2b5-1fd8-4cd8-a8b0-96cf8bf92057", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514612, "uuid": "807c018f-890c-4d0f-b65e-decce291de73", "value": "SWIFT_Scanned_Copy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb42373c-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621532998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532998, "uuid": "46f5d901-12f5-4616-bf6b-51e769106f62", "comment": "Malware payload", "value": "79bfe1d8bb2114ae3dd43a6760d3d9c9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532998, "uuid": "0fa4d431-6a7e-4f26-84fd-15308a654837", "comment": "Malware payload", "value": "1a977ab6fe3db4261f02db6266c482a68aaca3b2f7caea6a52c0c9b35487420a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532998, "uuid": "b387819c-8486-40ad-bec1-ac6d50668660", "comment": "Malware payload", "value": "da472c50465e307d56f53eefa5f7bc33d575350f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532998, "uuid": "756b9632-0566-435d-b6ef-fe0210abaf92", "comment": "Malware payload", "value": "fab82c9aaebda2306cf1f6602fc6b6c29ed1841d0393f876193039d2d5e8435daabc75ef4a91cc0bfbe2836cb95d33c8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532998, "uuid": "acdfb8dd-f6a8-47c1-b35c-0d75a3100ea1", "value": "49E48DAD3280BADFC817CE76CA641C20EBA1A4B7531BE347A51315ECAA4D957DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532998, "uuid": "7e32888c-68c5-429a-919d-1c80e4479b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532998, "uuid": "1bf40dc8-ae95-4503-ad8a-c5d4b8f437c3", "value": "12288:duxTeZHpKz3aBTi4Sdhh/LaWi8bjsa/Yu8BUCg8YndEzRq9Lhjx7glPLr8:I1sHkz3ag/aD8c+Yu8ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532998, "uuid": "c75059a5-84f2-41f2-bf3e-64c8a63e6df8", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532998, "uuid": "bed08d45-e3bf-4432-80aa-ba995f5b04d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532998, "uuid": "2df2b43c-976d-44ee-be8e-58f2ea8b3daf", "value": "DHL Original Shipping Documents and BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89527ca-b9bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550174, "uuid": "6ea31c78-faa5-4bc3-8970-de13e9816c70", "comment": "Malware payload", "value": "072cb0645d04b8a985a74671452c33f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550174, "uuid": "d927b583-228b-4b70-a856-b051d400fc2d", "comment": "Malware payload", "value": "1a9ce191dbfc3e170fc3c7291ce20836fc05bfe7b921fd3deaa900f986033960", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550174, "uuid": "3e9e703b-1cb0-4b60-90ec-0ad949946cf4", "comment": "Malware payload", "value": "aa69f7c3b18b98eef914fd1ef03f224b707337ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550174, "uuid": "d217909f-44d6-4dfd-bcab-0e9c7436204a", "comment": "Malware payload", "value": "b07ab250929c1d3bb4672f391aa7e503b7a1deb155d239b66a873ce81c51041326783b2e908a13c63320a5b27484b09f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550174, "uuid": "79162f55-f17d-4dfd-ac7c-32683ed3e580", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550174, "uuid": "c3e554e8-7a04-452d-b43f-b852131f8253", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550174, "uuid": "91229aa1-0393-4c3e-acd4-e9665035aa5f", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550174, "uuid": "60711d22-98f7-42fc-b55c-2054c3666863", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550174, "uuid": "f1225700-1447-4aa6-9c80-e9298b142677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550174, "uuid": "5d9ce40e-d4f0-4172-9a0d-fa0c7ad364b0", "value": "072cb064_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215cb319-b983-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525841, "uuid": "64afd9c7-9eb3-4a6a-b38e-cdaf6ce09cc5", "comment": "Malware payload (Dridex)", "value": "4286022cee977e64f38ef1383f692830", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525841, "uuid": "0e6aded5-f187-4ca7-8570-dfbe702c34c8", "comment": "Malware payload (Dridex)", "value": "1aef4e5e7eee9bcda47c6a5b38ec566ab68bfe6f44c6778860849c4bc22af2a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525841, "uuid": "c9161880-be16-4475-8a2a-6574c9c55099", "comment": "Malware payload (Dridex)", "value": "fc9449bd7511481e96aabe41b0f4bf3f6b02323d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525841, "uuid": "518050ca-1abc-4412-95cf-ac2cfb679815", "comment": "Malware payload (Dridex)", "value": "d10e750be64399554be9d62ed604c5fe12f3657285d0908448ba44aaa0f0ee5d7c353dd600d3167fc3f4a98c1d0e2382", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525841, "uuid": "5dbcebb5-3f9a-4337-8f13-dba372cd55bf", "value": "4D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525841, "uuid": "5152ab45-ab0b-437e-b34e-b70afbd7e2c9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525841, "uuid": "d6cf826a-08b9-43d7-8fa9-73c5911ba6dc", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525841, "uuid": "602b411a-4ed0-4b43-aa1b-9d9dfee22c52", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525841, "uuid": "3272a3af-4533-4713-9e09-0713322fca10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525841, "uuid": "7f2b6cc7-1e18-4705-bfee-7f76fedb7352", "value": "4286022c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ae7bac-b9c2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621553172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553172, "uuid": "c3fa1590-9ebf-4916-8561-0fb829dc5473", "comment": "Malware payload", "value": "209d899ea6365900a1ce8183f7d562b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553172, "uuid": "304b0960-07af-4b3b-acc9-b9868ae5a10b", "comment": "Malware payload", "value": "1b08c1346eb15e01af56fb9d2eca8edccc01e333c094405af451ab58b545c4ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553172, "uuid": "f49e0711-27aa-46cf-9bf4-a608623bcfa5", "comment": "Malware payload", "value": "cdf8bd874e883069ad8c041cf7bd1d66a869a260", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553172, "uuid": "cb51d8bb-280c-4013-963e-e2ee109b294d", "comment": "Malware payload", "value": "e126b1ea4feec232369b166e10b62c54b642c3a66a1507349f87915f7901e7dd32f79e8f0009431ec2660570434c4490", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553172, "uuid": "984d7250-79f0-4093-b205-5ddfc8a688e0", "value": "C9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553172, "uuid": "3f475d7c-f205-4752-b498-11b86b025e6e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553172, "uuid": "6e556090-95a7-47cf-8b60-b15964b69186", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621553172, "uuid": "ea7e5a2c-e978-4f72-bf90-51df6f47185f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621553172, "uuid": "f8478d0c-dc36-410a-900b-a703dfa00f6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553172, "uuid": "65957449-9adc-4d7a-b7de-eb67b624a89a", "value": "209d899e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83044aef-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536742, "uuid": "2ad4f412-53d0-4439-8987-853f3cb8fb58", "comment": "Malware payload (Dridex)", "value": "fb0d7c0272a339e0838255720558e313", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536742, "uuid": "d1ca0101-7572-4a20-9124-ec4dae9aadd4", "comment": "Malware payload (Dridex)", "value": "1b27504bc1c8f09692256827f38f2402485baa4c1b8b03583eab30621a6dee1f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536742, "uuid": "7c1a9a9b-c79b-48cf-a16b-6d32dce9cfd6", "comment": "Malware payload (Dridex)", "value": "4e08d987198247d79cf6ea1c0f7d9155eaaf86d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536742, "uuid": "f079481e-8744-4894-8d41-02735c054469", "comment": "Malware payload (Dridex)", "value": "1db82969aa2da405ef79f57c51c2c0ae518115f7cb86f1cd21ec30ebe868c2b6a19fbe087c992a84e1d606ba33416d75", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536742, "uuid": "1fcf4507-e655-4121-afc6-a1f18488c1d7", "value": "3904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536742, "uuid": "b297b59e-53ab-4bbf-80fe-c009ff39269c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536742, "uuid": "eaea5591-0aba-41bd-b576-72bd0fcd7d1f", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536742, "uuid": "bfd00dad-10ae-4d08-bcd3-39c5bd47d2a0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536742, "uuid": "682cb12a-b925-4225-9f86-49c351553fb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536742, "uuid": "5def496c-ac18-4429-a40e-17a7e4a48402", "value": "fb0d7c02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5205718-b91f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483247, "uuid": "88804d81-12f2-4c8a-ab56-2f75d0d6f124", "comment": "Malware payload (Dridex)", "value": "afe903a29d32c295a0989a3577e15208", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483247, "uuid": "0bb11219-9b19-4102-91c7-22c738c98100", "comment": "Malware payload (Dridex)", "value": "1b58b0620d00f2ddf629e5efceffd8e83759e93a981cc7c0376c06479d3d3483", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483247, "uuid": "de3a640f-2a58-4a39-b58f-a61ecc651f89", "comment": "Malware payload (Dridex)", "value": "6e64e8a883f1a643c4139927eaa5b1b9d13dd30b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483247, "uuid": "9ee33113-0cf7-4379-99f6-1050a94924fe", "comment": "Malware payload (Dridex)", "value": "6f2d7158c53af8daaa64acec5691758dce879099d02ee120998a340bb51784db8847a54d3a7949287fa6789f1f2a9250", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483247, "uuid": "1f1db894-1116-4377-a2ae-a74e65438da9", "value": "FEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483247, "uuid": "dbf98715-a6bb-4499-977d-d09b60bd406e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483247, "uuid": "0ae3b9fc-d3b6-464d-a1a3-bbe3f90fec33", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483247, "uuid": "c78c0271-0969-4ef0-b650-5a99623d000d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483247, "uuid": "b355484a-695c-42ff-bc79-3acca954aab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483247, "uuid": "b512d056-2083-454e-abee-2a439cf1a3db", "value": "afe903a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c6ed4e-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527026, "uuid": "5fc03b50-19aa-4d65-a3cf-7a03edbd94c5", "comment": "Malware payload (Dridex)", "value": "3e86248fcaf6903ea800c85a036606ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527026, "uuid": "f0cf0be5-c979-447d-884e-a6f862a0e434", "comment": "Malware payload (Dridex)", "value": "1b6b58bfce31da5b12428858df57cd1d4bb3e3f486cab8e441d4cc12fa9e26e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527026, "uuid": "7d633525-a2b0-4b73-bc97-7164a352228f", "comment": "Malware payload (Dridex)", "value": "f322ddae1f5b2d2e99670b965d742d5586c75ae6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527026, "uuid": "8c6f514a-7b53-4f70-b6be-ec289cf795ce", "comment": "Malware payload (Dridex)", "value": "8c4109e485176caf9a1d8fb474ae9a9ce389cf282b92829218e9e909ef5fc28a2409ce138921953eefda2e6c02f23685", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527026, "uuid": "70f4fcd2-9e67-4cf8-b0e9-37888eb11308", "value": "7D04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527026, "uuid": "120af66e-dec7-4d8a-bb1f-65d45f44e0df", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527026, "uuid": "d319dee0-15b6-4355-9102-e7abd2513ef1", "value": "3072:wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:wH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527026, "uuid": "5d019a95-9bf1-40ef-b81b-df0d1d9d2dc3", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527026, "uuid": "c94b97dd-a576-414e-a57f-74f93222f28c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527026, "uuid": "4c2077cb-8314-46b4-912e-f2cde94e13de", "value": "3e86248f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b87666-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540909, "uuid": "1f6e1e13-dff7-4005-907a-8430122c41c1", "comment": "Malware payload", "value": "087d7fc980175820b3b52062b1481550", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540909, "uuid": "01e4df89-d758-454d-b141-1c1e087879f8", "comment": "Malware payload", "value": "1b8659c9762d6f49938e9c8bf3ac9969018d24a1dce83c81b72ad1060183c04b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540909, "uuid": "a7c9de8d-370f-4d4b-b549-271bc2e94e13", "comment": "Malware payload", "value": "623f703950fb26ff2d074829ef5f3c27ac28e699", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540909, "uuid": "425f2df5-3050-4bc1-ae16-4111a0a2ce1f", "comment": "Malware payload", "value": "35219e8aeb7c41e59f9c96e1f49f8e44d1bac6d032f24c83a1990f944b9b44ddf0399b7c2ec44a356a304f6e4f6daf4d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540909, "uuid": "2064cc7b-b8af-4f30-83fc-6913bcb11f2a", "value": "44F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540909, "uuid": "dd2408c9-c206-4746-a0d9-00af90252b5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540909, "uuid": "8a836bb7-f3d5-4b9f-af54-d398c728a6f3", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540909, "uuid": "eae1ed54-921f-413b-8d19-742dc52aa6c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540909, "uuid": "7e99a65f-ec30-4656-b259-43972075c44c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540909, "uuid": "026e67d9-c7bf-4f9f-be2e-1582aa83cf0d", "value": "087d7fc9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5157dbe2-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621486837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486837, "uuid": "f2aa61e0-a7cf-4565-a91f-ca80c7bd8e39", "comment": "Malware payload", "value": "20212a7267120153a64c2b3e23fcca26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486837, "uuid": "0626bf81-9570-40ac-b4ab-995df1946258", "comment": "Malware payload", "value": "1bab365771337a76028575e960577ce88e95a670f3c5cd5d4c1f604c95b03e04", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486837, "uuid": "29e59308-de2d-43de-800b-fc32a2b098d6", "comment": "Malware payload", "value": "e093840078daa6a3d36f0b5cb3fc761eee7f324f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486837, "uuid": "f999ad0c-d6aa-4477-9fd3-7e77c3692ac8", "comment": "Malware payload", "value": "cef939e2e4fd53e046b99afeaf6dbea1d998b134c8340fddeeb2c670f6c813dcf8ab7e74aeaa961d0f790c83e74bb03e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486837, "uuid": "aa924cc6-0371-4f40-a7ee-4c7cf980e8c9", "value": "99D02317D3153FBF45D18211343AE4C1374BF1D643855C94515804867649D6D69633C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486837, "uuid": "df901143-b6a5-4e47-b71b-020c8640af9b", "value": "6:YAageFA0/9ChoPq342lAZLLV0Dn62NrUgC:YvFLlChkdf9LV0zIgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621486837, "uuid": "d2f04d83-3287-4006-80ad-4ca7e09e489a", "value": 206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621486837, "uuid": "05df1de1-0ab5-42f6-a42a-6b8e088bc526", "value": "application/json", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486837, "uuid": "cd3e2cba-93dd-45d0-8f9f-e006390c9cae", "value": "806a8950_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe4c2b7-b944-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621499076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499076, "uuid": "f964bd2b-fad4-45fa-85ca-175342ceaae4", "comment": "Malware payload (Dridex)", "value": "2b78aaddb1992e0fd522eba5956b5b16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499076, "uuid": "84e6085b-f352-434a-8cec-7b49778ef736", "comment": "Malware payload (Dridex)", "value": "1bcda9e82ff7457ed7de487d8f5365326b7e5c445e0f7fc441b9eb763ea601c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499076, "uuid": "4c988641-6734-46a5-8aee-8e5babff5aa8", "comment": "Malware payload (Dridex)", "value": "15d1ef2d08ab8f67b9008e9907768856d8d79768", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499076, "uuid": "c585dac7-6b64-483f-b55a-2093af90d298", "comment": "Malware payload (Dridex)", "value": "78a7fd5e056ae8ff2c75db8e13f750fba4a8b9996901102c8401de1de7ea30d4b6e266fa5587df05067b2616b4bb872e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499076, "uuid": "40884e11-fcca-4130-884a-4ca39cb57de9", "value": "E2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499076, "uuid": "4cd23751-02b7-4d8d-a388-e96429e13d0a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499076, "uuid": "817f04e4-e834-4d89-9d3e-7ac7fba2759c", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621499076, "uuid": "c50a8b09-61ac-4ba3-92dc-ecb3256090a4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621499076, "uuid": "d9c930f0-cc52-4cb8-80bb-c6d3f23f3071", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499076, "uuid": "c20739eb-e13a-4260-9676-dccdcd49e6dc", "value": "2b78aadd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a284a819-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537654, "uuid": "9eeda16c-00dd-4d39-b674-0f461ab21149", "comment": "Malware payload (Dridex)", "value": "d6f38ae8c48046f08b3118098d138ebf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537654, "uuid": "09b9f26e-b539-4c14-8ec3-0950408f8929", "comment": "Malware payload (Dridex)", "value": "1be6f3147dcbbbd8ba422d2dc93707ff813b3c88421bf78ec0c939cd5ba9bdad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537654, "uuid": "14f134b9-22b9-40fb-a9e9-94f53922e8d7", "comment": "Malware payload (Dridex)", "value": "51eb2649141a097d154e184b432fe510e295a3e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537654, "uuid": "ff77fa6a-d1e6-4124-a2cb-57f5c35bfb35", "comment": "Malware payload (Dridex)", "value": "46e8aa56aa830ad70fc4ab2cdeb6255de8cee96e9e485d094d2d96244df846371a911eaa5d1dea819afc3ec27a57c1d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537654, "uuid": "d8fe6565-0c44-4cd8-9506-767549630895", "value": "A104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537654, "uuid": "9e599283-389e-476b-b601-503bf7e230d1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537654, "uuid": "5ba5482e-ef76-44cd-82df-467094976a4e", "value": "3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537654, "uuid": "1e1f14d2-250b-4074-bba2-361e6222e44b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537654, "uuid": "be03256a-cc5f-487a-93ea-833f9fd0ecad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537654, "uuid": "73221113-55a6-4150-adf2-31d30421b6b1", "value": "d6f38ae8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dfee13-b95d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621509501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509501, "uuid": "33d33458-e19c-4647-8aad-6361818f92a7", "comment": "Malware payload (Dridex)", "value": "8b8fb638d3536ed604bec02858877226", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509501, "uuid": "cb69b703-32f2-4732-ac16-9d4120b50275", "comment": "Malware payload (Dridex)", "value": "1bed5db917640f2fd5b1ff76a6972092cbdb0446e638f8c669628089b69d0a77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509501, "uuid": "f2a41a3e-145c-4443-8fe3-24aa4fb64266", "comment": "Malware payload (Dridex)", "value": "394f072058d3d6587a2bb1be7c230ab7f29d63f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509501, "uuid": "8c963277-32a7-47f9-b868-4bef18bae83b", "comment": "Malware payload (Dridex)", "value": "1ee510e810504f4b9e006a63f898cb0999a426490b5a85a11b997982ee8a03848bdcc42813460f2ca786bcc9f6a54e95", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509501, "uuid": "39dbf8b8-a929-47c3-961e-14a31f7db4c9", "value": "A7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509501, "uuid": "7ebfb0e2-d063-4af8-a6f2-bf504ef9f64c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509501, "uuid": "474627f2-12da-4663-8782-a73a6b4541e6", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621509501, "uuid": "5a1ab4f3-399b-4c57-99b3-c71bb230f8f4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621509501, "uuid": "3ae0e4e9-b136-468a-b6d5-629edffec10f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509501, "uuid": "25197634-ee51-488c-abe3-77edfb1c8eb4", "value": "8b8fb638_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaadcf47-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621533051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533051, "uuid": "4a8bc485-377b-4c34-bb66-7620dceadd5d", "comment": "Malware payload", "value": "b5dadf19ab41c8b4583b1aa847f5c480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533051, "uuid": "76505736-21a4-4989-971d-cd03a1050809", "comment": "Malware payload", "value": "1bf5cd1908f1b5e6033a6db7d4d9df71be61f5d326c045cc7b4bd560d5134c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533051, "uuid": "2c8cdea9-6c7f-4b9f-a100-271db47c6483", "comment": "Malware payload", "value": "02e750822c7df3b26b68f71f162769e47bb1c004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533051, "uuid": "603339ee-db4a-4c95-9386-0636070fe0c7", "comment": "Malware payload", "value": "b608b352e9436e6358080ab8650b4a58a83f1c1c3199c3ae5971a01a1a68f38bc1bf65696b2a68678e54556eadcd1bd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533051, "uuid": "6aa2fc91-803f-4e49-8871-04a9572db374", "value": "CBB4E02673896F14E4BE5B7718B454204BF9FC46D732D62EBDE930DE91A2FA01220B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533051, "uuid": "8625caeb-0303-40a0-ae14-9974cd93fa18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533051, "uuid": "e2bd1c8f-17bc-4146-a2c8-c15bff61ab0d", "value": "12288:PMDzcsKz7JhA6iWcCcgdsvt3mXwBEpjuJshkzvE5NBWxe:Tz7JhmWcCcxlAwByy/E5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533051, "uuid": "9aba45eb-a93b-4d1e-ac44-c61d65f92f4d", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533051, "uuid": "b4a1cbed-4d59-4454-a2ee-9b6d190e0ca2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533051, "uuid": "2598d1d7-0bd7-411a-b76a-299c226acf50", "value": "factura -5201367322632_________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab634a43-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1621523925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "ebb10341-8848-4184-a382-3b7018e04166", "comment": "Malware payload (CryptBot)", "value": "4fc81ed7e14c996685d930fc25d89d0f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "e19d8bd7-0651-4303-88a9-9c51bddd265b", "comment": "Malware payload (CryptBot)", "value": "1bf9a15445a908fdcd7d4a5a0584678a1efb086d1eccbf0ae60393f6be208919", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "bff00c8c-9c32-4ccb-aa60-fffb4836339d", "comment": "Malware payload (CryptBot)", "value": "9133156789a5b0d730c5d059948edc14bfb7ead4", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "784bf582-7901-4d1e-91a2-f0ad71011689", "comment": "Malware payload (CryptBot)", "value": "91e5c3a25184ba2af58cc6e565846bcea841ee9d67445504c2bb4eee1f6ce0f8e95893f41f40fafee753834e5b1802c0", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "9cb0d9d7-f48b-43c2-8e60-bb5d00ba071b", "value": "A7F4F130A6A2C035F5F312F849FA7279793E7BA16B3554CF12C426EA56706E4AC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "b3559172-d47d-49f9-b0c0-577b6490f675", "value": "b7513c9180d9c4b81797d95ecb76f0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "7a1fe16b-5a9a-404a-800d-64e51d7ff86d", "value": "12288:BbGZjFdpCpe7gRuoRlnnRt7zXYLo6Evgra7uGsDO0MZzLyEytEyBWUdIRUEo99Iq:BYjF+qoR9nRd8knp7u9DC1PypIRU73ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523925, "uuid": "9827b983-227c-4e4c-b2e6-1737d6e4e73e", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523925, "uuid": "b987ad61-5e86-42f1-ae78-d2536d396963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "c074369e-eff3-4c83-b17c-223fe17fd859", "value": "4fc81ed7e14c996685d930fc25d89d0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c583da9b-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535995, "uuid": "ca43d42c-504e-49f3-975d-61f8e4c16e41", "comment": "Malware payload (Dridex)", "value": "a0d51d7c48b210e7363b67d121088196", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535995, "uuid": "c07bf42d-93be-4008-9505-00344fe3d942", "comment": "Malware payload (Dridex)", "value": "1c2015a5f88dcc019c51171fcc17b71001734d8503364338d8549ea9f2ff177c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535995, "uuid": "f8b2b748-e7ac-4df1-bf4a-bf546ddb82c3", "comment": "Malware payload (Dridex)", "value": "0bbc60cf44c6fb6a2f8dd904388c18714a2c6f0a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535995, "uuid": "fdfb9b8d-8a7c-4ce9-a438-ead0e9f18d0f", "comment": "Malware payload (Dridex)", "value": "8fa870ddf3bb578ca6cba23d910e5134cb189c88daf794bc23b0abaa7773c7479309e22ed506e2ebc2023b45ea7d8502", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535995, "uuid": "817e090f-b64d-4cc8-bdb1-d392fd40530f", "value": "3B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535995, "uuid": "028b4206-2a18-4f5e-9bca-1915e087189a", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535995, "uuid": "d440dbb4-2e02-4eb7-b1dd-776b0ad161d4", "value": "3072:Yi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:YH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535995, "uuid": "6de1b817-09ff-40b5-9ffa-d501a9a0f641", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535995, "uuid": "bd1df63e-f9e9-4343-9d89-d364a3c96dc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535995, "uuid": "d7edc94d-b459-4746-87fb-190b8c4e5a1e", "value": "a0d51d7c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1478b30-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541142, "uuid": "77cc7374-42c5-4034-8f68-772541cd0d98", "comment": "Malware payload", "value": "f73a65664ba6a6a50c4fcfcab352787f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541142, "uuid": "98fd3274-4f12-49ff-b37e-e10cc410f830", "comment": "Malware payload", "value": "1c231802fc9c150c7e168290e070f420068de7432cc1e67063b7c1f0f5c200d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541142, "uuid": "fc829c91-d60d-40af-96fa-7517bd0d067b", "comment": "Malware payload", "value": "807c4f120f23bda5744a8ce5dd3c5e1d5557e7f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541142, "uuid": "1fbace65-695b-464f-9e9b-97b4dfe1d5cf", "comment": "Malware payload", "value": "e244461299346b3398316e71f7867a0b2982dd1b565e384e2d84646f8277ffb2318e14a5a74a81788a47640db79e4197", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541142, "uuid": "9b4fe319-eaf9-4070-b628-a164aee277a1", "value": "ECF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541142, "uuid": "4958037a-1e9b-4151-adb3-f0003d1d25f5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541142, "uuid": "5ef87c09-0669-4adb-8528-73fc2c8825a9", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541142, "uuid": "a94cf013-d985-4a87-bf71-b605a285bec5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541142, "uuid": "c028b386-1c03-47ad-a93b-5105cbcc9fb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541142, "uuid": "4c214e91-c030-42ed-83b1-f4452136f27b", "value": "f73a6566_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413693f7-b933-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621491535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491535, "uuid": "c7df13f4-9c75-440a-bd0c-22b6f467a63e", "comment": "Malware payload", "value": "2ed0fa5611977ba9009cc0fbc45729ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491535, "uuid": "9b964bc3-42c8-4b2b-9da4-6c32ae2d7503", "comment": "Malware payload", "value": "1c2577408884ea0d74c50fdb3ce7454bc25b25105302a26bb319da75e10443db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491535, "uuid": "acebbd43-de85-448d-9702-02095b7d2f3d", "comment": "Malware payload", "value": "b7f59a9aae3b9ee225b7d78f5731bd6c6a32a434", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491535, "uuid": "887cb927-8b45-4641-8511-25fd76327590", "comment": "Malware payload", "value": "02a2627125d3e10cb0d1298c9d0b7129462dc1ce2db0c78709e8e759b493ae101d611d0464dccffc82a6e74898b1d192", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491535, "uuid": "bc07f990-5af1-4720-94f8-da66fc582880", "value": "D723F100177E113FBB9B6D130ABF2B424D6B746A85046C5B766B18D08B2FFCD4069ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491535, "uuid": "cdc8681a-5cce-4e32-bc9e-de8b45eec42c", "value": "1536:i9mzCmyyDkIvKVY0w02sNdGhJnjHNJ3WVgemDd:iyTDkISV4JsNmJjbWGDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621491535, "uuid": "1430e246-26f1-4861-bcc8-89e47deb241b", "value": 49232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621491535, "uuid": "bc37afd4-c7f9-46f5-abb0-ac18395298ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491535, "uuid": "569e34a3-e88f-414f-9aab-97bbd72f9188", "value": "cdjalp-85.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b1f9f7-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621537499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537499, "uuid": "b9f1da5d-be5a-4417-abd7-fb3436d2b5a4", "comment": "Malware payload", "value": "729d08d89a140140d411b06884a858fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537499, "uuid": "158e580c-df86-492e-aea2-c99f9da9532f", "comment": "Malware payload", "value": "1c5575ed0aed25a5e335e1586338938aea28376a7c1608f3fb40038c57b53c52", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537499, "uuid": "02934c1b-3ba8-4831-96b3-60c731390540", "comment": "Malware payload", "value": "e1f75b4171243a9af0545201ba6cc2e4b96dbd83", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537499, "uuid": "5c6689ad-cb78-4d59-bc25-e543ebcdeac4", "comment": "Malware payload", "value": "102aaa6faf93694276d6f3136bd42d57c3ccc43c65423f247fcbd804fe52d227dabc5d3531dbcd41846160d9fa61a9f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537499, "uuid": "0feee11d-82f9-4a6e-808c-08bbd878eb95", "value": "7023F15E364F95996FF4BA304226495C959900E38804FB1E3E18F7E0D8F7DC22B49D17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537499, "uuid": "5f4686e3-7304-48b9-b59d-5251768f6f46", "value": "768:2UpWH1w74/LUrs5gFNBejXSpug+ia95zMr75kDZRj0EzkcEm4p7+YoQ+jxozIea:961LU98jXSpn+1LzMBk8qkcfM7+3QQxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537499, "uuid": "5a381eb0-db6c-41b8-b6ed-595774062bd7", "value": 49085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537499, "uuid": "9ee32913-7136-4373-a7dc-8f1afd462ff5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537499, "uuid": "67779d1c-6a28-447e-b517-8a7083e3b688", "value": "729d08d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe0ff4f-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527557, "uuid": "df8bb8cd-836d-498a-bcb2-7f7a4ee4f894", "comment": "Malware payload (Dridex)", "value": "0f24b2440f81c01e04ef5160e84a68ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527557, "uuid": "a9617399-7281-4b0b-b819-32a854e98384", "comment": "Malware payload (Dridex)", "value": "1c67f89c31f80eab4f5fcefd66e9c210d91c15a1464e2efac6f8ff2538af0b9f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527557, "uuid": "3ea07a2b-58b2-4236-aec9-a34a42b4ab00", "comment": "Malware payload (Dridex)", "value": "f123dd6c16051a05fdc14de16439990a0e6d1986", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527557, "uuid": "58a8c2e8-6249-4417-b198-f9121ed538ff", "comment": "Malware payload (Dridex)", "value": "59ea2c3765d34b77ab4c3c1fa9893de380c5f3539200eae98c3655f7d0be672fa635e8ea541e20db9380a8f12c1d1cae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527557, "uuid": "87db24d7-6c4e-4434-815b-48ba48966512", "value": "B804BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD28ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527557, "uuid": "3a4a1f13-9d81-45e4-b3bb-5158e8f12e6e", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527557, "uuid": "70d6a045-c237-4055-8d17-81058e4cecda", "value": "3072:ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:jH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527557, "uuid": "791a4d5f-8168-47d5-a40c-a3ce95581ae3", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527557, "uuid": "bd1c1e47-1a0e-4a33-8773-b8bdcd85b631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527557, "uuid": "9dc4e342-e633-41c2-ad62-88d5b510c2b2", "value": "0f24b244_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a992385-b957-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621507039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621507039, "uuid": "ba615ad1-d27a-4259-ba71-1d5e15e5c7ac", "comment": "Malware payload (Dridex)", "value": "ef4e36872aae2beb5ca261483cf39aec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621507039, "uuid": "e07e64b1-8c6c-41a0-98e2-033adf66158c", "comment": "Malware payload (Dridex)", "value": "1c6efad99229f3f27870ba2a115926d2d2fed279535cdb009035075642bd9b43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621507039, "uuid": "4a23b6cf-4aa9-4c3e-b158-4a7cc3d06ebd", "comment": "Malware payload (Dridex)", "value": "c0742d624b6d734ae4881e54c3313f53c911325a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621507039, "uuid": "4572b037-62b7-4012-a8c2-72f4c02270e4", "comment": "Malware payload (Dridex)", "value": "2f52664400f82c20ae76e7cfd308272f76cb46ffd1b83fc972576e9d009ab67c1447cd3de92d2f74c9f7b6eb15d14002", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621507039, "uuid": "da2ffc11-2041-4f87-a805-1ba0a0ca3722", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621507039, "uuid": "e7e371d2-a654-4024-b700-de2961909134", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621507039, "uuid": "78360fa0-6130-400e-b65a-44ab4021f833", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621507039, "uuid": "0f79798f-610b-40e1-bb01-2b90fbea7960", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621507039, "uuid": "c83e15d4-950a-4bb1-9779-9592c04d2e2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621507039, "uuid": "5c70e4a4-f42d-4e70-b75d-f87c7658b014", "value": "ef4e3687_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8acd9f6-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544617, "uuid": "ec545949-5446-4a41-b055-62179af88c0a", "comment": "Malware payload", "value": "95f7cffbc67aa24308abcee0fdad2c66", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544617, "uuid": "c4d001a6-3090-43cf-8292-b239b72585ec", "comment": "Malware payload", "value": "1c74f526e70ca02abffc6805c5e5e17132859b40b0745263d37f8472f7962781", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544617, "uuid": "56e04972-f6b2-4b48-a295-7c1b4e9498a1", "comment": "Malware payload", "value": "9ea8c12dfb01e53892fbb0e2ecbfdf4fc22a9fc3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544617, "uuid": "13d4b364-95fd-43d6-9c24-e9b3e489b041", "comment": "Malware payload", "value": "c33a8e0422aae905e82bf91e9e0d940d6f155c4ca3ae5a3a3c47827c805f7aaa3ab6e59eeadabfb64a5de171e97a908a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544617, "uuid": "a0a027cc-6286-4134-8eaf-ee0609e4436b", "value": "B504B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544617, "uuid": "9912b3fc-204d-43db-b051-82b574c0cd24", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544617, "uuid": "fc1a4b40-74f2-4718-b8d5-6d41fef0f430", "value": "3072:aWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:aWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544617, "uuid": "69b5fd83-47d2-45df-9ea5-8d27eab856d1", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544617, "uuid": "17bea97f-e329-4ca0-b58f-9d301806b4b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544617, "uuid": "46b26381-d455-45ba-b6e3-8e57795f8da2", "value": "95f7cffb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f055f2a-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532387, "uuid": "c463a939-4bb6-4101-9215-6be63d8ebacf", "comment": "Malware payload (Dridex)", "value": "e2f0bd9b92e73120476f0e1e3562922b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532387, "uuid": "f213fc94-55a2-46f3-bcb0-e67d69a2fc1d", "comment": "Malware payload (Dridex)", "value": "1c81bf6783aaa4baf59ca5e2d834d4fbdf52462568959171d81e9cb499c4ec80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532387, "uuid": "29fccdd1-75f5-4297-8518-9baa0236d874", "comment": "Malware payload (Dridex)", "value": "934312ca5f0de641c8b7b0ede0a9736f6059dcd1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532387, "uuid": "a5b0d915-d1b3-4192-a69b-b096b0acd83c", "comment": "Malware payload (Dridex)", "value": "3c6a1efd4d748c9942373912189a7b562e095192e3304ed0bb0626ad38b9b8c213e9d4b0de92ddbb2ad5f932820dcc71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532387, "uuid": "7313038f-48dd-4b1a-8432-c104a8cbc1d1", "value": "A504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532387, "uuid": "34b1e228-400e-4972-8b4f-498f27317443", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532387, "uuid": "260ee2ba-be82-4959-b285-5f95ce0e14d5", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532387, "uuid": "aa0cedd1-5a4b-4bd1-99ef-ded2317ac789", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532387, "uuid": "a992e6a7-3a4a-4ad2-b4a2-b43a8c790409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532387, "uuid": "06735426-3523-4281-9cf6-8e0f823ef8cb", "value": "e2f0bd9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df337ba1-b975-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520147, "uuid": "d3d2ae81-7cd8-4baf-9ddf-4aab0a4d97a2", "comment": "Malware payload (Dridex)", "value": "a3770e810232a6e15b4fd36a444ef8d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520147, "uuid": "3fb20a68-b61a-4ed9-9781-01c4813a1e09", "comment": "Malware payload (Dridex)", "value": "1c90f739b96cfd6a5e1d3ca13eea94e28150e3eb7744d4865395df7f8c250a80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520147, "uuid": "924f7215-5d28-4971-bb60-5254dec59fb3", "comment": "Malware payload (Dridex)", "value": "8393744757072b7f65190678e54161864615a953", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520147, "uuid": "02544f37-2c6e-4c34-bb97-27edfdcb286d", "comment": "Malware payload (Dridex)", "value": "1276b7b4faa4a7813f7ce24f47225c48280a093b45415844e5348354cc0dbcbe333952b0d0feaec1bcdc29f8de6d0daa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520147, "uuid": "8d09c28c-8700-43e4-8c6d-257ac3a3498d", "value": "13050815B694CB16D66B0E310DAF8ADF6339AD00CE3193076E9F731E2E3675CA852760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520147, "uuid": "4259dfab-6e24-4f46-9d86-65a0623cfeb4", "value": "6144:Jk3hOdsylKlgryzc4bNhZF+E+W2knAaQ6wJeRaa:NJeRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520147, "uuid": "8a648f9f-c0d3-4d79-8f58-457e2dfe8212", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520147, "uuid": "5fe65e3c-f105-4e38-b30e-1ca7fe7c262c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520147, "uuid": "52755b58-5e82-4941-840b-b541c785a866", "value": "a3770e810232a6e15b4fd36a444ef8d4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d285dfd-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528116, "uuid": "36a8eaa8-1f80-42ac-9cee-e229b15c5271", "comment": "Malware payload (Dridex)", "value": "18002762cdfe6851c4c2e6cb16eb369d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528116, "uuid": "7bd188c2-7e89-4e83-9c67-85afc0cea079", "comment": "Malware payload (Dridex)", "value": "1ca641efc73c7a5187f9d83f721db756a7ae2e96fedff844931857c4b3e8fdcf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528116, "uuid": "dd8416de-5de0-4720-a99a-492c24bd6602", "comment": "Malware payload (Dridex)", "value": "00d6ed6d9e263606a940f1e15a58671f0af9926d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528116, "uuid": "c10dab57-698c-4a5f-97b5-f4583d5f6b30", "comment": "Malware payload (Dridex)", "value": "1c7833a4570bd9405f3d1ac5b84e8b00be9afd28b31f4a2cda8cea5e11716e3ae1c289b71ec2393f338aa8f38fd633ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528116, "uuid": "e16b570b-0f23-4582-96e3-06f1b00cea33", "value": "3104BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528116, "uuid": "397f4d27-6926-4945-b343-9069c526ada3", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528116, "uuid": "7f0de35e-f9b1-49e9-87a9-ffd5a5e57420", "value": "3072:Li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:LH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528116, "uuid": "17781c39-33c3-4b2f-8ffc-4735533775c1", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528116, "uuid": "8485d501-9034-41ed-a275-81d2993f2252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528116, "uuid": "bbdfb321-3657-44a0-8f40-4f63e6425a2a", "value": "18002762_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48acef65-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542228, "uuid": "5bd617fc-6df6-4bde-9e89-680e4ffdfe85", "comment": "Malware payload", "value": "fa3bce51dc73313c74fdfeddd0218318", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542228, "uuid": "88132191-180b-4b54-b193-c25686589659", "comment": "Malware payload", "value": "1d0b98b43b8fded5a4315c4c2331a5f484fb377e9c22c2afda5ab1270dc9ede9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542228, "uuid": "f937bb02-c4e5-417e-b62f-aa6d0ae6b9e3", "comment": "Malware payload", "value": "04bbf52a7212e55415bcaff8ea100ab44034049e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542228, "uuid": "19aa3985-64b8-44b5-9144-6d17479cb822", "comment": "Malware payload", "value": "27d5e52203f787f38bcbf9922094ed4d8045286ec0d1215d2f3200e08077f099a8fdb829e18bdff2be5f72fab8b92f9b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542228, "uuid": "7c7f7880-d860-4d36-b16b-8b35302169ed", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542228, "uuid": "664ab374-f89c-4c50-b303-3dde9e5e45ed", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542228, "uuid": "ac9b3cf6-a342-4762-b2ea-f096353219ef", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542228, "uuid": "add400f9-0967-4641-b842-45d56911a2a3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542228, "uuid": "c3e3bdea-df0c-46a1-b19b-e7b71bd39e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542228, "uuid": "02de8bc6-320b-43cc-9873-f296c6f7ecaf", "value": "fa3bce51_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e53e1af-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "56bf74f1-dffb-4baa-a0b2-19733872fcdb", "comment": "Malware payload", "value": "2e57e64b5e5ffd34b40e332378dfbad3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "d106fd93-1563-47e2-99aa-39af41e37ba4", "comment": "Malware payload", "value": "1d1c9567d9c71514703ab57f5fec94f4738942abb57c402a258a3309e4d8b3f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "cc25c514-cc59-47ce-ba40-065c7ce550b1", "comment": "Malware payload", "value": "f5d3eed2f12d3572dba1a1a6690b20cab33618d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "29a40831-d2a1-4b88-801a-5da13030c882", "comment": "Malware payload", "value": "f60617951c7b57644ef4598cb3deba898fac41bcf8f99d3801769fecfdf02d4091421b3b6f198fcaf21580b9f57ca606", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "9e21d290-08bf-47c4-bff5-5eacb063e5bd", "value": "5704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "f62ec674-e784-4eef-8715-a6818c65e3bd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "173b88a2-1744-4a2f-92f3-8fac0e5be44b", "value": "3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538775, "uuid": "f2263fd1-3b27-42f1-b925-fddde4b1c710", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538775, "uuid": "55617f1c-f439-4b73-9ae1-d9f9a4770593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "b8996957-0198-4d75-8c86-64cbd4f0887f", "value": "2e57e64b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baaec7f7-b990-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531682, "uuid": "f73bd47b-fa83-451b-8ce1-887f145374b8", "comment": "Malware payload (Dridex)", "value": "c202517a235f6bc08034247ddbe00914", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531682, "uuid": "d31af570-4974-411a-8b75-71b4655d63bc", "comment": "Malware payload (Dridex)", "value": "1d4c86958619a3917eabcf89dc5c2bab5c4f3853c34170d9eaf10be4c809cec0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531682, "uuid": "307f2876-7ce0-4c38-a507-3dbdccb5d886", "comment": "Malware payload (Dridex)", "value": "73b795de443feb7ec53db3a97cd53d035fb857df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531682, "uuid": "859aa80d-1520-404d-b5b7-eb9f0a86f0f1", "comment": "Malware payload (Dridex)", "value": "892599ae52d217fd78329acadb445d3d2883322d921c720db727c400f1f2381aab56dbfdb444513d6f457d20372df995", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531682, "uuid": "2c2606e0-7cd3-484c-8855-bddf1deb25c8", "value": "DC04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531682, "uuid": "98419df4-5311-4814-b836-e2bd86c2f279", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531682, "uuid": "c1c182cc-8936-4547-8576-5f52d52cf14a", "value": "3072:Si49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:SH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531682, "uuid": "c48971e7-4843-40fe-b204-f81a5163f061", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531682, "uuid": "17fcfb0f-e090-4fdc-8613-aaeb447618cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531682, "uuid": "afcbf152-1d5c-47a7-90f4-c205acc4d885", "value": "c202517a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6174fce9-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526378, "uuid": "509d5bed-608b-4ce6-8ad8-374ba4fcb3bd", "comment": "Malware payload (Dridex)", "value": "07cbdd1a59ae6bbcc459422ebb984b50", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526378, "uuid": "33a0a555-58a5-4d0a-bb51-5165f888b988", "comment": "Malware payload (Dridex)", "value": "1da2a5816c4688ab96c48e78f1bb2e116db28758338406e14d53beaae0d64089", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526378, "uuid": "1c164f5e-2efb-43f1-82ba-5a747837765a", "comment": "Malware payload (Dridex)", "value": "addf6d40585544b5b5b5c3c09d16060ff120a307", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526378, "uuid": "e9aca415-2d90-48f7-9fcf-7f932515c843", "comment": "Malware payload (Dridex)", "value": "8238794623d3de8101f2bf9ebc7c7940cd4b3f43bed1ec0a503f0f1c8e42c4678a5aa0598dac107874345566995ccb94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526378, "uuid": "e2ef3e8a-7706-40c1-a2d6-c8917de9be45", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526378, "uuid": "f20b2907-1cd0-44da-a5f9-18ca56611890", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526378, "uuid": "dbc49379-5eaf-4669-90cd-4d38cc22afd7", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526378, "uuid": "f9b851ea-f768-45d5-8d7b-5f5dba544fac", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526378, "uuid": "13116873-7846-41f7-bc9d-86eba8030122", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526378, "uuid": "1be4130b-5e75-4cc7-91b9-8580e9da717e", "value": "07cbdd1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fff2a04-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534644, "uuid": "67b5c548-4a76-48c9-b8ef-d1df0118a288", "comment": "Malware payload (Dridex)", "value": "32c3e8b5a3a82004265b79e25a2f5b14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534644, "uuid": "c900a201-ce52-4d31-85d0-274e927f756c", "comment": "Malware payload (Dridex)", "value": "1ddd145795a916cfdc77e088b2414fd2e176ca9616295c485a27e46b93ad1bc3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534644, "uuid": "d9569ab4-6603-44d8-9818-7dba41c69689", "comment": "Malware payload (Dridex)", "value": "68475648b971c631b32fafa84374ce334a449e40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534644, "uuid": "f84ebc32-67f9-484c-8edc-e7e0e1dd072f", "comment": "Malware payload (Dridex)", "value": "976ecc8f22ee6054724036d60bed6145fa7236cd8747112382054f107e7309ed14a78e142c9d7c2226401e095f79b1c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534644, "uuid": "cbe7d511-d49a-4eb8-a834-fb304abe42b9", "value": "5B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534644, "uuid": "948f333f-3d78-4c1b-bbb4-71bc4b5a7759", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534644, "uuid": "5d87095a-8eee-4854-8e0b-92d879f5d9b6", "value": "3072:2V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:2V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534644, "uuid": "6205f06e-e56c-4c00-90e4-72ea5efdc0bc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534644, "uuid": "ec974305-bade-4ba2-879b-30a0c19b098e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534644, "uuid": "c4dc79da-db26-4108-ab9f-048cbfb0aa33", "value": "32c3e8b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fbf6e6-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542510, "uuid": "c4557f8f-cb0f-46e1-a26b-be3f4163996c", "comment": "Malware payload", "value": "1e6560660676627b89f422597a5b6bd4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542510, "uuid": "f995ac75-4c3e-45b4-b583-58ffd61425c1", "comment": "Malware payload", "value": "1df0e0d35e2526fe028aa5a86623a40f6ae972be8e9c0357cb6063487ff2e55a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542510, "uuid": "07987282-0de6-4fbe-95fe-da71dde2bbca", "comment": "Malware payload", "value": "d8c53d09a3c7b6f478f4399ce370e9b4a71069aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542510, "uuid": "a54fa9d3-4944-4bc2-ad98-4e4f3f3b8188", "comment": "Malware payload", "value": "80332be0521d3e627e12243b5b5cead5ca1deb56b20476f908b296da3ce5ecb6058777e060be5195f4ed8f6eb3e3f18e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542510, "uuid": "5164e1e6-0e87-4402-b9cb-951c502d5b04", "value": "8704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542510, "uuid": "578b2154-5b14-49ff-b000-4866d341da24", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542510, "uuid": "d7d65085-9678-4b32-9be8-78eb349057c3", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542510, "uuid": "04e9f164-8653-4736-b271-81d2637b28e1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542510, "uuid": "d4c683b2-0c38-4585-b306-c3ec7a618e21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542510, "uuid": "f7a81c29-a8fa-45d4-8846-e9426a95bcf6", "value": "1e656066_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c891c1-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533957, "uuid": "3a5fe04e-c733-4a66-9be0-2e1928d7b2dc", "comment": "Malware payload (Dridex)", "value": "afe55694c8f117bae048d20e876e17b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533957, "uuid": "926b193d-8d55-42e9-a6d4-28cd2c07fe5c", "comment": "Malware payload (Dridex)", "value": "1e02e377d2b15557411f67732a6902b6c4aef05b99ce8572eeea3fc3e665e4ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533957, "uuid": "5842750f-f812-48e5-b204-28e1dead0ace", "comment": "Malware payload (Dridex)", "value": "9f7972b6855d0dd00aa3a13ee928488d75100325", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533957, "uuid": "511b6152-e263-4163-bea1-2eddfffcb4a9", "comment": "Malware payload (Dridex)", "value": "a61181968c1ed384785eb116e2c31a42da0659bead490514c6837566f7f0538887ba1969fc23c34c5d9bdc9c4d236cb9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533957, "uuid": "cbb093ed-6f71-452d-925e-b6aace1c2840", "value": "2A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533957, "uuid": "0f5f407b-8e3d-4ad8-9dd6-a7826480fe94", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533957, "uuid": "e425b5a9-c832-4044-8593-d6922ddff4f5", "value": "3072:di49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:dH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533957, "uuid": "74b540aa-9d6b-4879-942c-ffff28d6cb44", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533957, "uuid": "c9ad0270-61a4-4fe3-9d8f-5e082422eb63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533957, "uuid": "0be034a1-0097-4e5b-b5f1-e8c990e9f80d", "value": "afe55694_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a9653f-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552093, "uuid": "5e824b5b-c419-4d92-9593-1cb956fc3a8a", "comment": "Malware payload", "value": "2842b7387aae1139cf6d50234776b181", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552093, "uuid": "3df38b5b-549a-43c7-b36d-65899ef2db3c", "comment": "Malware payload", "value": "1e1bbb81b1be06da6e8c899f1c24fd99c31d150ca3da01c8860d3a4e44ae7d51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552093, "uuid": "cf09b433-f05b-49cc-b866-5666f97aba4e", "comment": "Malware payload", "value": "18e47acf6b886aa1b6cc9ecba013ab07e9dc1cff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552093, "uuid": "ee4d460c-d8a6-4fce-b077-b8959b7534fa", "comment": "Malware payload", "value": "b329ef4d1b6c8581770ea7667186aabf86311d59d18956652228cf4ac818d75fb39922783c149b3045215feb0a8aeecf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552093, "uuid": "fe82b7d5-417b-4204-acd6-9d372e0cd8ca", "value": "D8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552093, "uuid": "033f4eb0-9c17-4b76-81e5-9f79f7ea7c1f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552093, "uuid": "859a5780-98bc-4eab-895f-7c09f384f060", "value": "3072:8iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:feAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552093, "uuid": "6afeefd6-5a31-40c6-86ae-ecb4f26f88af", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552093, "uuid": "156ffd2d-7f00-4240-b011-7929be255c4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552093, "uuid": "37ae70e5-9e2b-4f8a-a3dc-38bfafbfdfae", "value": "2842b738_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7982df-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526885, "uuid": "6b3946bf-96d8-4f47-a31a-7a000dfa5d4c", "comment": "Malware payload (Dridex)", "value": "9bb9395e0c205af291e2ebd66ca8faa2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526885, "uuid": "cd2a11b0-6ea5-4b13-9f43-4f7bbdebdc42", "comment": "Malware payload (Dridex)", "value": "1e4914d70086a443d4abbdb93d1263973a1196a94401c723910b96731b86b11f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526885, "uuid": "631c91c2-ea6f-4bab-b31a-848561c27d5d", "comment": "Malware payload (Dridex)", "value": "d8772cc9167e258d8fc81350b7d3712eea9c93b8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526885, "uuid": "9dbb6acd-03f5-4a0a-91b4-9b6b09e184ae", "comment": "Malware payload (Dridex)", "value": "8bc87b4710bb668ea7219536d93824e82dd829f189440d25425cd036c365050728450305a4d7b2437bdf627dcba4ba88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526885, "uuid": "b728d4d1-5b63-4223-846f-0cc8b994df7f", "value": "FD04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526885, "uuid": "4258b29b-94ad-4efc-9941-7bd09a15df92", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526885, "uuid": "1a87e01a-29ef-4d74-8f75-9624292a5410", "value": "3072:Qi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:QH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526885, "uuid": "c5c6de86-bd73-4e92-a4e9-5ebc77980c06", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526885, "uuid": "5b323b89-15d3-41bb-86d9-8f1d99fedd3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526885, "uuid": "759719b6-6a49-49bc-9f01-ce68e20bf20b", "value": "9bb9395e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b9d7f2-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541740, "uuid": "7174ecf4-4cc2-4e0e-8b16-ea40d00073f4", "comment": "Malware payload", "value": "9a33b783c06d8759ea8ec5d91ec0f388", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541740, "uuid": "4508fa9a-7aba-4add-80e0-5d79fd413baa", "comment": "Malware payload", "value": "1e5650167bb4dc3b2bc1bb6a9eebb265c84504861b0aa2ca16a6fd04b77868c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541740, "uuid": "5c8be5e5-795f-4e14-b147-59de367555e5", "comment": "Malware payload", "value": "54fe576fe2d362d324b5a7d4e968f8b314363b44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541740, "uuid": "a23304eb-2c6b-4467-b4a0-4f1ae8eeb9d0", "comment": "Malware payload", "value": "fca484bc60c9b94839840b589b6f57578445583f0badd4adb1e2ef1db3e6d6f964d7934f956dc9459d29fdf3b9e274e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541740, "uuid": "364ff0bc-1874-45c0-9018-0a4db8681c98", "value": "CBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541740, "uuid": "7bd3c100-2cfe-4848-ab2c-5af046fb6c86", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541740, "uuid": "a7f97bf8-11ed-4966-802a-277d31ebbd9d", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541740, "uuid": "cc9f1518-7f61-467c-b1cc-36114447e1d5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541740, "uuid": "e390e2cd-87eb-4b00-a963-293de7067f11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541740, "uuid": "064ac6e2-519a-436f-b0f6-6abda37da649", "value": "9a33b783_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ef6007-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537586, "uuid": "ad799350-9d80-4ade-981d-c1a388548889", "comment": "Malware payload (Dridex)", "value": "71dfe4e65cb9737dadb4b71334963d9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537586, "uuid": "867a98c1-ae0d-4193-a918-2c4147c07468", "comment": "Malware payload (Dridex)", "value": "1e8bb739896fc7d8ba4cc8cbf5fecfd6b792e461b980bdf08d266405caf45382", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537586, "uuid": "f39127b9-77c3-41b7-a804-2f21fbbd9ecb", "comment": "Malware payload (Dridex)", "value": "61a4c09a57945c40a236bbff974d4a4b61247f89", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537586, "uuid": "c9857d65-408a-41ef-a19f-734fd0f53979", "comment": "Malware payload (Dridex)", "value": "0e29e7b94ae72bd2ebd2149cb45414919670ca14712ef50f4afde6e4b81697553c0a7c2b072943ebbf6454bfce6f77cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537586, "uuid": "3f976415-41cc-4af0-9088-cc00b73abd10", "value": "4804BE5EDBC7A84FDC0A06B5B07A2E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537586, "uuid": "b31208b2-d45a-4c11-b973-399f5b3dc2bb", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537586, "uuid": "da4f42c1-3b71-44ff-ac2f-fc91968230aa", "value": "3072:Ni49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:NH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537586, "uuid": "d08031ac-305f-48c1-acb5-d4e8eabb68eb", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537586, "uuid": "9645e372-5670-4c7f-9be3-fd65457c4ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537586, "uuid": "76cb44c8-ece7-4b1d-8045-9c9bad836728", "value": "71dfe4e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4bbc12-b963-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621512273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512273, "uuid": "460cc26d-7938-410b-87de-c84e0cbff40d", "comment": "Malware payload (Dridex)", "value": "11f5e5e46b56516b9240ed64e4026a1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512273, "uuid": "3a751c14-380e-4a6e-8b55-34be0fffd290", "comment": "Malware payload (Dridex)", "value": "1ee1582ebc2001949fa8bed84182d9d634b00186938a0fdb2c6143cf582330ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512273, "uuid": "8234a754-cc93-43c7-b9d8-eb87d1436cca", "comment": "Malware payload (Dridex)", "value": "fb8506ead23dc0198308f9f8888f642ba68e173f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512273, "uuid": "94dd8649-d482-44b6-b49a-b929362961b3", "comment": "Malware payload (Dridex)", "value": "a273a675b407530e998b89a4b5ded85d0a4d8452b2174e428977315e2bec7d79251d58a5c01a3724674708fea5d66437", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512273, "uuid": "0cb385a9-26b6-4c10-80d5-52612972705f", "value": "ACF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512273, "uuid": "83ebcab3-c18e-4775-ba0a-99c9d03473ea", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512273, "uuid": "44dd2ee3-143c-42c2-8c78-535095398e45", "value": "3072:AiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:reAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621512273, "uuid": "2015e84c-1444-4dd6-b14d-0f5dae0d9832", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621512273, "uuid": "ccacdb2f-dce7-4caf-895c-c7a1e5143a4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512273, "uuid": "660ac153-74cc-4432-aa25-85dc62b6622f", "value": "11f5e5e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1576599-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479778, "uuid": "f84d136e-f5a2-4aac-abae-92b719c3e0dd", "comment": "Malware payload (Dridex)", "value": "d789a9fb953d1db7dd4d22c291df8890", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479778, "uuid": "f78139bc-7287-4d57-9762-dd696bcc98e0", "comment": "Malware payload (Dridex)", "value": "1f30f4981e4101ed3f9206c9133303724e9030dd40f309c901d23a243bd7dfc1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479778, "uuid": "381870e0-aede-4091-8faa-1949da03090d", "comment": "Malware payload (Dridex)", "value": "51cedfecb1605a5d07e9eaa3f7603355c5cecac6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479778, "uuid": "2b4f265e-855c-4d5b-a928-38039d3a8c51", "comment": "Malware payload (Dridex)", "value": "7059a7f045cea55a47872ce43309347bc136f101334e14b405d84859a9ce7d0fa42999262974238ae9f87b5986b6491b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479778, "uuid": "b7c5aead-eae9-4250-9cf6-8b4b93781545", "value": "B7F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479778, "uuid": "b988ca4e-c04c-4988-8bdc-12e10623eaa4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479778, "uuid": "bf9648c4-9745-47ec-877d-7c9968aef7cc", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479778, "uuid": "d4e4f5d7-9e08-47e8-9ad6-a747749f01cf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479778, "uuid": "d73ecd6f-348d-4aae-b18e-bd57557a6352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479778, "uuid": "bc8ea5ce-9f52-4f78-b5bf-076c4f36f784", "value": "d789a9fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab072d39-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "f821cd6d-5830-4a6e-a2d7-9b6d55fa1c6a", "comment": "Malware payload (Dridex)", "value": "0a17bdabfabb10f60774edbc002bf9a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "a5727a71-f2af-49cb-9bd1-8777053f6f05", "comment": "Malware payload (Dridex)", "value": "1f71edcb0b89ee9c621272ccbec32f88c7279ea597e97b6531c0cb80eeeee262", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "2a2d0338-5a6d-4b23-b542-81f7d21db1a7", "comment": "Malware payload (Dridex)", "value": "855f2d1425528bff86d54806525c633d104e4b6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523925, "uuid": "1169eb8b-172a-4713-a8c9-6fb8465bd7e2", "comment": "Malware payload (Dridex)", "value": "24dc99b9142dda117d063b21b53350684bc2a6ec04cf50e4d5a8013070dabbc49802c45892e3fa8d7406575423fdb5ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "a7739656-33b0-4e88-bb6c-6bb4ab18759d", "value": "5004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD28ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "71e2058f-3f3a-44b7-8ef9-1c1f01ae384c", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "d30696d5-b60d-4872-9b44-d7bc3d2a1a92", "value": "3072:5i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:5H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523925, "uuid": "c3f90db5-a35c-4deb-9a3b-4b654f7fa329", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523925, "uuid": "da528034-1207-4568-bc0d-22bad088be46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523925, "uuid": "01bf7627-d520-4bc0-aeef-ee3a3969c371", "value": "0a17bdab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb681b6d-b937-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621493565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621493565, "uuid": "974e5a38-3c2c-4aca-9afb-43e76f304166", "comment": "Malware payload (SnakeKeylogger)", "value": "a8f5400dcfc0bb82333f6d988caac86d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621493565, "uuid": "31277abe-325c-4e91-bdd1-ca983dfcc79a", "comment": "Malware payload (SnakeKeylogger)", "value": "1fb7e7adfde8513cad887fb8d169a72d304ed2a24bd3cf1d72db5c4e443d50c6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621493565, "uuid": "5b94c93b-089d-46ff-98c2-5b1c0f14467b", "comment": "Malware payload (SnakeKeylogger)", "value": "d15acf71654d9b135be1a6f8c738f51e44194d2f", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621493565, "uuid": "262ae2f3-5fbd-44f0-95eb-4bf861fbcc4a", "comment": "Malware payload (SnakeKeylogger)", "value": "d63fc94e09aac5881b65399e0f317c518307d89dd7cd38c43f2b0ceb0e0202fb4f1f9d90afa0e31bea155df477cbccac", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621493565, "uuid": "52361863-b368-4664-94eb-ebdfab969ba9", "value": "3B25CF2333D4AB61E1BDA7755060165047F2F92BE732DE5D3D9840AE0866FC4CAA2F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621493565, "uuid": "68fb607a-655c-4468-b8ed-620c6fbde50d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621493565, "uuid": "7f5127f7-af6e-4248-a881-a1c0837fe988", "value": "12288:58W3ArKzqADEWCq9uE6LqGG/z8pA4sSs:513AuzjDrCsuE6LqGdpHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621493565, "uuid": "523c2df3-d5ec-4f45-aa69-be8bbd414fb4", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621493565, "uuid": "9e1150cb-a180-454f-a247-b049c6608e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621493565, "uuid": "a2a2bb37-7a6d-4bad-882c-2ab2519681d4", "value": "PO.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54195241-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621535375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535375, "uuid": "5826aa36-eba5-4e07-8308-f1c8fe529651", "comment": "Malware payload", "value": "138ab2fed2a328e0527968d304844f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535375, "uuid": "e3ded496-f9f7-4c96-beaa-ba3795f0b4a5", "comment": "Malware payload", "value": "1fb9a15f04e22fa2ffed97cc9ea058210140517821eae6a84ab2dead604a8179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535375, "uuid": "0afc01c2-4666-4aba-a25e-4cec92b66f9b", "comment": "Malware payload", "value": "3aa5af8c7d086a9efc085a218843efe2bad19774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535375, "uuid": "46ed5ab1-fd36-4bfb-a57b-0c2f2c80bb29", "comment": "Malware payload", "value": "bad47996e47a218bb2d4f68e41f9979e36b30f423ac840ca6409fbe860260ea74ba0686e3189b5d16161b6c1f85b0657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535375, "uuid": "79cb78c8-3b11-4c74-9f45-68c9a2dc106e", "value": "0E545B2066A3C034F1FF16F889B58279652A7DE15B3460FBE2C52ADE56706E4AC3134F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535375, "uuid": "f237e58a-101d-4795-a454-467e03fcb68a", "value": "6b55f630541fdcd5757b3e440357a9c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535375, "uuid": "0ee165a0-6b79-4b28-b9e8-5f927b96d6a7", "value": "6144:obMLtB/tUN49xvSTroe4klf5ckS+aNgg5DEokXsTRVjG:o0tB1UNkxvSTcklC+e53kXsLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535375, "uuid": "4c6aa340-7c26-4843-8df5-25bf4ea3ca92", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535375, "uuid": "386b7a76-13d8-4fc9-9564-284a7c8c862c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535375, "uuid": "061551e5-391b-410b-8ec3-c212f335cbde", "value": "138ab2fed2a328e0527968d304844f5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f6dfe5-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621538173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538173, "uuid": "929da410-33f0-4292-93fa-d342913996f3", "comment": "Malware payload (Dridex)", "value": "122303757a845787083023e14736fa2e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538173, "uuid": "69d81fc3-ae0e-4d33-9934-79a6e15f4743", "comment": "Malware payload (Dridex)", "value": "1feea3e168dede7ba2716b3c500db53affb9a6af2af281fb17b49590e5fe5dc1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538173, "uuid": "0201db58-04fa-4d29-8e0b-842ae38de6c3", "comment": "Malware payload (Dridex)", "value": "cef55ca4f9e2f494b97ce3414e0428a3a7e39459", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538173, "uuid": "524d30b2-b2da-493f-ae01-57ff505c1c61", "comment": "Malware payload (Dridex)", "value": "2bb6e37c400b103f93f656e0d95cd89735aa824622add68c81afda510bf9c6d4b58f82276931020ba7b2bd8d36e41c84", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538173, "uuid": "48ac3e9f-9077-4f30-bbce-4e040db94f73", "value": "4804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538173, "uuid": "449c9af7-d368-400a-b2d3-bf5f9fb51cec", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538173, "uuid": "dddc3dd1-17c0-4735-9a25-c17f8a2193c3", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538173, "uuid": "fab28742-f6db-40ec-a273-3538e516a15b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538173, "uuid": "39ab9ae3-b294-41a5-8957-73390c0a4007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538173, "uuid": "2293e91d-fc5d-404f-8506-7682701c8a4c", "value": "12230375_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bbc3ec-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472458, "uuid": "5ea6c946-ca3b-44a8-a04b-de7b4446a46d", "comment": "Malware payload (Dridex)", "value": "770064765a7f90320b781602e3e1db0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472458, "uuid": "d83a94fd-41c6-430f-aa19-5ecb0c9f75cf", "comment": "Malware payload (Dridex)", "value": "20206c9053c697ce06cd68f24f5311c3760110de847a18e07b054f8b5aff4a24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472458, "uuid": "7fd37f4b-92f0-4881-b95d-bff2f6314011", "comment": "Malware payload (Dridex)", "value": "70701132ea3814fd588ed07e8e45bb4be27e3932", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472458, "uuid": "d1d35f3e-48c7-41ae-a1d0-a9f67d2a8078", "comment": "Malware payload (Dridex)", "value": "2356ec3d192afd4c9b28cebb66a91277ea198a197ef5deeda045acf67b2d2a8ef9a05a62fc8dbe5632e6bd6dd16bdbee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472458, "uuid": "6936dcd0-9a6f-4e67-88a2-2ec4e731d452", "value": "5004D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472458, "uuid": "b7ae98cc-232e-4555-98ae-780bd0c48832", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472458, "uuid": "a4fa35a3-aba3-4813-9e8f-fc07b2a9ad01", "value": "3072:1qWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:7VqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472458, "uuid": "e96f77bb-4aae-4f20-99fa-7c6fb871baef", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472458, "uuid": "aa26d6c8-ac62-4d44-9320-8f0b518307bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472458, "uuid": "c316e819-8cf8-4d21-9067-179e3ee512bc", "value": "77006476_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adadb549-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539820, "uuid": "fcd2910b-e3b3-4f72-b530-d6733ec52dfe", "comment": "Malware payload", "value": "d5295027ef22a8987280c6602ca3dc4f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539820, "uuid": "38f16487-fde5-4b71-b45b-6fb80018a669", "comment": "Malware payload", "value": "2024bbce6d4f5de704adad87610ae10a498bf67b70c2afaff15fb1a31f90c864", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539820, "uuid": "e84fbb1c-3662-45cf-adec-ddbd2e5b2a9e", "comment": "Malware payload", "value": "93f158137f9c4ba14491189dbf77a9082113cc93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539820, "uuid": "da66fe5d-22a0-4a68-bd20-0104dd3dc124", "comment": "Malware payload", "value": "6201de4c0027ff1f9c2c64f983053ce5b596de844bc264c9eb1cc04935fc6573737fabbe2865cc2b907c75ce140a36af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539820, "uuid": "deb6d564-fc3d-443d-8412-eb4955585edf", "value": "4504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539820, "uuid": "8a903f88-d770-4e75-9d09-f143e45405e1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539820, "uuid": "9ff15dd3-36c5-474a-8ef1-65cb1c4f0041", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539820, "uuid": "7902e148-2bda-443e-a29c-7dfd3f7e7e3f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539820, "uuid": "2492e69a-3631-4d2f-bbc1-696c682d9abd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539820, "uuid": "8161f1df-277b-42a8-b6da-a3fb43a08d7b", "value": "d5295027_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fcb493-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552260, "uuid": "7bf4a7b3-e02c-441a-b787-ba30d25538e8", "comment": "Malware payload", "value": "014aa9df052ce8ac9b558f1f83afaa1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552260, "uuid": "5020016e-7638-44ca-9fcd-c10e3c671099", "comment": "Malware payload", "value": "20599a2a6317286245bdb0ae224bdafbcca01f10a5bf3cf0bb9cfc10280f256a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552260, "uuid": "c615cfdf-00a3-4d55-b3d1-815c981849de", "comment": "Malware payload", "value": "bd47b280b422ed80d1f3ecd0ca12ae0d1c7aca3e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552260, "uuid": "f8e5b215-be8f-4f26-8c51-809afd1e59ad", "comment": "Malware payload", "value": "1a0458ad7f00f139fd43f76f73c6593407ab2ec0f423cc0ccc538ce79324fb164b7de6e0464af38a46fb61b490030df2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552260, "uuid": "5460bc73-44c8-4aa5-8e01-c873ed71edcf", "value": "1EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552260, "uuid": "5c90d085-6480-4dc5-ac0a-74556f476711", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552260, "uuid": "28a6daf4-37c7-480c-b64b-98b35372bd1a", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552260, "uuid": "fe4e33e7-1a89-49da-91e6-dd1cd59a5b42", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552260, "uuid": "7e5817ec-f435-4d1f-9627-aa2ff0a03397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552260, "uuid": "6e73db1a-4247-48f9-832f-37102845a007", "value": "014aa9df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800c06db-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528147, "uuid": "b54beaa3-968a-4a71-bf6e-9dcf25d8e6f7", "comment": "Malware payload (Dridex)", "value": "bb9a225ac1202dfd862d4e83aaabfd89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528147, "uuid": "aeb2232d-b35d-4478-846e-933328fac131", "comment": "Malware payload (Dridex)", "value": "2063872c149ff09982cc91bbd6308eea612654db822a940167e08f49cf26042d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528147, "uuid": "b86b9051-df66-4461-bcae-02e335b76a6f", "comment": "Malware payload (Dridex)", "value": "e7a509356b4595d76278d7abd17db6c1721e6bf0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528147, "uuid": "2b0369bb-4f77-49e5-9c8d-001d87823035", "comment": "Malware payload (Dridex)", "value": "c5f741be1d9e0cde8933f08229daf5ff87cb5f2c8b201b896d680ddc728386b42bb0608b0c273875e145c334f4e37ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528147, "uuid": "17dd4a95-5130-44a5-ab2d-24f417804e1f", "value": "9504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528147, "uuid": "05ff3f20-9338-4405-9e5d-aae7564d20b6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528147, "uuid": "39072b83-a63c-412d-a1d6-7cad49289796", "value": "3072:Ri49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:RH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528147, "uuid": "bf8f9f05-0145-47cc-807d-0061cdd337fb", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528147, "uuid": "5edf029a-8f5f-4c72-98cd-6ee58ade3489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528147, "uuid": "24b791ed-478c-4a25-88bd-b510054e9f12", "value": "bb9a225a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fa68f8-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532509, "uuid": "95878194-91ae-44a2-93e4-e1645e76a010", "comment": "Malware payload (Dridex)", "value": "f044a60e27025ee390e15b52ef77a09d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532509, "uuid": "609a5193-5b3d-449d-95f6-59b13da25873", "comment": "Malware payload (Dridex)", "value": "208fe6f1c52f6a8b8ea4ac93962b1799561f792497fce5e288c41d1a5033efb3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532509, "uuid": "764d71c4-36bc-44f9-a38b-89621a449fbc", "comment": "Malware payload (Dridex)", "value": "a4d25fadf3f1a74cd11f03bb2ac9c16348d787bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532509, "uuid": "9f72fcab-b1cb-492b-86e2-1b92f9b44fcd", "comment": "Malware payload (Dridex)", "value": "db2f9c35ce884450fc06a4abc364196665e3dd85023f2d25ea13dd98810fe18ca6801d9c8813774aa4185260edf90bcc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532509, "uuid": "9e1e50bc-9391-4b11-8bf1-3e3cc4f7b016", "value": "AC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532509, "uuid": "86a4cbdc-cb01-4478-a14d-7ae33371edf5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532509, "uuid": "f6496adf-5622-4436-869d-54dfe816d830", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532509, "uuid": "9d6321b6-f2df-418f-a353-8cb41d19cf00", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532509, "uuid": "295c5c1b-c046-4733-a6e6-effb8a88397c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532509, "uuid": "1312c6aa-3146-4a2e-b51e-28333358d7e5", "value": "f044a60e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639a71a1-b9c6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554729, "uuid": "6bd2a31f-50c4-4c5e-a999-77daa0021c3b", "comment": "Malware payload", "value": "f2dfdde94cdaeefd689b69060a2af664", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554729, "uuid": "49380242-b472-44b9-8572-e5fde9f18eb8", "comment": "Malware payload", "value": "20dfae4172e6c633e6434edfebdfbbf90fbe7e3d535b1e78b3110f31677dcb2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554729, "uuid": "174ea1e3-09d4-4d80-b10a-68f3f63b75c4", "comment": "Malware payload", "value": "1fe14a77421e0bfa571ab24779e60ec6bae5843a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554729, "uuid": "a72da4b9-3ef4-4b86-9bc1-2e59c156276b", "comment": "Malware payload", "value": "14cbb9dc46a2be89eba311ecd3fe9733f4d2a14a4c53f6e9cf281ef5fb3c7b4ccc7e73f14b195ceab3cc51791dde5c89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554729, "uuid": "2225f60f-f73b-4167-b1c4-1dcc6f54046e", "value": "4804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554729, "uuid": "8f89c6a8-22ab-400e-b190-1ec116357c1e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554729, "uuid": "802064de-9732-47bb-981a-1b1c7cbccb39", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554729, "uuid": "87bdef91-e691-456e-921e-d276f2a11862", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554729, "uuid": "637f1027-4b2b-4001-a094-0cb28550aa0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554729, "uuid": "b18387b1-8751-452e-baff-08a1ce28c771", "value": "f2dfdde9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a88b3b0-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528809, "uuid": "9c5df7b2-0fcd-467f-95de-14852c9d7c20", "comment": "Malware payload (Dridex)", "value": "68906ee8d36e6b48759ed93d807c9bdd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528809, "uuid": "d9a81cb8-4cef-42b5-a859-b87887c25378", "comment": "Malware payload (Dridex)", "value": "20e7baf8be3f25813ef8722246a097564feff753296c973b5d8ae2b4962ee069", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528809, "uuid": "e397aee8-e966-40ad-b93c-8a0e00592b8e", "comment": "Malware payload (Dridex)", "value": "5f173581e5ca27d624b7c0d9add5972a43eb9cf9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528809, "uuid": "6f12c0e5-d3ae-48fc-a804-58764a4183cf", "comment": "Malware payload (Dridex)", "value": "8b5291c03cf00d61fdd4106d362f9564a6ea69bd3ea7fddef35e349424cfd7783a52188d2e7bf8812e006baeb413d630", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528809, "uuid": "00f72d47-87b1-4f58-b30a-a7a1f0dd9723", "value": "FE04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528809, "uuid": "5c24f03d-bd3e-47bb-9a68-a955bed0cf31", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528809, "uuid": "fedc5674-a7e6-4210-b7ae-c1237d0c004c", "value": "3072:Ai49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:AH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528809, "uuid": "969d9116-dbcc-4bd2-bd11-ed9c9f0dd747", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528809, "uuid": "7359edb8-5f1d-4fa9-b62d-50e99fd99a1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528809, "uuid": "f9301349-795b-4757-930c-29427dfe543a", "value": "68906ee8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca268673-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536003, "uuid": "07e64da2-8dd1-4005-a127-d21788cf54de", "comment": "Malware payload (Dridex)", "value": "a537cdb881ab965ac939e1f88e255552", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536003, "uuid": "eee8a4ae-793c-4f51-a3e8-813150da1893", "comment": "Malware payload (Dridex)", "value": "2116aad241d4ed3d91c35b53174206c14dfa2e0529a38a3adaa73244a143fca8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536003, "uuid": "c8257072-4375-40c4-92ae-ecc2c48db9d9", "comment": "Malware payload (Dridex)", "value": "39914555831f54cba1fa1b170a5b511623128e2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536003, "uuid": "b8c37e8b-a937-4273-a728-4ad199ed8363", "comment": "Malware payload (Dridex)", "value": "d467c60ca91b0d9e99b7316da684610e01a0c53d82527499129b06675f92e03c55066b8fbeccb5ddd39129e8f54ce0a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536003, "uuid": "5576d0f1-768a-4520-a11e-d2bdb2854ace", "value": "0FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536003, "uuid": "7734038c-7bac-4524-926e-fe4a086ba9bc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536003, "uuid": "7b110184-9585-4d35-8825-296d5e42a6ad", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536003, "uuid": "f0fe7a4c-5fe3-412b-bbac-a6559693554c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536003, "uuid": "f8afdae2-0506-45b9-a1c8-96e2f6233514", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536003, "uuid": "d9446345-2fd1-4b21-8f6f-4092e08a713c", "value": "a537cdb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afe9b1d-b9aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542742, "uuid": "a13e8dc3-1fc1-4e46-9e7e-82f7af9b94fb", "comment": "Malware payload", "value": "d8c203216b0974ac26ff4a59772ffa8b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542742, "uuid": "3353f8d2-b2af-4d24-afcd-00d346516df7", "comment": "Malware payload", "value": "2116b3fe7ba36732a2ccbd25da27cd6dc75bb16f0f565e02741c93f3ee1a19c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542742, "uuid": "efbaba95-b1d5-49a4-b32c-e0ab27e448a3", "comment": "Malware payload", "value": "7999c9bc8c6b66d1bb9dac8e64822492f7154882", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542742, "uuid": "3e4f46f4-a308-4e69-9938-446d28294d30", "comment": "Malware payload", "value": "2c40ec96091bd184affd3012bf1092940c1a8f3c8f17feba4a365ca8b8eed9c497f365a15a6f9052bf74170472797bfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542742, "uuid": "288b97c0-c413-48a4-8e69-d969051b8e6f", "value": "2E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542742, "uuid": "598f9e6c-bac8-4daf-bbb5-93783c8dba52", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542742, "uuid": "c6a11c14-a2d3-42c7-b1de-b9f17dfe1340", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542742, "uuid": "3ef10baf-f471-4f60-ab33-89d6a940e747", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542742, "uuid": "8912d00d-dd68-45cf-8a04-e90a99ed668f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542742, "uuid": "ff7024a5-311f-4258-b4b5-2bfb583b8cbb", "value": "d8c20321_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358f522f-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540907, "uuid": "e2f4d214-ce95-4454-ab67-6e198dbba078", "comment": "Malware payload", "value": "3a0f9f18ad36728f583eb80a2786d8f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540907, "uuid": "ca815495-dc82-4d88-8ccc-cfd8c8f32d73", "comment": "Malware payload", "value": "21181294b5099f54c36cd6bddfc8f470a33f70379dc569b6706ab4d1ff6f6a66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540907, "uuid": "4aece25c-8ae9-4804-8bc3-cc9b68485f3d", "comment": "Malware payload", "value": "dfca2d4f3919e1f7cea0d3c6492dbf8b276204d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540907, "uuid": "65e3928f-ac48-4ff0-8d34-3c23f64d2c35", "comment": "Malware payload", "value": "51b1e5e21e3c6c0380df6fb17ceed6096b80e734daf66304ef4dca6e50da748bcd20d8d772d4baf05496188c19171a95", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540907, "uuid": "019eee82-9ab4-43d2-8d15-6bd73cf888b9", "value": "BF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540907, "uuid": "c6ac7441-b9a5-47c9-8a0e-39e81d222441", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540907, "uuid": "37670776-bd27-4ce7-a8a1-f48c656e1f30", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540907, "uuid": "c3d19d47-a8b4-4320-b6c1-171ae6620b95", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540907, "uuid": "7dc0b0f0-8161-4710-9449-7da6336b21af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540907, "uuid": "05e96c4f-ab59-4f06-b4b5-687486d271b8", "value": "3a0f9f18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62223845-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535399, "uuid": "43540074-277c-44e9-afd1-09d36011755c", "comment": "Malware payload (Dridex)", "value": "8d3af8dd5bf8ba30dffafdada21b555f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535399, "uuid": "0a537d99-5167-44e1-8630-79397ba329b5", "comment": "Malware payload (Dridex)", "value": "217a985ee6e74545214637cb63f235e5d9bc52021f250bf502460dbf27b26a36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535399, "uuid": "8f539b17-84d2-4175-9dc3-5e31e3699d78", "comment": "Malware payload (Dridex)", "value": "0bad1b98230a9c15d6e520d717209694a09b9c22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535399, "uuid": "478c540d-df7e-477b-8026-bb4179644e3c", "comment": "Malware payload (Dridex)", "value": "0af68282f6a7afc0a7c3c3340a34e021a902fb2eef4644ba8306918d38724c5a3718fc4c9f7622cd7e6a4c7f2dcd38ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535399, "uuid": "ff67544a-72a5-433b-9d4c-a84f5b2acc85", "value": "6AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535399, "uuid": "f4166f6f-b2cc-48db-a358-ceccb36678c1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535399, "uuid": "5fa1c6df-82ce-42f6-851f-f12eda6e75c3", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535399, "uuid": "d6d32bec-87f9-46af-9dad-e6a5f822914c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535399, "uuid": "176a9c30-649d-45c1-8a49-d8fde2d330c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535399, "uuid": "7c29acfe-fb56-4751-9d41-793a2379a4b5", "value": "8d3af8dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6df88d-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483636, "uuid": "ccc8d678-a08f-4aaa-bf17-0e79c742060b", "comment": "Malware payload (Dridex)", "value": "967641a3be9502b7d657d0b003ba8357", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483636, "uuid": "48966e92-4c32-4d88-a5dd-4dc30d5c657f", "comment": "Malware payload (Dridex)", "value": "21b4478f4449abba530fdb30d89fcd8c50c8df9ea73729ef9582bc689424e493", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483636, "uuid": "d0f43638-0f97-4eb1-bd21-6afb4965b45c", "comment": "Malware payload (Dridex)", "value": "0332a1e64a3ca14888501e2dfc1a3b598450344f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483636, "uuid": "3e1569fe-f4f5-42f3-8aeb-c59bde7d5799", "comment": "Malware payload (Dridex)", "value": "b022761814586126b3a7817559e575f46b46a97e6709cd7a2dd633780106c5abd57ec292a8f7211d5aee2742a7b094ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483636, "uuid": "17d7f745-f2b0-4bc9-8272-f1ab7f8c6107", "value": "04F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483636, "uuid": "d226e66b-5a27-4910-9716-51eb7a782138", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483636, "uuid": "7568989a-51d4-4b1e-8e3d-a982fc3c1be5", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483636, "uuid": "aafd5b77-8af5-4e75-83e7-99c1b2ee5fa3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483636, "uuid": "e1bc4153-19b0-4af9-beca-b3f62bd3550f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483636, "uuid": "92651ca8-3894-41e6-96b1-aaec0541dd62", "value": "967641a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cc6655-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536994, "uuid": "3e4190ca-1509-4b6b-8d88-48146e5497bc", "comment": "Malware payload (Dridex)", "value": "50c4fc037cf7b068d07b49907284f936", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536994, "uuid": "bbe61843-7104-4f02-866d-de7fa8906644", "comment": "Malware payload (Dridex)", "value": "21c65552c65ee25f9ccba1b89c4287259f551bf8d120f159414b09ff5aa62e6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536994, "uuid": "c5bb822e-eb8d-46f6-8287-2bf1a08cda6e", "comment": "Malware payload (Dridex)", "value": "7eaf769f55cfd8a8352fe6792c9f223c2cc3a967", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536994, "uuid": "68928784-5a40-4d59-aed2-fe6b762c9f84", "comment": "Malware payload (Dridex)", "value": "83b6034a83b6a9a15b782d1d56e3a63a76c9527cb872fc407a9ca93e5532970d47d2264bd1d242c076892fb055fb86f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536994, "uuid": "36a34883-d6c4-45fe-8529-7fc83a2decef", "value": "5604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536994, "uuid": "c2d2b301-dc78-4b8b-9d28-1b811eab7460", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536994, "uuid": "1b2d4291-8972-4b65-b739-8f2b1fc45566", "value": "3072:ri49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:rH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536994, "uuid": "999e1a98-883e-411f-8e08-73dda1bf9f57", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536994, "uuid": "a7f4931a-78a0-44f6-9d7a-024e0ff593de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536994, "uuid": "d3e0ab19-4a2d-4e43-ac85-f677a4926df8", "value": "50c4fc03_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503bcd97-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544818, "uuid": "81482a93-f5fb-451c-9990-d4e65140e568", "comment": "Malware payload", "value": "4f00bda9d020bc21b1e9d7006460cc6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544818, "uuid": "c654cd62-904e-404f-b5a9-2569b2818397", "comment": "Malware payload", "value": "21e3d79364c8ba16b4515d449065228cfdf45700a5a49bcf950d867f0e764f5b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544818, "uuid": "1b93c37b-6d03-468d-880a-430a2808395e", "comment": "Malware payload", "value": "ef2da07b1a6162d95e5c519e0ae94ea2c42abc57", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544818, "uuid": "5de58004-f3b3-4fba-b945-d3261ff3219a", "comment": "Malware payload", "value": "3f669bb6f3b5cf1cffb49225fece27ecc64e2e058703611019cb4e299a0e45a57d07fcba4fca3d9d70d477f6d0b26235", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544818, "uuid": "3a583388-e43d-4e85-9caa-79d3c3300c5b", "value": "0104B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544818, "uuid": "ea394685-c769-40d9-9f73-ab0f56ccce3b", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544818, "uuid": "2828df69-dcf4-45a5-97a7-513521cd8f3f", "value": "3072:1WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:1WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544818, "uuid": "a9a4253e-41ae-4ce0-906f-eadca0333edf", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544818, "uuid": "cc6c328f-67aa-448f-ac87-7090564d0d2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544818, "uuid": "b6cc11ea-99e6-49b0-9f66-f5a36bfeb686", "value": "4f00bda9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b4f78e-b965-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621513311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513311, "uuid": "aa93102a-c06d-4de7-bbaa-b410ddfe5070", "comment": "Malware payload (Dridex)", "value": "216c05e09307d4758fdd0c63712b160f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513311, "uuid": "8ebbbd72-ff7d-4909-a033-179d91f8721d", "comment": "Malware payload (Dridex)", "value": "221ed4138436e46081515e9012d4adfa8df3f95b343fff1b10d8fc297969627f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513311, "uuid": "3868c26c-4f07-4fb9-beda-7c1eab64cd17", "comment": "Malware payload (Dridex)", "value": "8ecba3c673c196ccfab4f7fe17b666522ddb61f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513311, "uuid": "0fd47784-7701-41ec-b550-fb5978c32ab6", "comment": "Malware payload (Dridex)", "value": "cc38afd9e578f600995d99b5f35b9a1bfc4d2c07cc71560baad166dcf5237de349dba2cfbf47ac803a36ead1fb1b42be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513311, "uuid": "27454c3d-8208-419c-98f4-e15a762d20df", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513311, "uuid": "13a07616-431a-411c-a5e0-4628b59f67f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513311, "uuid": "d66a30a5-2a1e-4254-878d-1ecd28c488b3", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621513311, "uuid": "3d915e94-a1d9-447e-9fba-e947238612e6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621513311, "uuid": "9c3702e8-da14-401d-ae25-7e2700245d68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513311, "uuid": "78ca1e2c-0ac7-42dc-9ef6-9bde401494f2", "value": "216c05e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9732a9-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545078, "uuid": "57e176e0-0300-4a9f-925c-c83f1860b1ef", "comment": "Malware payload", "value": "8a28a3cc80bb3e5a8bb680cffe2eb384", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545078, "uuid": "aae536b1-14f4-48bc-a55d-0469cb0ceeea", "comment": "Malware payload", "value": "22400ab1a6724749788f85f956812bc179a53e422fc0d41c2d7378ab07467c03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545078, "uuid": "534673a4-cada-4b7e-9fe4-0debf836299d", "comment": "Malware payload", "value": "c85fe3904a10cdf0138700afb413691399022fff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545078, "uuid": "72d42f59-9ac1-4ff5-a4b5-4fadd9732a6c", "comment": "Malware payload", "value": "fbfdf9decbf96f887b01aa3c1da71e80944da23216899abe6257dd748d47dc1c21e62e8d4a355d8b98e53fde4314405f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545078, "uuid": "1b609d19-e18b-46fb-9469-bbe303e739f3", "value": "AF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545078, "uuid": "925d5005-c73a-41f6-b3ac-b865c9e5f454", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545078, "uuid": "7d3d45c4-2516-481e-a94a-d74d72e92c8d", "value": "3072:2V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:2V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545078, "uuid": "c7c8da7e-0965-4383-b608-5e6c0eb3d048", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545078, "uuid": "c6c814dc-5e5f-4eb7-bb8e-97d52d7a05ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545078, "uuid": "de26cdd5-119c-4234-bc39-0df32dd67430", "value": "8a28a3cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a6b206-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544484, "uuid": "85970d2a-2b91-4365-a447-8c04baf0059c", "comment": "Malware payload", "value": "ea3cded3b53e3cf515fec1742130c8e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544484, "uuid": "78dcb332-ac1f-44cf-8a08-836577068443", "comment": "Malware payload", "value": "2283c8ac3c9dd101d54f76d47e26b471980e4094839c5c456cd296b2f71eeec8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544484, "uuid": "6226df98-ac56-4445-80a0-77553dbfe48e", "comment": "Malware payload", "value": "54f60db781bb308494f5766fe40b0aa716fd9d34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544484, "uuid": "19baa5d5-081e-46fd-a793-38231da4d480", "comment": "Malware payload", "value": "bfb4f342d5490b6dfbd856b36f5a781c52c01e41fe2e75da4e6e8d78e45e0e886b6019ff722dce581737da23212eb96f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544484, "uuid": "d13f8ef3-54a2-4ea6-a1bd-b464f1388d2f", "value": "D404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544484, "uuid": "862fcb8d-69c8-4181-a59b-1b1a9428d9d8", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544484, "uuid": "f72fa3c9-56ea-4728-91bc-742770867680", "value": "3072:Ti49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:TH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544484, "uuid": "3100cc0a-6dfe-4af7-abd6-18a59772e389", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544484, "uuid": "e47f67fa-a861-45ce-ae9e-b3d27d9d7af5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544484, "uuid": "e8e6d2e2-0de9-4f91-a2f3-d060ebad9006", "value": "ea3cded3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61faceb-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532560, "uuid": "804bdade-d87c-4074-b5c6-b946d900e860", "comment": "Malware payload (Dridex)", "value": "d2d5eaef1d168a9f74caa290a63d81f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532560, "uuid": "331c8750-6353-41ac-b6a8-f7b16d14d1f8", "comment": "Malware payload (Dridex)", "value": "229c4235e4102b34a747fbe6c0b70de3f6aea195cec2f7cc3df7735ce421d7cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532560, "uuid": "0a2240d6-5938-474d-9207-dadf09e451bb", "comment": "Malware payload (Dridex)", "value": "2025a892c483ac7c0d15cbad66993e6c24713dfe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532560, "uuid": "244e419e-7713-4dca-a8fb-f5c82a8689f9", "comment": "Malware payload (Dridex)", "value": "45cb391c1ed29cf9cf07a571018ec043f4ea092e7fc577c89304b668a028b3672fa5c7be9cd40514a119f3b67ca00dac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532560, "uuid": "60ad5675-cb31-4b1a-8689-4c92bdb3fbc3", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532560, "uuid": "7d159165-ae3b-4170-9deb-d5a4f35e9214", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532560, "uuid": "145fba00-f701-44cd-ad9d-dbeeef78e493", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532560, "uuid": "7a19159b-5366-40f2-adcd-77be81521f0e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532560, "uuid": "2cdd526e-f121-488e-8d89-27f347ca91ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532560, "uuid": "5d26dae0-838e-459b-9bdc-53960568eb14", "value": "d2d5eaef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dacc28-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545007, "uuid": "fd658372-b972-457d-9c16-87712bdf843c", "comment": "Malware payload", "value": "6056485874c8e7a1aec2d2bbde6b8d0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545007, "uuid": "b56ca181-2b31-466f-8a69-76898b373a3e", "comment": "Malware payload", "value": "22a9e8156cc581c1ffa8251990223d62eb0881eb42e137e6ec07599d8aaed70e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545007, "uuid": "68b691c1-815a-4ea3-8dc9-2a29fadf3af1", "comment": "Malware payload", "value": "aac31fbdc8c94b16ad8bcdfa8c239cf61942d662", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545007, "uuid": "a72a0d7f-be12-4c88-9ba8-488bfc174c5c", "comment": "Malware payload", "value": "4297b720426c8b9466cd798f0951fd3610f6417a4198cbd3c1cac095769f1e99bc3ae627789911961a8c8edca27139da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545007, "uuid": "ce3cbfa6-372a-43af-8e81-ffe8b77368f5", "value": "A604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545007, "uuid": "ee3f4be9-fdeb-498f-b73b-f76d5addddcb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545007, "uuid": "76e6edad-17f8-4ac0-aeec-094c0bc8e4f7", "value": "3072:AV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:AV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545007, "uuid": "bf6ba276-d183-4547-8333-316176cb38de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545007, "uuid": "8b7f29f8-3e1f-478e-8b7e-aa22891f05a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545007, "uuid": "152c9c25-87d7-4e82-8150-e9c2ef1a50af", "value": "60564858_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9779f878-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468916, "uuid": "1286c788-ae66-4658-b52e-e8ef3b8452d8", "comment": "Malware payload (Dridex)", "value": "a5909c0b06268fb137647b04f8f97542", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468916, "uuid": "99e2183c-db42-44be-b9ae-3a10a29bdd80", "comment": "Malware payload (Dridex)", "value": "22b361d827511c8f4096d3c622a240bdd551b301436799c825c2e3b7aa26f069", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468916, "uuid": "fc5cdffe-8ed0-4cb4-8359-26155e04598f", "comment": "Malware payload (Dridex)", "value": "ebcac710e5cdcb3fa8f276336b74ed951ccf2664", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468916, "uuid": "42bba01f-0ca9-4eb6-a523-31ef1d94acd1", "comment": "Malware payload (Dridex)", "value": "603dd876f50b3a7cb2b9a32a606324f5a6e8fd8298e609dcda216b203c77d827be72227aab74fc13e5fb94d58b4d804b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468916, "uuid": "ecc6c294-e1d9-4977-91bf-bfca76d3d3bb", "value": "43F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468916, "uuid": "a3249fc9-a8bb-4391-b59e-131d9e944509", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468916, "uuid": "08843a17-5dfa-4563-b0b4-bc7646f280c0", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468916, "uuid": "8ea6f2ad-ad2d-47a0-adbd-f3eb26a02b63", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468916, "uuid": "580794e2-6d9b-46e4-b242-933bdcafaa08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468916, "uuid": "59dc5ba1-4d04-4477-a614-6ef62a43fe13", "value": "a5909c0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1554b508-b933-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621491461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491461, "uuid": "06724917-8765-4805-91cf-39e5cea5f5b7", "comment": "Malware payload (AgentTesla)", "value": "16898cf53d10d029d74d1836374bdfb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491461, "uuid": "5658af87-ac96-4c86-ab0f-835c2c49c276", "comment": "Malware payload (AgentTesla)", "value": "22c7173681d280243fe516b9dc1eaaceb7bcc9b162e861b5bc212cdd875d58f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491461, "uuid": "511f293b-1c6e-491d-990c-ab684132c882", "comment": "Malware payload (AgentTesla)", "value": "10c65be8fcf6d342789d41607f829a42268ba432", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491461, "uuid": "62cb848a-a9b8-4894-88fa-27f549b4be95", "comment": "Malware payload (AgentTesla)", "value": "ef6ea8492ad92b54337a95cac4414a0a4ff51b5f8beff4f9ed71f6483184f0792aa0b765ed4715d9a298b5a6c9b0cc90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491461, "uuid": "cc828da4-0e08-44ca-b7d0-965d6415d0df", "value": "433523408BA63F2BD75F19BC546BE34090DC8F80231295A35AD1F29C6C39675EAAF1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491461, "uuid": "a814a4e2-47b8-4645-8208-1d7a120e9e36", "value": "24576:eYdDgYCHSbVirLu9B1nlqTKkcjrj8PC1DxAa9Wx:NeHCM2bYeRrjv7AaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621491461, "uuid": "625be67b-ac0a-498b-8fb9-0d932a6ecedf", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621491461, "uuid": "fd7bfd65-71f8-4ed5-b15b-97471743532e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491461, "uuid": "0d6ce5d8-f938-4001-98ad-c5ad8be9690e", "value": "PO-AWB.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16bef0e-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621530405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530405, "uuid": "d5f09086-d84d-4b34-a0f4-6f406fac9c28", "comment": "Malware payload (Quakbot)", "value": "7c24c1c8807443367c3e89a29980a479", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530405, "uuid": "562030e9-9993-4f62-89ed-b9981c210e24", "comment": "Malware payload (Quakbot)", "value": "22cf76937043b616cb4c67bec58e329fecc91015329799f7b85abda1b2f6fde2", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530405, "uuid": "e28749b2-d46f-4c5e-a6bd-3376321a7093", "comment": "Malware payload (Quakbot)", "value": "65310aa93358d43f2a68a3d3f3f9bd7d618e51fd", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530405, "uuid": "0badc166-9aba-4434-91a9-b1cb6d4f797e", "comment": "Malware payload (Quakbot)", "value": "785299ceb97f98ae25e97a5f7f291d0cb5a3ab1bec29e1334b7c16e997f8424c9f2457ef02d0df2a67f0720998879cb1", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530405, "uuid": "43a006a4-90f8-478c-97de-a2a95e1f7f15", "value": "F045AEA435C6F132E07520308F95D9FC1728BD119B6A0ADB37E02F9F6D6DAD26631722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530405, "uuid": "07f48eed-8711-4a92-ba95-96ced30b82e7", "value": "0ed466b2251d50e532029d12ce278b8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530405, "uuid": "f6c3b67b-02dc-40a0-954d-752d633054c2", "value": "24576:V+pepiaKOv8yfFBexi2QtpIGte8CBwLCAJCLL:MaqsFR2gteDBws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530405, "uuid": "efddfa9b-d188-467a-9498-907d125affe2", "value": 1240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530405, "uuid": "18829718-34a0-42cb-8fea-fcd089b01f5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530405, "uuid": "9e1e88d2-8308-4d6a-8a49-83bc21d5b4c1", "value": "7c24c1c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8516c4-b94c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621502452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502452, "uuid": "90e139af-e3ea-40ec-84de-d601e2bccfbf", "comment": "Malware payload (Dridex)", "value": "3bd78ab006b46e4113acbd07d229f0a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502452, "uuid": "d7914090-61c6-4039-ad38-70b343bab139", "comment": "Malware payload (Dridex)", "value": "22ee5085eececeae6d7295476884b016bddb75b66df3ddb3e4dfaa5b068cf08d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502452, "uuid": "7899d2f7-d5cb-4bbe-a0e1-b154487ad1ee", "comment": "Malware payload (Dridex)", "value": "c671d7588baa706462167f16657fbff68702a44c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502452, "uuid": "c63131c8-1006-4383-9956-fcd0c87b0c99", "comment": "Malware payload (Dridex)", "value": "74b4035e9699195e55c6aed01e3675efa32e0f3cc6575c3be98dd31d99fb6d4c2f1735168975705d118cdaa76f02e1da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502452, "uuid": "5d319e08-171c-4342-beff-0d51fddb561f", "value": "A9F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502452, "uuid": "aa2b3a06-9637-41a9-a716-b9e10f20af44", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502452, "uuid": "12da6857-ffa1-4a66-8bc2-d67661ef26db", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621502452, "uuid": "40a43fe4-680c-4bab-80ae-d86841d6161a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621502452, "uuid": "c4b81742-1bdc-48bf-93a3-5e67b6261b0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502452, "uuid": "b7f70a2f-ffb7-4c00-b520-fc7df92a9cbb", "value": "3bd78ab0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a9b92f-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524100, "uuid": "fe5f7d8b-c0c0-45a9-b594-51ddb244c7ed", "comment": "Malware payload (Dridex)", "value": "9811e93bc4e8f540dc18716e19009647", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524100, "uuid": "b0c7a9fa-b898-41ab-b839-646134152a1e", "comment": "Malware payload (Dridex)", "value": "2341a7ec7b88450b91e2a85d4f0a91b92e400c65b6e004edbbf1606ec97fcb07", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524100, "uuid": "9e8d885c-7e07-498d-a7c6-322ada61bd57", "comment": "Malware payload (Dridex)", "value": "cf934944e5e4123f05df4d44357a2d658485cccf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524100, "uuid": "f15fb779-7911-4180-8d3d-dacb7c369c16", "comment": "Malware payload (Dridex)", "value": "57a5ec785eabae14488fedd1237bc6e83fdca7858935968bb33c5baf3c27a97905e5906fa1d53863923bc5a53e5f1c75", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524100, "uuid": "15b345b6-a846-4fa7-9a7d-e7031c752dfe", "value": "8504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524100, "uuid": "00b1b4bb-3c94-4f9c-a6f0-3c95ff963377", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524100, "uuid": "cacc3e31-0076-491e-8e97-5a63eef84489", "value": "3072:ii49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:iH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524100, "uuid": "5fae4bb4-c930-445e-8b6c-742c6290d1b4", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524100, "uuid": "7a67d636-a88a-4bed-8fe3-075629bd761b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524100, "uuid": "5e4c7956-3531-4950-bf17-337fca14a12c", "value": "9811e93b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57debb20-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476111, "uuid": "29a7986c-5bde-4ab2-9a63-a8d5fdf30e5e", "comment": "Malware payload (Dridex)", "value": "72be195492988be2e7ed5aac586f5642", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476111, "uuid": "cf8e93ed-cf18-4062-ac75-0181f0a84a71", "comment": "Malware payload (Dridex)", "value": "234d1e4e744c9a4f81e18a5c2965acd0dd89c9785469aac30ec74b6705162770", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476111, "uuid": "4e1f0037-d6e9-42b7-a5d9-f480b72dbacb", "comment": "Malware payload (Dridex)", "value": "9bf37852609b28e15286e2e120267da7e4f74281", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476111, "uuid": "a2592cc2-5cde-4255-8975-85799a8dc0fc", "comment": "Malware payload (Dridex)", "value": "7592ac5974ca31f4354d4b389c925edb00d9108f4009aab03af241e0e827051fe0af574cbb97c453dee387b101372642", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476111, "uuid": "0f89f2c8-9c51-47d0-94e7-188d6bc8e6d9", "value": "30F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476111, "uuid": "e6f857fd-a588-45f2-b885-fb8cf03f4ac0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476111, "uuid": "572ed70a-8bd9-461b-80ba-6d7ec76a6c58", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476111, "uuid": "69a177ac-8a74-42c1-bbe2-7f086c9288f7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476111, "uuid": "0baa477e-2c87-4b2c-a330-8cd15a352f93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476111, "uuid": "ddf7e51a-e423-4d44-808f-6ece99c0e673", "value": "72be1954_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b37a28e-b974-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621519442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519442, "uuid": "d1460cff-2ebb-4344-a966-e5fb7ffece23", "comment": "Malware payload", "value": "7c0d7d62b9697fc757528feef817e08f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519442, "uuid": "2b636953-fdfe-4da3-aeb8-3df1ea048fe9", "comment": "Malware payload", "value": "2382bd5d961b31d0311130ecacb908a2a35051793640eee7b7db02ff75cf9898", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519442, "uuid": "acf3b1a7-cfb5-40e1-8c5d-3c36b57a124b", "comment": "Malware payload", "value": "233d72ec4e4510397cfe1392832a95f6d0c81567", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519442, "uuid": "a2a0053a-f958-48df-b89d-9f2e3ba67bcb", "comment": "Malware payload", "value": "3a9b6315a85b32ba7d8d147bbef5a5ab6c31d72a15d5333d650cb11998f9401fcc5439b753af9a74751c104f455f3c83", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519442, "uuid": "a32d76b6-0a33-45d5-882d-633ee276eace", "value": "0BA3CF2ABEAA89FDD60B403200485177E74CA299D951A03F2BFD05CE9C74DAD4B05EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519442, "uuid": "d9aa62b2-8f3d-41ee-bed0-3d3a264b2028", "value": "1536:2U9RP3GlrNNz0bctOwKpl6V93BWJwGiqH+A6FEVz5tdAr2lK1v+T1u0DDdC3gGA+:PtWlrLz0OkL6VTWJwdF+Ryr2qvwA0Dl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621519442, "uuid": "e9c4f7a3-16c8-4b89-a304-bd8cca80b83d", "value": 103186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621519442, "uuid": "86680580-7146-4040-91e5-f0f4d749d360", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519442, "uuid": "669517fe-1ecc-4479-b03d-bd8e39eebad7", "value": "DHL Notification.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59a7681-b96d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621516614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516614, "uuid": "7ceebf88-fcc3-4787-a699-203f2deadff6", "comment": "Malware payload (Dridex)", "value": "45195ad902e0726932fa0c40e3b8c6f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516614, "uuid": "bbcd27fa-22d6-431f-aec0-89abb504e11e", "comment": "Malware payload (Dridex)", "value": "239e2555b53c93d82fbd761f7a1f832e222afe7583277ff77f34780a18487ae8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516614, "uuid": "aa9e9d81-37ff-4fae-a14f-fdc7d426f786", "comment": "Malware payload (Dridex)", "value": "93d18ace8f26de79589f53c7ba6126e47dfcc2cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516614, "uuid": "afd36cab-e1af-448b-8b52-bdd6e2920526", "comment": "Malware payload (Dridex)", "value": "ed66516ae15328771d2a079a8ca613350ed6e55f9d313a0ff1829b5c517f4ea14138a39df9131405e0b8f4d642c7d4a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516614, "uuid": "91b32bce-53e8-499b-8cfd-2110dcb75ca1", "value": "4EF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516614, "uuid": "84711009-bea8-4d4e-b965-920c0156176e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516614, "uuid": "26d3524f-af39-4ebf-af41-83926be8cbbf", "value": "3072:JA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:J3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516614, "uuid": "20eb13fc-5eb9-4cad-a1d6-eb37a8f771b0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516614, "uuid": "06ac54dc-aac0-4404-a22d-5af321b713ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516614, "uuid": "4130369b-405d-4d66-b365-8c6931466098", "value": "45195ad9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a8a1cb-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539559, "uuid": "bc9950a3-9f9f-4489-b9b5-cd2a26f119f6", "comment": "Malware payload", "value": "c6044169295197b0ed463a2491c1081d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539559, "uuid": "8677d0bb-2f04-4111-a707-53e600509987", "comment": "Malware payload", "value": "23a870c7bcc610b938ccd4baeb0672b4bb10644b58c93022cb4b4dc402f441fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539559, "uuid": "a7cfd410-83e4-4a99-a3ca-4d46dad458c4", "comment": "Malware payload", "value": "e46d43fed6e436e3ec02e8ad9ce24b0815f41581", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539559, "uuid": "d11f4d80-6736-401b-8226-646030801c27", "comment": "Malware payload", "value": "c167949eb9de838f6d23778c7495b3853da8c7af7a54f839a0b103a2ece6f4e6c2917e9834489d1da7fe6a3e8bda6279", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539559, "uuid": "a529f477-84d8-455d-8534-f26f490bdb74", "value": "8404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539559, "uuid": "dfec9c33-6927-47ec-bb92-92c006b00ba4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539559, "uuid": "1eaec514-9601-4630-8a82-c6b337bf7c08", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539559, "uuid": "76ce0f8f-b8ef-4d4d-aac8-83364f770936", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539559, "uuid": "b50e8877-111b-4f4a-bf21-fb661c9cfc2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539559, "uuid": "ce48bdf5-9b6f-46e9-9754-5a1c83cbe1a5", "value": "c6044169_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bc4edb-b990-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621531534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531534, "uuid": "4be7bd4b-f2ab-46e5-abd2-3c7a144f0a14", "comment": "Malware payload (RemcosRAT)", "value": "f06244612507306454865882bda52bd2", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531534, "uuid": "a405b761-18b1-47d0-b39b-2cd41316b45d", "comment": "Malware payload (RemcosRAT)", "value": "23b280242da6fb79f7c6f0d82ebc8fc5c45786965f54ee12f1ee450a1627795c", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531534, "uuid": "2aef4a49-41f7-4abc-8679-fbbb6497fc67", "comment": "Malware payload (RemcosRAT)", "value": "64229bf0db3cd4d2b82af653fcf3bd035652e454", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531534, "uuid": "ef6693c9-b03c-4a55-bf2e-1025d009865d", "comment": "Malware payload (RemcosRAT)", "value": "d74fcb71301f93c951b6497497415ba92266f53becfef76747b38314f1c923052416c4a7da6aaac2f812fad8a13d407e", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531534, "uuid": "501cdca3-3495-4129-8a24-165dff4a6a71", "value": "C4F423A79687158BC583AB73038C1BDE657C0923E932A481177B9B42BB516DCD0E0F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531534, "uuid": "df3c4786-6935-448d-a6f5-01cac791fda0", "value": "12288:m1qGrU/lkWENYIQp8DBE3N4dHJW84ovWCaL6p+d7QwaS6vn9fgObbV1jvf74oTfu:m1qD7ESzSXpLBkHpQwahlHVVH7NjBZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531534, "uuid": "6609cb21-7a4d-47bf-b638-970b7499e420", "value": 750455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531534, "uuid": "2a9866e3-724e-4989-88d6-d3ef9409bda8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531534, "uuid": "c2771f0f-37ad-4534-a3e0-afa7ea24f9e9", "value": "Transfer No. 20210404 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d2cff1-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523377, "uuid": "daef2713-2dea-4ea9-a978-c24adc915da9", "comment": "Malware payload (Dridex)", "value": "afd8bf7a2075529642ce3227edd461d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523377, "uuid": "3917c2c8-1689-4538-bd97-9e9f98aa6361", "comment": "Malware payload (Dridex)", "value": "23b8394746511fa7947bb22b67a1d9a395be79578bb7379f8d45df5f2a96dec0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523377, "uuid": "8246243f-6381-4715-8495-7b663120f41a", "comment": "Malware payload (Dridex)", "value": "93a77daaf4c8769578bb64246584841f4c6da327", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523377, "uuid": "cf139cf8-c83c-467c-a6c2-33b676b0f0c8", "comment": "Malware payload (Dridex)", "value": "8a79499a0d1d2bf7024e3cf601ff1629a330eec6a4b3fd0759f26d0c2592fd5570e48f13c673c65c740f24344683c166", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523377, "uuid": "a2427512-babc-4696-8738-c0c6b0937d63", "value": "1004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523377, "uuid": "22008bb8-5686-4ecc-a3d6-8d533a4ef8cb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523377, "uuid": "6177c811-230b-4d52-9478-395eb8fe06a8", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523377, "uuid": "fd3126ff-cf66-4a9f-939b-a800309b2016", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523377, "uuid": "42501e98-e5ae-4ded-836f-ac50f12c14fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523377, "uuid": "93cb32b9-9d7e-40b9-b331-167b9962abd7", "value": "afd8bf7a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670e00a0-b97c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621522952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522952, "uuid": "cb89cf4f-426d-4243-b84d-63afc53ae090", "comment": "Malware payload (Dridex)", "value": "a625fbc5893fb9c766e249288b00985b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522952, "uuid": "a08931ff-85a1-4f08-b24d-7132346d7d79", "comment": "Malware payload (Dridex)", "value": "24101c26f47b74251012f46ac61ef1bf2cd280bba359efcb37038b067752e2ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522952, "uuid": "db245bba-23a2-4be6-bb31-68cf80bef13a", "comment": "Malware payload (Dridex)", "value": "036a426edd76fe93b5ed50130b09f3e04fff91be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522952, "uuid": "38deb1ae-7ec8-4efd-be38-1b23849875e1", "comment": "Malware payload (Dridex)", "value": "748ea110e5f36dda89f3c0a0ff631b50c936b746f5dc907a4b699675b5e03d9be1453667029f90c2c132e7616e8c82c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522952, "uuid": "908a7429-0159-4825-8d33-bab71cb62dac", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522952, "uuid": "cc67abcf-f805-4377-a8f8-2e1e1174b467", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522952, "uuid": "cc30a870-7ba5-46db-b03c-0b97c601f543", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621522952, "uuid": "499e1682-4e16-4de4-8e27-682d0d15487b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621522952, "uuid": "9ef088f1-b657-4ab4-a6ae-3b0f34c4638e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522952, "uuid": "9cbd44c0-6009-478d-87b0-75b90390c964", "value": "a625fbc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1117aa3b-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529679, "uuid": "ef2a605a-8331-4961-9646-c01a7f85e5ca", "comment": "Malware payload (Dridex)", "value": "ef5fcb7301e8e94a5664fb00caf3ae9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529679, "uuid": "7d0b0330-56d2-4b58-a9c3-f1918f734652", "comment": "Malware payload (Dridex)", "value": "242eb275dac1591e9af3dc9f1af02c2e124eb0bcd252d2997f0b5bed7329a968", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529679, "uuid": "5e4399b2-c96e-4e56-9c11-88a454d4ba3b", "comment": "Malware payload (Dridex)", "value": "0bf4260107ced76d7dcd1a1eacdb44209eb7c0fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529679, "uuid": "41e3e8b0-1c52-481b-887f-7ed2d87d82e0", "comment": "Malware payload (Dridex)", "value": "fa10e3b6b27417b960eb1c2053300bdc5c94a8997f8332b14a46eacda929024368eeb9c6caba4815f89f26f39699581b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529679, "uuid": "d4b126a6-e084-4381-86c3-62e0d556a8c4", "value": "9904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529679, "uuid": "53485371-cede-416e-8c20-01b263498e5f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529679, "uuid": "8bb9bf03-9b96-490b-995d-f287a9b3daea", "value": "3072:mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:mH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529679, "uuid": "41239b0a-4880-45e0-9115-e2389547f943", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529679, "uuid": "993a26dc-6101-4512-8aa2-8c3fc58e7314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529679, "uuid": "fbb2cfe8-1198-4dd4-8b34-1de67da65c1e", "value": "ef5fcb73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3481896d-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476052, "uuid": "26e504da-aaf1-475d-86da-4d0b6d7d1461", "comment": "Malware payload (Dridex)", "value": "7fc22304fedbb665e6ac8914e9e64b4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476052, "uuid": "3f2e9604-985f-4267-993c-9abf401c4ff3", "comment": "Malware payload (Dridex)", "value": "24490af2f44776ddcc24c0b425be24eb5e5e7f6ad6181030ae8b53e026bb11aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476052, "uuid": "3e24d73b-c7c0-4c2b-ba15-d7287bfb424d", "comment": "Malware payload (Dridex)", "value": "bfa6a74dd3301316ff0d7fe28960d2c81714517d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476052, "uuid": "219ef295-b9b0-419f-bc24-1933d59e2725", "comment": "Malware payload (Dridex)", "value": "2a68fd12cf659732c04cc2745debe28f0dd5a6a12a5ed99c13b6f535d846f3e2d252eba684549870febac00433af523e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476052, "uuid": "dca72ed6-0169-42a1-a963-065708226142", "value": "1A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476052, "uuid": "0d3749c0-b522-4700-87de-250a599a8357", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476052, "uuid": "c668e8a0-5b6a-4d4a-a798-95c2bc541c5d", "value": "3072:ki49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:kH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476052, "uuid": "d34e7864-6063-4758-a3e7-c9a2a9cea8df", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476052, "uuid": "7016c054-7347-4ef0-988f-639cc19eaefb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476052, "uuid": "138de36e-7fa8-46f8-aca2-04b972327764", "value": "7fc22304_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8ae306-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529620, "uuid": "0a0da11f-45df-4d1f-9e02-91e024b22054", "comment": "Malware payload (Dridex)", "value": "9d056375f0cf2d4e3f84d6034ff96c20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529620, "uuid": "1a56d76f-b4c2-43de-b907-917a3292700e", "comment": "Malware payload (Dridex)", "value": "245bc96e7ddf7aa4238baceeb4ae060c3800900f27947110497e132d6ba3ccb9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529620, "uuid": "61680b3c-c395-4435-a5c2-612fa90c78b8", "comment": "Malware payload (Dridex)", "value": "757810e7f39bbf58f627824f0340383c146fa41a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529620, "uuid": "4f5ad35f-cc98-4f99-a5bc-dc5f187a736b", "comment": "Malware payload (Dridex)", "value": "07187792f8776969eaa00f84843486c5f83614b1ba09f9160cb14b56ce2a8c80ceb37f268d2966e39eecbaefcaac65ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529620, "uuid": "3b99ae1d-b7c8-4b7b-9d21-20c22195ac62", "value": "81F3E141F9278CD9E893167DC33A173B51332F2E921A87F4FFE5DAE1A63492B4914881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529620, "uuid": "25eeb00a-cc20-4bea-b953-5cd2952ffc76", "value": "fc47fd76b9a60699eeca15d304e88a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529620, "uuid": "76f71d07-2891-406b-9a59-bd508154dae5", "value": "3072:7BefihU8fQ2Sob/xg+eNV1A1I3aiI8i3GdVAzuECtNjP3/3ioP7y11a0E:7Befiv/12+2A1AIpFzxCtNjHSoPm11J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529620, "uuid": "db1abe43-b68c-469f-9d38-338e15e4bc8e", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529620, "uuid": "a58697b2-7711-458f-8b07-5ff494397554", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529620, "uuid": "b94b9d43-7ea2-4e01-ac19-868cb4208747", "value": "9d056375_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91aa1609-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532472, "uuid": "447cde06-d4be-46eb-b60a-2a0d5af500d1", "comment": "Malware payload (Dridex)", "value": "9823128ef7ea07bca234cd0a1c1f82ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532472, "uuid": "cb8166d4-579e-45e5-b2c0-b3c954c19b00", "comment": "Malware payload (Dridex)", "value": "24619167e3efc212efa9e02cc353df41faaefc8e8184c4c036552a5b55ebae91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532472, "uuid": "6d59c17e-a1fe-4579-b9fc-057e5cd57797", "comment": "Malware payload (Dridex)", "value": "611a240cc18f6f12a6417fa4031dc0a3d3f1f316", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532472, "uuid": "edacbf28-f07b-4950-895c-a6f1dcfd3238", "comment": "Malware payload (Dridex)", "value": "11e3adbce0d87bf11b22f5d34085f12b4dcf8644e69c12d99640fc85e89f8612ff06186fb6d81663b0384b29ed0efc78", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532472, "uuid": "133ac54f-e82d-42c7-9869-261d16d967bf", "value": "FF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532472, "uuid": "427b2bfb-5b87-44ff-884f-14e34b321725", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532472, "uuid": "8cfad7f8-a722-4192-8fb7-2dfccfa51a2b", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532472, "uuid": "ef11a2c1-25c6-48b7-b95d-3da22c377025", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532472, "uuid": "aee3d66c-f01b-4ab8-875d-6e55fa666175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532472, "uuid": "b8e4edb3-5449-4dd8-92c5-4822b04cf78d", "value": "9823128e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5d64d6-b9b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546767, "uuid": "79b3af8b-ccf1-4d90-98bb-e2971931e604", "comment": "Malware payload", "value": "4cbb0b042f0f8677765fcb240755a263", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546767, "uuid": "57777dd9-e9ad-48f4-ae7c-b03e26e517c7", "comment": "Malware payload", "value": "246b1da9a742014da70c026af3bf69cbab6d4d193ae1a831e2518268ee18b8c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546767, "uuid": "62514707-6520-4f8b-b11e-8a13c7b952ba", "comment": "Malware payload", "value": "ac00aa8483b5047b8f0eadc87531658b23cb71b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546767, "uuid": "b19f7606-2aa0-44c8-a6e5-ba1b9d4e8557", "comment": "Malware payload", "value": "ebbbaa615a0dd0e1d24484e0ea7d8d98288e6572aa2a667722f104b7d2c9150603666ea59131f3e472e864b4bc0ee19b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546767, "uuid": "5b664781-5358-4cfd-9504-9040b0186c70", "value": "D604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546767, "uuid": "2d04740f-47f2-40cc-9169-3fce7c3a73b8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546767, "uuid": "a2202fc3-e55b-459f-b77c-ffa54283c588", "value": "3072:5V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:5V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546767, "uuid": "7d6f7c22-4018-4818-9bfb-fc5dd3a16609", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546767, "uuid": "359dde50-5528-4128-a307-80fc16bce3f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546767, "uuid": "9563e5f7-e083-4a10-933e-534e92cc414b", "value": "4cbb0b04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b10e476-b998-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534850, "uuid": "4e85da3f-b65c-4c0c-ac0c-de69190032e6", "comment": "Malware payload (Dridex)", "value": "fffe954b5b73515a852755a8ca03ec9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534850, "uuid": "79c9389f-e247-4a4c-a21f-faccc84ea731", "comment": "Malware payload (Dridex)", "value": "248ae954bf33ac389dec1803cdc71c3e019116eb4ad0593f08aa3d2ac783b348", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534850, "uuid": "7a5cda49-00a2-4f26-926b-37557641a2c4", "comment": "Malware payload (Dridex)", "value": "80d668cf90d7203e6bb80be5cf8f95bad3e7bb11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534850, "uuid": "e7c328ed-b5c0-4782-987d-bbf96c907be0", "comment": "Malware payload (Dridex)", "value": "8e2ea0d3b4d1f4923ca8201f0259ca60f299e1ee7fa7296a38ec8cc9af83b48844d3194678116d15278959f83164ee79", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534850, "uuid": "c14c6148-7664-4986-84a5-7adb5bde5109", "value": "3904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534850, "uuid": "3f50b901-8275-4358-9822-fd2a7410bded", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534850, "uuid": "95f65f24-5972-48cb-be35-ea3dc49f698f", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534850, "uuid": "ab693e0b-5ed4-4aad-b7d4-1169278979e3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534850, "uuid": "9ac7c799-d130-445a-ae5b-7cda6e83b01b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534850, "uuid": "5b61964f-5481-4ce7-b258-a77d4016d9bc", "value": "fffe954b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436e72aa-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529764, "uuid": "4c632687-3ab9-4a5c-b072-22c4cc5249f4", "comment": "Malware payload (Dridex)", "value": "c93809aa59ce28549f1b3fb9a3b02a20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529764, "uuid": "fe3e0cb5-c6bb-44f6-9d1f-8dddbde929a1", "comment": "Malware payload (Dridex)", "value": "2499d1ea525ab4a32c2c173ad1e350726660f2bfea17f9138128c4016810b229", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529764, "uuid": "f1120ddd-abfa-4731-9db3-683d9d1223dc", "comment": "Malware payload (Dridex)", "value": "9c7a7d60df3517f2f2bba0d7a24bc0571b31538e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529764, "uuid": "ef3fff22-adea-421f-bdd8-87b078b5e4e6", "comment": "Malware payload (Dridex)", "value": "d3b115ac630a9e7a1ec4b7e5c32e46eb22c13d1e052363e436b4d3259906d14e4fbf4a67c1d01e2a5c03cc5e26c16004", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529764, "uuid": "5e2e8917-4986-4c22-8e22-f9c3364a9f9b", "value": "8C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529764, "uuid": "dc5ce5ce-54a2-4c90-b800-010628addf01", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529764, "uuid": "75911a1d-a1f2-4497-a55f-ab46298f9653", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529764, "uuid": "d0665f0f-4534-41d7-9743-bf182272b5b6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529764, "uuid": "6cc64ade-4a5c-402c-822c-6a334a801c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529764, "uuid": "9e6038d9-6e41-4771-86ed-4726b7968a4f", "value": "c93809aa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52925052-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536232, "uuid": "47c8ecc0-c03e-4a8d-a29c-41c58933d6a9", "comment": "Malware payload (Dridex)", "value": "4364560564392b9ae5f094c5eb447fbe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536232, "uuid": "3ac6cd87-5093-4aad-a902-75444b5d2248", "comment": "Malware payload (Dridex)", "value": "24c5528cd436ec72a2a769c194436dfc12acbf71a1eedb569cf5be430aebc8d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536232, "uuid": "40034ef5-1b50-48f0-919a-4066c16c5d94", "comment": "Malware payload (Dridex)", "value": "fd76c9e924019a1d88ddfe2141865b0ebcb6a2a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536232, "uuid": "3d70f039-abea-4e4e-88e7-e0116522ce28", "comment": "Malware payload (Dridex)", "value": "f1539bfb206f7295bf4f0aac12e4a6a4e8e53a5f22d4d12c5aeb649a6c5aa65abbfeed5dfbe50a7c100c3da436510980", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536232, "uuid": "5f900533-3f2a-4b13-a19e-e381bcb502c3", "value": "9204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536232, "uuid": "1b71bd76-f8b3-44c6-919d-3b7d6381a2aa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536232, "uuid": "9b15012f-5122-42db-9394-63defeefe71a", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536232, "uuid": "eb7c23be-5841-4870-80d7-677a3a94ec08", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536232, "uuid": "4bf5604b-2e24-47b7-a447-7f91de8b4550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536232, "uuid": "7aa445b4-14c3-4c80-b776-e98d4eec3c9e", "value": "43645605_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345bbb0f-b9b9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621549066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549066, "uuid": "4fc2e9e6-fec7-4bf0-91cd-8ed789595d2d", "comment": "Malware payload", "value": "bbb30cf2299d3a18f9d970c9ebe19970", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549066, "uuid": "1b8cc263-ba21-4f11-a286-8d1ba982bd8f", "comment": "Malware payload", "value": "24d1d4860545cbc161336eea05317b3ffb4bc5cce01ba19bad84c473159b8c61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549066, "uuid": "8b5222b4-f477-4bc4-b030-9670859106d5", "comment": "Malware payload", "value": "38809274273e44c6753ed33169aa851256907203", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549066, "uuid": "63018aa7-b238-4347-9c52-66ed3e8d5a21", "comment": "Malware payload", "value": "336a9af6b10f8f50fa5148ff522e477ec56b26ce297c83d04689dbfa14b2b954f174ed6d543d91b25e8ebca373504ac8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549066, "uuid": "61a57095-5761-448b-8054-e844af24d38c", "value": "5404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549066, "uuid": "0dff610c-89fd-4fd8-ad59-aae5d7002ae8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549066, "uuid": "c0c4015e-2d11-4e0d-a04a-4a9565cdb5fb", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621549066, "uuid": "e37f84d5-52c8-4e99-97e5-9abad0d1f05b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621549066, "uuid": "eb427c70-5035-4870-921b-cdf5d521093b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549066, "uuid": "6bc7453d-59af-424b-bf4b-fe38162695e0", "value": "bbb30cf2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d02f69-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534256, "uuid": "64cd799f-0e77-4342-88fd-12bf7ab23b8f", "comment": "Malware payload (Dridex)", "value": "d42928ea7b58d26114eb80e9b72e0056", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534256, "uuid": "0ba590c8-0af5-4d63-ad07-eef478d14049", "comment": "Malware payload (Dridex)", "value": "24d3ce44591933b4c770fc1405d14377c03c22d744c4955e60e0d68b04bf1a91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534256, "uuid": "1b168b97-536b-4f5f-b2b2-96132a90f44f", "comment": "Malware payload (Dridex)", "value": "90ff63144258982dd5d36acabe821bdced7f55ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534256, "uuid": "9f844bf3-df6b-49c4-b350-0e68bbba8bdb", "comment": "Malware payload (Dridex)", "value": "a4d054b9c6127d1d1a631dbf89623bc764b9f163531a55123c22f5cc4a907c44b22e192562aafd8bb0d4417b6bbf13e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534256, "uuid": "6fdeed10-3bf1-426f-aa2e-11de4916c5df", "value": "8E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534256, "uuid": "1f19421e-8e42-489a-8b1f-ffea0b70ee5a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534256, "uuid": "4d2296e7-b8b7-424b-b656-07d763ce3e51", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534256, "uuid": "22fb6a0b-2643-4b8a-bd3d-113fb83a8901", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534256, "uuid": "5c23aa8b-a28a-4ffd-bd74-d314cc5e9451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534256, "uuid": "d65702f8-43ec-4995-9200-f26c71d8eab9", "value": "d42928ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928e807d-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483940, "uuid": "eb5eabc3-5772-4cd0-b157-6df42b1b4f7e", "comment": "Malware payload (Dridex)", "value": "1deedc0cf9d09a3024646ba27d2554ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483940, "uuid": "6705188c-d521-4de2-a13b-b6e4263d74c9", "comment": "Malware payload (Dridex)", "value": "250a9d880c03c0a46d0f83eff19e0f9c2483a93f2a1bccd24945604901761516", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483940, "uuid": "b4de264e-ed2a-485e-bda1-85a722153aab", "comment": "Malware payload (Dridex)", "value": "b1877ce047e0f1043426868c00f3016dd6610f6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483940, "uuid": "05493f07-52d9-4073-ad07-cb729a7338d1", "comment": "Malware payload (Dridex)", "value": "72473247dae6072173a2437bace6e003c3b547f6fce379e2bc9a6586645f6884df94aa06b89e6310e94aa3eab177d84a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483940, "uuid": "ca762241-3ea2-48b8-84fd-f8ad795cd570", "value": "1F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483940, "uuid": "556f8cfa-2e09-4d08-8f78-159e878ccebb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483940, "uuid": "9ab1ba95-1626-4721-b182-9f0ac1a9565f", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483940, "uuid": "1b8d122c-4071-4362-8e13-34e4a4e9e95d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483940, "uuid": "b4144984-f050-4dcb-864a-13a02bb1a2ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483940, "uuid": "60a6eb77-de2d-4cca-8471-5a77a2809a15", "value": "1deedc0c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ad8256-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552158, "uuid": "31ea48a2-4a1d-4267-a782-700629a150a6", "comment": "Malware payload", "value": "9c63471ef4b9b113f5241e71d0895777", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552158, "uuid": "b3ac8dea-55d3-4697-bb2c-090d01e20e07", "comment": "Malware payload", "value": "250fd132fe84897fa6566c30a629b5d6e024c9b3df5fa4eb46b47e0b6493c65f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552158, "uuid": "9973321d-f7ae-48e3-8b35-2e98f0bb3e76", "comment": "Malware payload", "value": "da74f3c7fed896634d29d83ea59d7b9efc7a6891", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552158, "uuid": "0a45e85c-a3e0-43a8-805c-16aa66043696", "comment": "Malware payload", "value": "fdda1ed58867f01f75b32a1ffbc3de5398893f529e8d36fe475263a5e2cff09162463e491920758b33423bc3b66e4450", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552158, "uuid": "4345d97b-75fe-45b5-9b44-7e77bfca1409", "value": "1CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552158, "uuid": "2c48a1e4-d0e5-4566-88a0-78c0dd57c334", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552158, "uuid": "7caa7694-277d-4626-b873-c0b60ac675b8", "value": "3072:OA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:O3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552158, "uuid": "6e009149-c053-4e33-8f3b-a44e6e1f1275", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552158, "uuid": "53f90d4f-ebfe-4e4d-a95c-8ce0b9a80028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552158, "uuid": "b158b1fb-bb0b-4f4c-99c5-ee28e5e7cd9f", "value": "9c63471e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524840cb-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1621476102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476102, "uuid": "04758ca4-858d-4014-845e-aacdde97c8b5", "comment": "Malware payload (BazaLoader)", "value": "36f95f7e28e486ef9f48990e23a71ab0", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476102, "uuid": "0ea37c78-f619-44b7-9d9e-1539c5bf8d75", "comment": "Malware payload (BazaLoader)", "value": "2526d899c4401d93b6ddba11e67e7539a9422f929605f578549a42a162303748", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476102, "uuid": "37fb85a7-579d-499f-b913-0938d2af11f9", "comment": "Malware payload (BazaLoader)", "value": "62402ee5c89da36672dd136c822b431c58a6f0c7", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476102, "uuid": "6f407496-3bd2-40ac-8961-0e65b1d0b36a", "comment": "Malware payload (BazaLoader)", "value": "944da35cd7c122f32fb3057e722b4defe38e1ec95474aa664637d724d29cd645e5fd930b08d1fe4d348608fe4dc001c3", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476102, "uuid": "92e488d9-abb2-4afd-b9ef-2e63d7c5b68b", "value": "68A45DFEB38205A4C8E9C977D3134B15F136BB9512097E662EDC42B52C3506F122EF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476102, "uuid": "c6e911ed-8eaa-4853-97b4-c344b49d1e9a", "value": "2c26945461063bcf28bd8f2f9fe738d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476102, "uuid": "2fd75b09-6384-4672-8211-13a5b2ca7d18", "value": "6144:VWPBdyiB1WUoV79AZ6pmJHQpJrsGWoyidHoL5t:VWZQCyqJwNW3ido", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476102, "uuid": "60004b5b-0853-4a70-8607-82f96f5e249d", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476102, "uuid": "8978ee14-d82a-45cb-a778-4c27cd137aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476102, "uuid": "9516f569-d8fd-4956-a33d-89212040b401", "value": "36f95f7e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81f9c96-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "ce026d42-849f-4212-8603-6ec8d3556c2d", "comment": "Malware payload (Dridex)", "value": "e6e198e55c13a22fbb41ea7fc84b9426", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "f724ff26-0c3b-4553-9b26-9bf76465561b", "comment": "Malware payload (Dridex)", "value": "252c9ba62a9b6a51654026e36f75e2610196d041b852eec5b3a55f7d82612e9a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "7b7dcafe-5861-437f-b6bf-30158fb50274", "comment": "Malware payload (Dridex)", "value": "1a977ce41c8b1e0cf5b939ea60ee8aa61fb81949", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535624, "uuid": "bba8f77f-e774-4c32-835c-09b165bfcc70", "comment": "Malware payload (Dridex)", "value": "323bfc4f4033a5be9b6566703b39fd0b1e2f9d81c680b458aa9317f9c5831997c7a2a967e8e0daf1b4f795af9e68b0d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "b7d4a288-65bf-44ca-991f-829fd264250a", "value": "DD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "b37f89bd-749d-43fb-bdce-ff3e34508444", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "9d153db2-2974-47a6-a7ff-78f62da77ffc", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535624, "uuid": "b2d68139-8a0a-452e-95d8-1e60c5a26d38", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535624, "uuid": "8560e5e4-bfd8-430c-854c-be91e95af082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535624, "uuid": "1d8e8161-7635-40db-9d48-939908cb5d82", "value": "e6e198e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147f4c17-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542140, "uuid": "efa3f9df-f1f3-42d9-9cb0-e45f9070a04e", "comment": "Malware payload", "value": "08c347cabdb37b20d87c484867655d03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542140, "uuid": "f51d4477-2061-412a-8a97-eadd45be3e8a", "comment": "Malware payload", "value": "2592238ab560cbb58134f3469244fdeac44c3b6399fcc6008ac17ddc45a344e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542140, "uuid": "cb08c097-8e43-4685-8bdc-56fcba987775", "comment": "Malware payload", "value": "6d6e2cfe22ceb5f5494543db753e05d16be685d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542140, "uuid": "38746653-d6f1-4071-8b29-3a915b3c0723", "comment": "Malware payload", "value": "64fc94c51d17a5a19e638b0415d9fb8cbe8bee0abb5e7753a7391d9f78b43fa4f8ce60c263712545a8dac1caf88c2341", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542140, "uuid": "c208b362-7f47-4b34-a3af-ed262456a62e", "value": "A304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542140, "uuid": "bc80dc8c-3b10-4c81-8ef1-dee45666527a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542140, "uuid": "9f27c940-aa10-4d67-9800-552323f25582", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542140, "uuid": "bec28981-8585-4810-9447-61943dd6d375", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542140, "uuid": "45260d1d-6428-4e42-b229-0cf367f974f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542140, "uuid": "5ff9b101-5087-4e36-82c5-51a368274c2e", "value": "08c347ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f700115b-b974-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621519757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519757, "uuid": "c9abb4ca-b606-4ecf-8a9e-6790fcfe2247", "comment": "Malware payload (SnakeKeylogger)", "value": "e936f7c19afaad2afbae8755f3c7d3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519757, "uuid": "e3ee61aa-5524-41bb-bf02-b5610ed070d0", "comment": "Malware payload (SnakeKeylogger)", "value": "25bb8ccc8dbda9140341970edadc191583abc5953237472fa97c54b06a1a7a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519757, "uuid": "6ab2caa7-b13c-4ce6-99ea-7186b473e567", "comment": "Malware payload (SnakeKeylogger)", "value": "7b78604025bb12e5befff71d79352db4d0690702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519757, "uuid": "9da5d426-08b6-480b-b58d-8d786cf71a75", "comment": "Malware payload (SnakeKeylogger)", "value": "62142d878423067009b3692c0d8f7262501c956d7fbbab6cdfa2af4db3c3271e30778922f8caf5a31b63d8296dfb5e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519757, "uuid": "4ca81ad9-94f3-404a-ad34-4a32e50d5ab2", "value": "7425C4EFBD5C719ECCF68831F9E41EA499157C7642078303707F3A99AA2D59E8F500A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519757, "uuid": "c2a46794-b1a5-4962-a59f-95c3193f2199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519757, "uuid": "cdec4607-3156-4010-9482-fe1e3eb1342f", "value": "12288:/c9jGpkQClvfoEby6S+pQ+Tbc5Uk2Cu1mKOfkaw7LQVH16wHho/EgA39ywEcvbpB:k9wA5Sx+Tbc5Uk2C2mK6Hw7ZG+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621519757, "uuid": "045024ad-a62e-4f99-8edb-590a58c62fb9", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621519757, "uuid": "f99610c8-43b3-43eb-afa8-a0a6218de1e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519757, "uuid": "1753b682-e862-4e01-b328-68d6df63c341", "value": "e936f7c19afaad2afbae8755f3c7d3b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ecac34-b990-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531615, "uuid": "7599ecba-860c-4616-8168-1de7b8087bcb", "comment": "Malware payload (Dridex)", "value": "a33d619994e231bdface61acc596d240", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531615, "uuid": "b93a036b-d731-40f6-a1ff-29d9d206cd52", "comment": "Malware payload (Dridex)", "value": "25cf14d019d16ee83f3e62e24ea544e2a037d5d553958cd746e9cb31fcc07ed1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531615, "uuid": "e66c3ebf-3e35-4526-8f18-801bd164dd1e", "comment": "Malware payload (Dridex)", "value": "ee3670402eceddb9511d6e4a70d6d1eef11318f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531615, "uuid": "28481ee9-2dd0-439d-884f-a3ee60d62986", "comment": "Malware payload (Dridex)", "value": "355bfdd20f964ff64f116cb7d82d1f65d75c043aacbe0a5bf507153ed2d218e23f4e5f5e6a081df19aae8b7d2b4845d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531615, "uuid": "ead8f9fc-7f62-486d-b746-6e5aa51c9d2c", "value": "2F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531615, "uuid": "0ed537d0-09ce-45b4-9e93-063c4df18bb1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531615, "uuid": "f58814b7-0a72-41a4-bdd5-72c544b09acf", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531615, "uuid": "e9466227-ec06-4974-b76c-44583f7fcbaa", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531615, "uuid": "a463e7f0-fbb4-41d7-8874-80828cba1819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531615, "uuid": "ca9e6525-b85e-4d61-b699-8a568ad64dd2", "value": "a33d6199_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5d7092-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537295, "uuid": "6338f4c7-28cb-483f-b4df-b464a009d097", "comment": "Malware payload (Dridex)", "value": "321e97c29cdd8a394f6a69fc4516a594", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537295, "uuid": "e86ec5c2-9e59-43c8-a8a5-75cd93714372", "comment": "Malware payload (Dridex)", "value": "25e9aa79fa4671aa09aca70bcb0cf8b4e75720b2282948f824a0c6f3eb9c7f24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537295, "uuid": "a9736cea-b238-4c80-acef-906ce82b5a87", "comment": "Malware payload (Dridex)", "value": "55188f1ca74823dd726f93646bf640aeadf50f50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537295, "uuid": "b894b63e-8662-46ad-8c91-23cc3679d34c", "comment": "Malware payload (Dridex)", "value": "a88a5eb488cf7d30ef3f33535c3d9771ed1a63b2c4084c13fc88ca7f3d8af526a8a3fa5646aadb10fab85d69e906c59d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537295, "uuid": "9484b758-efff-4a75-8956-c9b35ca27916", "value": "BE04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537295, "uuid": "31834709-a2f8-4f67-a0ae-b0ab32dcf575", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537295, "uuid": "56cb0a33-2656-4221-b775-d54e1558738a", "value": "3072:ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:jH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537295, "uuid": "87f5aa53-d2e0-4ede-a1ac-1209150bba92", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537295, "uuid": "9155f3bb-b63e-4e0a-957b-67fda693d738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537295, "uuid": "4b4279f3-1be8-4764-8d13-ea89e7ba0708", "value": "321e97c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c72ee7-b9b5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621547592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547592, "uuid": "b1659994-4d33-4ec2-b824-f6b65f9ac315", "comment": "Malware payload", "value": "1b38a3daad76d724fc3ac208c43562f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547592, "uuid": "82ee9f01-3beb-4837-8db5-b4acc8a1937a", "comment": "Malware payload", "value": "260f619a90cc677eb07d97f597a7d1ccfe16f821f9c10ac0958476c6b0949696", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547592, "uuid": "31605041-8d14-48e0-9a92-6f08964c4f03", "comment": "Malware payload", "value": "43d5bec1c46a7df903f02fdec8fa075e4d5ef07c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547592, "uuid": "e91a6f74-1e74-4ed6-98a7-ac7784c09da5", "comment": "Malware payload", "value": "ba2d72a0479ed9677c432819bfa62a0ab01d6d260d80cd4dedf0468af79e4d1ae584fd23ed65eeb2f5b3fb04671425cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547592, "uuid": "91e0af19-e273-43a6-9b08-5345e3938345", "value": "2904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547592, "uuid": "0f3052b4-e615-4304-abee-faaf4f420482", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547592, "uuid": "11b485a4-3921-41e9-99ac-d797baf30807", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621547592, "uuid": "11b33da6-a881-430d-9b72-ff5aecb06a0d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621547592, "uuid": "20a0f0bd-4021-4252-b3cd-c3239cb42b81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547592, "uuid": "37a23ac5-9c4a-4262-9a7d-d882d4697a50", "value": "1b38a3da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51109ef-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "80b34028-4593-4b44-bc37-65278f959051", "comment": "Malware payload (Dridex)", "value": "fa17f1db6d434ef9a656f85c8daf1726", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "231d1f95-2467-4604-94fe-aab72a34eb3b", "comment": "Malware payload (Dridex)", "value": "2611305452a6f79644ce6b04548cabb0ebac8cdec3698e1e33219f49a0d5a5d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "6beb246e-1bb3-44ad-8756-c4ad658249e8", "comment": "Malware payload (Dridex)", "value": "122514734e17aa7c7b5187d90ab46c628994ca9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "baec6e4b-fc22-4195-bd3c-023edea26582", "comment": "Malware payload (Dridex)", "value": "ae5408c8ab6014edd053693d60dfc7dff16e98f0e9da4527ebfebc811dbb012e5220f37b5d616cc3daf42f5e3999e042", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "1d235f96-b57b-490c-91d3-1c5b12391c1b", "value": "0904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "8be63e58-440e-46a8-99e7-5c812b270bec", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "ade4a8e4-5c7d-4321-a39e-b29842f59268", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529203, "uuid": "eaffc504-b91c-476f-8e4f-58e7c2ef013e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529203, "uuid": "2f9f09d6-64f9-43fc-a1ce-1221b060bfc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "9e440aa4-f4d5-4afc-8ddd-2bbacd594ac6", "value": "fa17f1db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec92a85-b977-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1621520817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520817, "uuid": "0f02a372-a003-4c21-84ca-7d9108b2b661", "comment": "Malware payload (Hancitor)", "value": "8c62810a160dabc85daa393f05d004f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520817, "uuid": "f9df601b-e185-4ab3-b3bb-1d65073649f4", "comment": "Malware payload (Hancitor)", "value": "262c4da734bba71878880d6e4dac03acd52770d52380ef4330e6f313dd12e4ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520817, "uuid": "40909b92-95fc-4867-940a-282546a6924b", "comment": "Malware payload (Hancitor)", "value": "d9b8daed0038f1d1fb7d9de03f248d72338a4eab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520817, "uuid": "2ece8b86-ee9e-4e78-b01e-c2ca14986b67", "comment": "Malware payload (Hancitor)", "value": "84d21f97fe73a8c0d84233e9840af0d04af882cbe447ae0fc87231412e7237beebe77b74354f842a1bf512b7f73e1b4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520817, "uuid": "055b2b6a-dac1-4969-a1df-3a055f2d965b", "value": "80B49E107481E032E57325354E7ADAF90B6CBC120F198ADB73D41EBF5E685E26B32627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520817, "uuid": "ed71195c-210d-4608-9a60-ab9348c1dd09", "value": "afbc6b91dfc430d15e529c0feb2aa550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520817, "uuid": "4387eb11-1985-4271-93a4-b7036b4c58ba", "value": "12288:fzaHESKEhitAZieq0VMk9tlLAuAcJdfJxacgNIMvr+:baHESKEhweYkTfBR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520817, "uuid": "5e1ca7a6-4242-4f9e-889a-74f51d451d31", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520817, "uuid": "a243c262-053b-490c-82fc-87518251a7aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520817, "uuid": "ed51642d-1be9-4faf-80d4-271001eec946", "value": "fax.f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c7673c-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540502, "uuid": "6c0fa239-3d46-4562-9e2c-e6cabbda021e", "comment": "Malware payload", "value": "30863694fe6e892bc6e6997432073835", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540502, "uuid": "5495fb37-1f87-4b20-a062-d84dad332f26", "comment": "Malware payload", "value": "2666d025c92dff8dbd4e06624e732f27061a152ab261e40652f25720b282cb01", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540502, "uuid": "8d40a296-6726-4ed2-b1c8-27e2c67f64e9", "comment": "Malware payload", "value": "803b5bedb4b318be481e965849ec9d70d8671ee4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540502, "uuid": "9e6eaf2a-e384-4332-9338-aff72bebe567", "comment": "Malware payload", "value": "dd3e9742dbfe1692812ed038f4f1110728e3ee45ff26bf460447e27dbfbfc8f0e73c988fbabaf38715eb8f60a84df85c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540502, "uuid": "25fcefdf-8eef-44d3-a965-ade131622954", "value": "0504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540502, "uuid": "acc994fd-df07-4eb8-8847-560e6e38c730", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540502, "uuid": "90467e23-8adb-4470-bd96-d53db69cc900", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540502, "uuid": "09ac44c9-7f51-474c-904a-d7e9a0e9cd79", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540502, "uuid": "b7b10f23-a521-4761-8bff-9788933a58dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540502, "uuid": "9e87847a-44a2-459d-be0c-ffe4ce2ec53d", "value": "30863694_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dee365-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621520394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520394, "uuid": "adeaa5c3-00db-4dcd-b629-e76c75ecd094", "comment": "Malware payload", "value": "7191ab4c053d652a90929780984f9ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520394, "uuid": "e8c3c99f-7cee-4e97-a162-2519ee989429", "comment": "Malware payload", "value": "268cd68aaa12ec554282fdc43552dc5383d1dddf5f890c8e6af50b161a46390d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520394, "uuid": "93316f9c-44e5-4a97-bd8a-997bfc4e1b11", "comment": "Malware payload", "value": "14e1b72a8cb7aed1ed497e81aba9062ffbef9a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520394, "uuid": "e09ea4d3-5780-4196-8691-ed246cd14a4e", "comment": "Malware payload", "value": "c637efad29aaa11f8935f6fa24f783f286c6db8370ba4825876840d3e4e5c2132d3789bd237d10eccae23c2aacb10176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520394, "uuid": "1ef28f83-e469-4e3a-a9e3-8d187e8e3eeb", "value": "BBF533BFC9621444C1C5C63AC656B920939E794305DFD6797F8BACA4B7F32C89881BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520394, "uuid": "f9dbf705-1411-422a-93a2-1bb7985c8daf", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520394, "uuid": "059124eb-7258-40cd-a8d9-7b10590d8bc8", "value": "49152:Td+vB+V9zP0sgHHUFLKq8Wg5+DZGmE7mntq40DWJ6VM6iOnvUrkgzEb9p:Z+veLHgnUFuqNgkDZu7mnU4FJ6bcrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520394, "uuid": "ee016285-f913-4178-a6bf-4a3b366806e5", "value": 3652608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520394, "uuid": "2c67d245-291d-4d90-8fda-f4ce3d975fc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520394, "uuid": "1bf3d5ad-da0d-490f-bcbc-843d283ce79b", "value": "7191ab4c053d652a90929780984f9ded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab27d24-b952-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621504865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621504865, "uuid": "ca3301bd-8e68-4cff-b0b7-52d4235dc353", "comment": "Malware payload (Dridex)", "value": "2e62262e122030b9a59eeca1dfe5a15a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621504865, "uuid": "3d4c64d6-768a-482d-84b3-431a18ce479b", "comment": "Malware payload (Dridex)", "value": "269f9fab9dcad324093c256f168220541c21d17ab3526cb0a699a06d4fbc12c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621504865, "uuid": "30602352-1661-4596-884a-a05c8b0b837e", "comment": "Malware payload (Dridex)", "value": "d392990503a63280deac13487f3ff78bf2c70bce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621504865, "uuid": "0ad85c17-72ce-44f0-8a42-6a02e638bc42", "comment": "Malware payload (Dridex)", "value": "50c1484e4b049b5cac215a43075764d85be16b5ba3ea618af75f15f580826eec0e3074743c6a66f6ba9a714fc5c0563c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621504865, "uuid": "42df4a4b-9215-4507-8ef2-ee9852a2f89f", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621504865, "uuid": "f698f8c1-a8e6-4c0b-b7c1-27674b3d27cf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621504865, "uuid": "69f7f85e-2132-48fb-910b-510491e6ad02", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621504865, "uuid": "7ca5cf2c-8109-41b5-839a-ffad1f8acfef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621504865, "uuid": "5ac80ed4-eddb-46e6-9c5c-b34944c75650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621504865, "uuid": "b7bf8fbd-bf51-4c08-9f89-80c3b36ce5fb", "value": "2e62262e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c60abc-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528712, "uuid": "515ce90d-6ba1-4467-85d2-3ee3c406331c", "comment": "Malware payload (Dridex)", "value": "5a57d1cacbb1f229fa529c4098475268", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528712, "uuid": "36c9d488-24f1-487c-bbdf-b7da194cf39b", "comment": "Malware payload (Dridex)", "value": "26a62efb6e01f6b2c31ad822828c0836c3fa8516e0daaf7cd970cbe841516d72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528712, "uuid": "06089a87-f5e9-476f-ac3a-1bde718f727e", "comment": "Malware payload (Dridex)", "value": "384e797e1d7f25f6f2c20eb6da1b4100404927c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528712, "uuid": "3d04e1bc-63d0-4166-b1a4-d8f229ee76ac", "comment": "Malware payload (Dridex)", "value": "0ba416fe3a1a541ac2e99d6072c18dd7ef683b199afc90583965ffdc7446ae8ab299accc3d4eca77fe716f460e5f125f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528712, "uuid": "057e7178-c6cd-454d-9fde-2f92b1a51881", "value": "3804BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528712, "uuid": "1e7df52e-8a4d-425b-8d84-ba088fc974b6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528712, "uuid": "effe0af2-efcb-44bc-a848-42c1a0995053", "value": "3072:6i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:6H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528712, "uuid": "a041507a-2f78-407d-abaf-e1422b94b759", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528712, "uuid": "240a4f5a-3fda-4bc8-98ed-032e7ffd226b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528712, "uuid": "a7e5cea1-e2cb-4af0-b2f3-c0653ea91fd5", "value": "5a57d1ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b2248b-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520485, "uuid": "4e1d94d9-c62a-4e18-aac8-b859137c1fa9", "comment": "Malware payload (Dridex)", "value": "9e176dcb2071bbd7c6fceb0fea68665c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520485, "uuid": "8f4b5b93-b107-4770-bcd9-7a91bf5f10a4", "comment": "Malware payload (Dridex)", "value": "26cca63f1fb18c67335ed4d8ea8e5f084719d17c6f91f607dce993bcbae74651", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520485, "uuid": "edcea670-867b-4556-a0c6-7b627aa81151", "comment": "Malware payload (Dridex)", "value": "b532dc0b8af85be353e94a49e674a280551b327f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520485, "uuid": "c91fde4a-b7d4-4769-9c19-5a6a03c1d58e", "comment": "Malware payload (Dridex)", "value": "b6b8bc948ceb692f7c0ef5e3986d79fbf568f9b57f797f517af2b17151778c630a3dfbfbdfd229588d3d3188539f44c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520485, "uuid": "71c27f06-c316-46ed-adb6-828fa886599d", "value": "67F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520485, "uuid": "2a1dc765-281a-44b8-a407-88c8f7a7e0fb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520485, "uuid": "112a1a2c-c955-4c32-b170-5505a7407e76", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520485, "uuid": "3e124182-95f7-4660-81ae-ecbd5460fd24", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520485, "uuid": "1c6404f1-a92b-4768-96c6-f8d88dd426d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520485, "uuid": "87797824-1b10-43e6-9771-bd8e29890c3a", "value": "9e176dcb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6666864-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529635, "uuid": "b5303cdb-bb2b-41f8-94f4-ad0573c0c56f", "comment": "Malware payload (Dridex)", "value": "28f17540b2b4f89c4880a59e7fbb420c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529635, "uuid": "31dec2b7-b128-4942-8294-99727d312b7d", "comment": "Malware payload (Dridex)", "value": "26f0aee94b4d2be06ef5f7b67de333c6d15793bb3ae240c45364839939080d0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529635, "uuid": "301e494c-a454-4010-b970-569297e2cad9", "comment": "Malware payload (Dridex)", "value": "6937590296e0b68e43470ee90043c83781118f29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529635, "uuid": "9a3a271c-8241-4bac-b635-fc4f88718f3c", "comment": "Malware payload (Dridex)", "value": "1f9ffc457d3a396a5029caace52dbdd0dd3ac745ef44646714b87104a4b41cda07fab50478bc328013ee14905057ba58", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529635, "uuid": "90ee67d0-88e7-488c-8b78-95f17c55421c", "value": "0E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529635, "uuid": "252ff18f-d225-42a1-a74d-1e533bc59354", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529635, "uuid": "82f1cdb6-1a4a-4078-941a-0cc49d00d048", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529635, "uuid": "84f9919f-0282-43bc-ad02-9c1ddee7a6da", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529635, "uuid": "31bb5cee-c545-4443-a1c9-0f09a94e890d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529635, "uuid": "90a3617c-28c1-4286-a117-7bf4218a59af", "value": "28f17540_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d799351e-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542468, "uuid": "d3259610-18a1-457e-bbc8-a0c8195a89a5", "comment": "Malware payload", "value": "3642391bed553701c4f5e5c3693d18dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542468, "uuid": "a1138494-dcdb-49d0-b12f-7fb9fc0c20f3", "comment": "Malware payload", "value": "26f386c3d5f8b77ecc1ba3590e038f9ea7ca90954604888379b53a2616aa2728", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542468, "uuid": "d7a957f7-aaab-492c-8630-86810caefea1", "comment": "Malware payload", "value": "58f51b9f57d8b992c5e9764d1d7e6c0c21379aa4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542468, "uuid": "5bd704e1-4296-41d2-a884-a47a7785108d", "comment": "Malware payload", "value": "c535a056de4b3abd157a0f255fc024ec6ab4952dbbcdd3e32afd95b103f1f28b3fb58e90abd2eb1e3a4c6d34358599eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542468, "uuid": "56a8da8d-d4bb-4cee-a89b-11d6d8037bed", "value": "AF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542468, "uuid": "07622d4e-8e5f-4d0a-be9d-4a8e8daa5373", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542468, "uuid": "ca0fc7ee-3feb-47a5-9256-361171d400df", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542468, "uuid": "44ba1d1f-76b0-49ad-af04-c34889419926", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542468, "uuid": "7122be57-d78b-4ca3-8c5e-0b38dcca172e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542468, "uuid": "78454539-aba0-413f-bd4f-5cc79f51aa65", "value": "3642391b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734b85ac-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531992, "uuid": "37eec664-0cac-4888-b9ce-0b03ccca704f", "comment": "Malware payload (Dridex)", "value": "49807225f31636789da7804be5aa1612", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531992, "uuid": "7ba2a701-b933-4e61-9c10-610cb96201f8", "comment": "Malware payload (Dridex)", "value": "27142d9fc8da780937c5a75b6d762ed2fe8dab1afb3bdca93648fbf9d854cde5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531992, "uuid": "34273e3f-7b59-4d05-827d-4401890c399e", "comment": "Malware payload (Dridex)", "value": "8c783ed064b5b4a8d9e2d01df96b8ec7a1a7001d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531992, "uuid": "b7f3bb0f-68ec-4720-abb6-7cd7f7c3bb9b", "comment": "Malware payload (Dridex)", "value": "1e354828e8007a54ab25307b07952015e54cadb1265cca74e6814497d86f11c2e278e3a163a037b6540cfa2839cc8291", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531992, "uuid": "1a12f410-f792-42d6-969d-e20ebca80188", "value": "B804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531992, "uuid": "c964e19e-e030-4785-8d52-44857288cb1a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531992, "uuid": "85f668db-583e-4881-8683-b2c1b8f189ec", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531992, "uuid": "4fb036ea-3f56-46cf-8d28-0a4cd250495f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531992, "uuid": "200b049f-e56f-4db1-b032-f6063643dd79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531992, "uuid": "b7e8a7b9-6bd6-42ad-8694-796722ff9533", "value": "49807225_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463fb39b-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534493, "uuid": "72f0c2f6-6382-4c26-95ee-75910a1e674f", "comment": "Malware payload (Dridex)", "value": "9c7a8e1a3de67bdbf889763b7c490064", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534493, "uuid": "09262cfb-74a2-4756-a761-ea96adbb4cab", "comment": "Malware payload (Dridex)", "value": "278b300683b13444367ac2b4229f73cff4b9ba6e289324c7429457aec0a8a748", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534493, "uuid": "fcf01adf-ad04-4d07-a310-725a59153a8d", "comment": "Malware payload (Dridex)", "value": "0186dfe5f03124ed0bf14d815dadb9090b5ceb4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534493, "uuid": "5d6e61d6-bc1f-4fbd-88ae-a7c51e91bf80", "comment": "Malware payload (Dridex)", "value": "647696c407e57e05ed7e4228e38df41fa49f55ccad62c3dd48a5d77ecee5e433304ea0e348e3ceccef3026a4103324a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534493, "uuid": "0f1ec522-805d-4bf0-85b9-8f927767afc2", "value": "5C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534493, "uuid": "33798735-6508-42f4-80ee-80ce42d4ccc0", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534493, "uuid": "9d12d1f9-aa31-4c5c-9c24-6511f3ade5fa", "value": "3072:ki49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:kH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534493, "uuid": "0313731e-aff3-47af-9ce2-e1f3029dee2c", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534493, "uuid": "dc899c37-0992-4a2a-b28f-19e2efbe03e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534493, "uuid": "fbcba637-ecfd-4d93-ba7d-e6717747fe37", "value": "9c7a8e1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fabd6d-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546268, "uuid": "c047a954-c554-4a9c-a175-96190d704a97", "comment": "Malware payload", "value": "e1e34e56886773aa958639bfe57ae018", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546268, "uuid": "971022e1-9de7-49f0-b1de-eb269372cdcd", "comment": "Malware payload", "value": "279b4b6f1e41dddf911c8c0f9c8a66340cc81bd7352f36d5b48790a9e331a439", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546268, "uuid": "0a9f90a0-eb54-48fb-9104-112bab9fa55a", "comment": "Malware payload", "value": "9655e46b5e70b525e9dec5ae9ce260d560ea7fe9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546268, "uuid": "2a06fd31-ff0c-45f4-8212-3d744c25f609", "comment": "Malware payload", "value": "c5ddf4bc4c2d1956e07da1da7f0363f08dbb6ea2ea771af568dd8b04bd14e1b2bb22451c54633e2d04e62a5134adbca9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546268, "uuid": "e55c1d83-c868-45fd-a110-7ee7b0007260", "value": "35F3E141F9278CD9E893167DC33A173B51332F2E921A87F4FFE5DAE1A63492B4914881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546268, "uuid": "e386fe2a-97f8-43bc-af9e-b9c74b7dd0ec", "value": "fc47fd76b9a60699eeca15d304e88a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546268, "uuid": "b04e4e0e-6588-4a13-a5e4-be54a428f7a0", "value": "3072:yBefihU8fQ2Sob/xg+eNV1A1I3aiI8i3GdVAzuECtNjP3/3ioP7y11a0E:yBefiv/12+2A1AIpFzxCtNjHSoPm11J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546268, "uuid": "525ff38b-82f4-4e59-b990-a497dc66912c", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546268, "uuid": "075381af-946e-4d67-a417-bdc5f5117063", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546268, "uuid": "f026d885-ec50-4fda-9469-600a2c1a226b", "value": "e1e34e56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513f4a86-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543531, "uuid": "a683409b-b2e2-41b5-aa56-f1254e7f1491", "comment": "Malware payload", "value": "fa3baf0ee33efe47da140ed33ce8f221", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543531, "uuid": "608f36cf-7977-4e90-9137-4848eb9d37c3", "comment": "Malware payload", "value": "27a83ec0267ed40b5dffa065cda6b693b70e6df67b9afe373bc1b9c825fc52df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543531, "uuid": "4265d89a-fb6b-42b7-b7d5-b918a00f8dc3", "comment": "Malware payload", "value": "524c944d159107f5b0807e999f81ac2bcbcea63b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543531, "uuid": "45fdc56c-e543-4dbb-a3bd-1a4aa4986470", "comment": "Malware payload", "value": "92002552cf5d13c8d4fc65a7c06e6dd6dc6dbbbab58cb8dcec60d52de4f324f3afc56bf48fde0ebc83b785dc3a3cfc84", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543531, "uuid": "fde36310-d4d4-4316-a37c-74071174ed9c", "value": "2404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543531, "uuid": "fd700448-3447-4f46-b8a3-4a5f7919474c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543531, "uuid": "797ae218-39d0-4aa9-9dde-d266d8a9780e", "value": "3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543531, "uuid": "4b1f0184-d6c8-464a-8466-40d854a45182", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543531, "uuid": "4b00e530-d1f8-4508-91d8-6e5ce2d7acc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543531, "uuid": "ead88917-1d4f-48a3-beb2-41dbd6da5a19", "value": "fa3baf0e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0585c65-b943-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621498566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498566, "uuid": "5a9dbc12-e296-4bf4-95ab-415033d46112", "comment": "Malware payload (AgentTesla)", "value": "5ead6b7071786a03767323805f527aff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498566, "uuid": "1c0fd634-9f77-4f59-b619-1ccbc2cd8af5", "comment": "Malware payload (AgentTesla)", "value": "27c11ae9a6412536ab7d4ff5cef35de451dc3e9facea2385732f6eac29a8eda7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498566, "uuid": "32ae3dcd-f4e6-4349-8bea-fcaaa92afc00", "comment": "Malware payload (AgentTesla)", "value": "2e9edd8f2a095bcce32a52d942b4c64f024c7745", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498566, "uuid": "e6a857f3-5fb8-4c8f-adf6-0817831f6282", "comment": "Malware payload (AgentTesla)", "value": "36a805c2c8bdcfdd076a691a296ec72a9b54ca2e1b457b03a310db84a1d9372f7954e5e4f7d8f6783399e9870b2c76f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498566, "uuid": "3cd7497a-b7e7-4a7f-8994-51459ca7822c", "value": "A6E4AE9C3650B6DFC82BCE72CA641C60EA61B476431BE303A45725ECAE4E59BDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498566, "uuid": "4ae0b803-e1d9-4561-940d-134d44b7ca04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498566, "uuid": "10d6a11d-593b-4368-a67a-795a1c880464", "value": "12288:Nud1oQJTX4Mo1l+V9tcJdcQ3dfnhK1ZQcJza+BWS0e3KziE04nHykTbb6CcFWrA8:NuHoQhXDcJT3dfnh+aSQzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621498566, "uuid": "97374171-4319-4535-9f5d-9484d50ba08e", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621498566, "uuid": "a4336aaa-11f1-4dfc-9f3a-1fddde35b2d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498566, "uuid": "fa58a302-34a0-4d4b-8cf2-f223d44c67b7", "value": "5ead6b70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a55ce5-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533989, "uuid": "509db83e-f15b-498a-8fac-24f82e6a7a71", "comment": "Malware payload (Dridex)", "value": "20cb64a83ce2ddd91b6184842c595ca6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533989, "uuid": "45970ad9-b2d5-4334-aa1d-898f3e4b8e26", "comment": "Malware payload (Dridex)", "value": "27c2415650e0066f9101df8df47a7d8aa6eb80a5b419158dcfc1949d5cdbfafb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533989, "uuid": "4ee8b564-eb2d-4fa2-b6cc-3ba9d84070c2", "comment": "Malware payload (Dridex)", "value": "edbe7283bf33c7eeac5ae9da83fd15c66a4139d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533989, "uuid": "190c8eaf-f9ce-4c8b-82d4-bbc90f3c3211", "comment": "Malware payload (Dridex)", "value": "0e74c45607ed60d2d8f8c49605022c060cad32a663dc9e860bcc4e1d2a7d62925b5b806d3b6ddc49ac389cd1a8938381", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533989, "uuid": "c26f459b-3144-4fa4-bf56-13756e06ecee", "value": "0904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533989, "uuid": "b5e4c8b6-4cb8-425e-9602-790d2692326e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533989, "uuid": "61f67d85-956a-4116-8e16-12bc065ac70d", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533989, "uuid": "24bb8d98-90dd-4ae0-b0eb-0635ef31958a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533989, "uuid": "24d03eff-5da6-4640-818a-c4f7e1641c89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533989, "uuid": "f385aa50-9b3f-4689-a41b-ea5a7c3889c8", "value": "20cb64a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa073545-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534795, "uuid": "52c087a6-6a98-4792-bf24-e54ffc965c83", "comment": "Malware payload (Dridex)", "value": "1f83709d83e0753a3b264bc6826f33f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534795, "uuid": "8d2a40c7-1ec8-4004-b975-c6fcd028508f", "comment": "Malware payload (Dridex)", "value": "27c96bde5a21973678691b1039666cb60dd670bc20777097f40637b1e69a34e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534795, "uuid": "7b35f219-3564-4d3c-8734-69036c1f14e7", "comment": "Malware payload (Dridex)", "value": "4e5b1225a178d96528a803c3d02dc8113341d6e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534795, "uuid": "3f80021c-4593-41b6-b2b1-314695c0f474", "comment": "Malware payload (Dridex)", "value": "56a164d785b06116f905dff97d36a5a5e46b7d453fc2ecc2af541648fb1029250adbe0102172d6e3810f8818131af851", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534795, "uuid": "0ce88b5e-d210-4d26-ba87-cf22a632e7d6", "value": "FE04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534795, "uuid": "9ddbee36-b288-41ba-9ad4-47ec5d403095", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534795, "uuid": "632444d2-75a7-4d60-a90d-d533484d9eeb", "value": "3072:gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:gH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534795, "uuid": "8a7e9953-7a86-4152-95d0-35890d25980d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534795, "uuid": "d831319d-896b-4d00-99f3-f16df301f4ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534795, "uuid": "77e8cad6-0186-416a-aa8d-2cf2c1a7d717", "value": "1f83709d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f436483-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527717, "uuid": "996722d5-77ad-41e2-9d3f-d3ce2e4bee4b", "comment": "Malware payload (Dridex)", "value": "7392b29dfeebf202ed4d272c987fe6c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527717, "uuid": "99cd8162-292c-4f54-ad94-6fa2676c1cca", "comment": "Malware payload (Dridex)", "value": "27cfe9e4afbbfd5cff4e26f2744d38bc4a8d2e8a5a58a51264d5e43cf3849618", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527717, "uuid": "6e6976d4-8939-4a53-aa4a-58e898d25ffa", "comment": "Malware payload (Dridex)", "value": "58c9cb7b9cc33572ba24b3b1a02726629719d697", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527717, "uuid": "a56d61fa-1894-4374-ab6c-d44a2a8693f6", "comment": "Malware payload (Dridex)", "value": "65d4b76f93e6bbec78fe430ba2b0908b6b715adc43bdf730b3a5adda4bd9a05fdfb0fa02ae4554197e55cb585472eca7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527717, "uuid": "14aec1bb-7841-4ec6-980c-ffebd808d915", "value": "EF04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527717, "uuid": "3f566f79-37f8-4279-9eef-fd3a3b10cbad", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527717, "uuid": "0711062e-e7d3-4089-80c7-547e7f35c94d", "value": "3072:ti49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:tH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527717, "uuid": "75a7b97d-6374-42bc-8715-56b9e571006b", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527717, "uuid": "3ffe4bd4-a51e-42ea-9234-d814e353cf7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527717, "uuid": "c9fe7619-dce7-4164-8b79-41a997ab20e1", "value": "7392b29d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cdc7d7-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540324, "uuid": "66a57fa6-455f-4099-b44a-0c3d0f0dfc65", "comment": "Malware payload", "value": "9c83338eb39c7bd76771750d096724dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540324, "uuid": "146a104e-b587-4eb1-ad3e-92664ed6c178", "comment": "Malware payload", "value": "280e1361fdca67d70e9938d4623cfe694289319e0d6abc3536541a050f3cc683", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540324, "uuid": "a874044b-68c3-4eef-8224-132398fcc509", "comment": "Malware payload", "value": "16f8412744b65c3da59d8496548bbe7aab2515a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540324, "uuid": "107e4d9f-58f5-4c20-83bd-f1459153688e", "comment": "Malware payload", "value": "95695b39f9fef5c07645c0cbf11809f7cf2598abaf3bc46863f89b5f206cf4db8abc57403e4557da669b5c9d783d3b9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540324, "uuid": "fe17b348-2260-4fb0-9e1f-966e546655ea", "value": "4D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540324, "uuid": "b1aa3db0-f32d-4653-bf21-48f94c5d7968", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540324, "uuid": "aba97f5c-7aa5-454f-9102-17e46b1b3044", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540324, "uuid": "4076c632-81c4-4dc2-9d75-57cdeafc92eb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540324, "uuid": "4c9eb721-f2e2-4a7a-a6cd-cf9d86b64b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540324, "uuid": "a6226760-e52b-42f6-80ae-03c42601bffb", "value": "9c83338e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8677a2-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533884, "uuid": "766ea294-64cf-44f2-b486-5fcb9abb1f0d", "comment": "Malware payload (Dridex)", "value": "b7c5a2ff6d2069786d1e19a8f4f822a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533884, "uuid": "d0df5f88-d8a6-45c3-a236-80c5645b55cb", "comment": "Malware payload (Dridex)", "value": "281ca7dc7a4f17e9111148d57cc92739a3a7e2f5778c1d53fba9d662484af96e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533884, "uuid": "c15814b9-df93-4305-bd2f-b617ae593f15", "comment": "Malware payload (Dridex)", "value": "36fbd5f5b2b77ca46ad0f8acaf1b03ce1776f004", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533884, "uuid": "75610bba-19c6-4fb9-8f99-bacf1f942618", "comment": "Malware payload (Dridex)", "value": "9c297433cd15b4b01f9f6c72648f9fa7e5e94f28d0125ac31245eaf4dc74127aa83df2511f9fbffa71b8c46cd4715719", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533884, "uuid": "9427b9af-e9d3-47ec-8404-fadba2547464", "value": "3004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533884, "uuid": "494c9143-aab8-492d-ba37-c7bba2100101", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533884, "uuid": "0b7ecfd7-ef0e-4df3-a802-86e14a33894d", "value": "3072:ti49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:tH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533884, "uuid": "542268bd-8e05-4e3e-bda6-cc808128d079", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533884, "uuid": "2a56b906-adbf-4707-8b1c-698796db7ebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533884, "uuid": "2884de7b-74c4-4a0a-a756-c5d4621694a1", "value": "b7c5a2ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a518a2e-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537426, "uuid": "e65d54ee-36ba-44a6-b46b-a97497783aa7", "comment": "Malware payload (Dridex)", "value": "5efd004fce573974b5f24f3a78da9997", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537426, "uuid": "3009040f-84ae-4dcb-b26f-55c634774eeb", "comment": "Malware payload (Dridex)", "value": "283ee38eeba5911af57c228c8abfba2292a0e04414a09029e36fa1018c08dc65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537426, "uuid": "be9d8770-54f6-4784-af2d-28d911c7f904", "comment": "Malware payload (Dridex)", "value": "3f357722e06d958bea7e0653ee9b8b467ebc9cdb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537426, "uuid": "4d2861f6-83eb-457e-bb51-b31306e844b5", "comment": "Malware payload (Dridex)", "value": "3f7876995221aa521133f3be250d6d93396deb17f2696529aaea4fdf4d498eb93f47cbaef37a68692d15eedcb212d129", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537426, "uuid": "b37c75ec-c616-4cb3-9016-f02a18bdfaca", "value": "FC04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537426, "uuid": "eb992ee2-8184-4b1c-b924-bb3cfd7a5642", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537426, "uuid": "613e6764-11b0-4a97-bb50-24efcd6b4034", "value": "3072:nWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:nWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537426, "uuid": "9d4fe070-e69d-49cd-be4d-f8b07b1286ed", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537426, "uuid": "84a760c6-2fe1-475c-ac49-2242aa40b38b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537426, "uuid": "2c2df508-8e75-4132-a81f-6a86c4c565e0", "value": "5efd004f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcbb690-b94c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621502508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502508, "uuid": "6aa1ab69-4ee5-4619-8c32-3ab188cf7176", "comment": "Malware payload (AgentTesla)", "value": "5f79994b00eee718b11111c7dd11f735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502508, "uuid": "96103216-6040-4015-99d9-fe12063612b0", "comment": "Malware payload (AgentTesla)", "value": "2849f8e54789388e2464504860329fc6d42ca47879cc61b8960e7297477cc948", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502508, "uuid": "fa0a202e-77da-4715-a908-2f4f8b174640", "comment": "Malware payload (AgentTesla)", "value": "8739fd497f712161747a6fdb306046a4bfc25605", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502508, "uuid": "b69d6fd4-4ab6-410a-82eb-a137bded6f07", "comment": "Malware payload (AgentTesla)", "value": "aab97d3f5a30725bdf002cbfa10fb5a292e40c968ed27d3d5c6a43866e394510be632a04614ccebe5c1d9d5d168dada9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502508, "uuid": "54dec926-3779-4294-af77-8fa5497c0852", "value": "CAC4CF2333A8E7A4E1B9A7758421921083F5F526E735DA4D7E6C109E0962FC487E2FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502508, "uuid": "b197dc59-ceed-4533-9b88-47f58473883f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502508, "uuid": "ff37e003-4e1b-4a1c-ac55-bd163624273b", "value": "12288:iF9USm3AXKzizcEh06gMOVsU7pec/evWLa5Z:iFqSm3AaziBMs8ecYWLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621502508, "uuid": "0b2107fa-593c-4e35-88f3-b4da9eea3b14", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621502508, "uuid": "db3c8520-6103-4fc9-a9bc-33e096344056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502508, "uuid": "e140b29e-d908-4391-b4c8-a5410efcacd6", "value": "Request for Qoutation For urgent Response For the Month of June rfq00735244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276e60c1-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537877, "uuid": "a569737f-8179-42d1-b35a-c1016c64d1ff", "comment": "Malware payload (Dridex)", "value": "4cf5f664189cfc2005e9320829202a9a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537877, "uuid": "fc374bdc-70cb-4450-a15f-5cb90d192eae", "comment": "Malware payload (Dridex)", "value": "289272f60239b6b94d8f14c5eb17ca07930a22d8eb037829c4b9351f400657fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537877, "uuid": "3cda0941-cdba-4c77-93fa-b952a07f1a42", "comment": "Malware payload (Dridex)", "value": "f0c4b3a00d5cab5fb649c9f400a9ec06dc41b040", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537877, "uuid": "36cb27b8-9370-4382-8aa0-6e51bd473340", "comment": "Malware payload (Dridex)", "value": "437a58c9b572b33123e1a15b4fd23b87b9059d53ffc8841989a266236ca4857181f40ad2e2de73febd1b17c082932649", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537877, "uuid": "98750ac0-78d2-4a57-a6d3-7fbbd581d6f4", "value": "B704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537877, "uuid": "6739b62b-799b-4bba-ae33-832f0f8509ac", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537877, "uuid": "a6ddb52a-b5f2-4525-8422-95e9b1e1551f", "value": "3072:ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:jH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537877, "uuid": "55d37a13-d3a0-48a0-b93a-bd76bf8347b5", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537877, "uuid": "c324fced-98ff-4a5d-a8d3-c8b3fa2558a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537877, "uuid": "47602efa-893c-4521-8a68-950a08f0c01a", "value": "4cf5f664_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de501d47-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621534319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534319, "uuid": "1c72e894-a9aa-4c36-b0a5-d9700fedd713", "comment": "Malware payload", "value": "30040724c4b83ea4b25eccc1501c40d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534319, "uuid": "a9f67a8a-ec4b-433f-ad1c-364c855ebcf3", "comment": "Malware payload", "value": "289e754a2cf583d9f99c47497555cc32130db6dc115e5bdcc18498bc23fb2f2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534319, "uuid": "671e9142-a56e-4164-ba63-06e1be7a373d", "comment": "Malware payload", "value": "d42f391a132e1fea675572feca450d3ad17fd2fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534319, "uuid": "02d16b0e-23e4-4589-a48c-df7aeb63d18d", "comment": "Malware payload", "value": "709a695a5a0ecd4854622ecb0d949d60c2a2c03987b447d2c859857c80ee49d41deaa3fe7891692c389e361e1035cf57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534319, "uuid": "d194f5c1-c43d-42fd-9ce9-9495411cf5d3", "value": "4EB53320215D6F46F87973BCE805812217F1D414CB7AF62CBFAA969A0DD2BBF03B5509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534319, "uuid": "9e28bd60-859d-4d40-8aa0-c162b4fd3316", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534319, "uuid": "65844a14-0998-4603-a229-f74b92b5c731", "value": "49152:jxMCrKilUF0RYhdCf3fO3QE8d5x6rV+sxOj1XP9GnlC3Srn29GX+9Zuz:CCrKWnl6rCGkSrB+98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534319, "uuid": "c18b06ad-4520-43e2-af37-7bdfd021228b", "value": 2442752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534319, "uuid": "b6ecc64f-5b3b-4b5a-bd3a-ef27b1260aba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534319, "uuid": "82ad6eb3-8589-42f6-b2a1-5c1b782fc6da", "value": "swift_7864345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b01dbf-b981-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524931, "uuid": "cffdb1ab-0e4d-4401-ac1b-2771e8e586ab", "comment": "Malware payload (Dridex)", "value": "7b999f483778ed9f02a3baa07aab9d6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524931, "uuid": "31e9fe74-bdfa-4aa3-a27e-f745bbc202d3", "comment": "Malware payload (Dridex)", "value": "28ab63caa28a20542d3a2f0e123152a87c28c3c20feb2aff1054f7153a713d63", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524931, "uuid": "ba3be032-45cd-4607-b1f2-8817f670a153", "comment": "Malware payload (Dridex)", "value": "5998282779f746dc5aac1016246903147815a4a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524931, "uuid": "d82d746e-8801-4a60-b64c-817c89305b00", "comment": "Malware payload (Dridex)", "value": "ab21fd0b471bb1abe636f7bc951664b1c83c4b71f732852256887364c739be415cbbb79fb973d58aa29052ef9eaaa6fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524931, "uuid": "c08c2307-c1bf-4650-9dc8-bd6ace7a5b73", "value": "C004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524931, "uuid": "b4a80a2f-cf21-45d3-8e34-b9e7429b868e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524931, "uuid": "a9273c13-645e-416f-860a-e8beebf65494", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524931, "uuid": "dd27f445-a4b7-498b-9e41-e91c64024d47", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524931, "uuid": "36fcd08e-425f-4b90-b40c-302c05afa99c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524931, "uuid": "8e71f677-3991-4ef4-8dec-86cba82f5b5c", "value": "7b999f48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785aa0c3-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621486903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486903, "uuid": "5823cd4e-0d2e-49a8-a9af-2735396e3c1d", "comment": "Malware payload (Dridex)", "value": "ca187bb768201c80d65cefd61e2b268b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486903, "uuid": "99eca5ff-b02e-4bdf-bf6f-a4206dc6349b", "comment": "Malware payload (Dridex)", "value": "290076847f808a500bfa0ce8ebe70017a172add50e8e94aed505147187293bf9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486903, "uuid": "7b4decbf-eb8d-459e-88d8-a9824b174625", "comment": "Malware payload (Dridex)", "value": "08868bfb760d5ca68058ec104a1b4eaa0e3367e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486903, "uuid": "b64c26dd-0587-4f3b-9d5e-94190e95383f", "comment": "Malware payload (Dridex)", "value": "19324e52fdda333947c11cbd1bd589d4d329039dfb3d6c3010276dbcae9d258e291ab87047801735fee6f190d24d432c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486903, "uuid": "ddbd30d6-b7a1-4fbf-8de6-cdc5c00624f9", "value": "AFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486903, "uuid": "bd86a340-bc52-4762-bd56-a9670e13367e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486903, "uuid": "471891eb-f1e5-4473-a69d-8afe38580377", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621486903, "uuid": "6db08983-e280-40ef-88b7-edb1d0f60459", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621486903, "uuid": "5a0badb2-433b-440c-9a09-fba8eab22990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486903, "uuid": "442f8b3f-935f-4603-8a82-afb3052f41e0", "value": "ca187bb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f30567-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "f0b1bf47-3b7c-41eb-baaf-9b7f6fbbd74d", "comment": "Malware payload", "value": "cf78909df535e33ce1e9216425fb6a1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "a2ff1348-60ff-4c7d-af03-952e68d6ea96", "comment": "Malware payload", "value": "29029bf307e00639f1cccb2bc5eaf6af9a1784efd433265ce8791bdca5d5d486", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "18dafa09-7159-40b4-9fc3-1461d04b0804", "comment": "Malware payload", "value": "d4a057d71131b4cb4b3cb5e1b2a7072daee30808", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "2a7c3bdc-f124-406f-b5ce-295598d35364", "comment": "Malware payload", "value": "c0052a2f113e7c291f6b4b8d1f05eaa67fbd3298c181f07ee6dd18b85a967e3ed1253f626f4f1e006722760a5493441d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541249, "uuid": "fe81fd2f-5480-4c5e-a495-441ba1258be5", "value": "3704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541249, "uuid": "8cb06290-a666-440a-aa21-1f3153eeb18f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541249, "uuid": "fdb6327e-ca9e-41f2-a84e-fee7ad7a75d0", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541249, "uuid": "df369db9-b649-4a73-952c-80bb4e4ffb99", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541249, "uuid": "b6ce4558-d1a3-4b84-b0d1-73b9d8966ba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541249, "uuid": "75b61671-6921-4bec-a9e3-7e55ca4fbdfe", "value": "cf78909d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b22e2e-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552283, "uuid": "c8fc209b-3708-4a7d-8cc3-c94606103cf0", "comment": "Malware payload", "value": "8c2ce87adc06bbebe4cc9c3d90600c81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552283, "uuid": "d8ecb336-fd03-4b29-a7c6-5a9f33f5531c", "comment": "Malware payload", "value": "299e5b0a8db1583550d173c7a38df668452931d7c38900f5eee4e68647900a02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552283, "uuid": "f879bb88-af74-41bc-8fba-da87b317d189", "comment": "Malware payload", "value": "612ed84f458b9d8ae0b517a7c51cf54143d52837", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552283, "uuid": "279c0c28-625a-443f-be32-c9fca3544c67", "comment": "Malware payload", "value": "a6f958f91c8828cda329bf8b733ebd820c9e23307b1f2903b33efb1f78590256b4cd70801b39d9f688e22d242214650a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552283, "uuid": "746b029e-d4cb-45ff-a47d-00b1e43d3ba0", "value": "7F04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552283, "uuid": "40195a8e-0a28-4fc8-9976-f1706ae144f3", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552283, "uuid": "cea3c80f-5d8e-4fb8-8b5e-a53782d713ed", "value": "3072:TqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:dVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552283, "uuid": "c8c67c3e-7508-4437-9e3f-65c994e30685", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552283, "uuid": "a75e2cf5-83b8-43b2-82de-61872c91e8f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552283, "uuid": "d8cf7e37-c420-4974-bcac-df04bd95cbad", "value": "8c2ce87a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4c7276-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527690, "uuid": "54e448ea-3044-4d4c-b6b7-1951a4de566e", "comment": "Malware payload (Dridex)", "value": "ea62272bc1272e6b02e57a39a7ee45d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527690, "uuid": "c6935721-5686-4ae2-b70b-c639e745ce2e", "comment": "Malware payload (Dridex)", "value": "29a9b099e8f3a1170054b76ecc526a28d91adf8418600537e8c0788d16baa90e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527690, "uuid": "9f27f228-d154-4b33-b417-d30c9d808bd3", "comment": "Malware payload (Dridex)", "value": "0a16aba6fb12c10d8429bb18f4e72b5a3446ad04", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527690, "uuid": "64e29965-1e2f-4317-a514-f547f3bb26fd", "comment": "Malware payload (Dridex)", "value": "58a90123843fc359b6cbfd0b7805af878fa832e5780c7691f360d19f723c1056046021f660d63c2248b77a9ac2f78fb6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527690, "uuid": "36ba6c07-8514-4663-860a-3422b3a3a962", "value": "9904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527690, "uuid": "9f76aa1e-cae9-4302-b159-56b952cf3fd7", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527690, "uuid": "12c71642-ed64-4eae-b7ec-70c11459e360", "value": "3072:Ui49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:UH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527690, "uuid": "eb53902b-654d-49f8-9f84-dc348f1561ac", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527690, "uuid": "1700c84f-d0fe-483d-8ced-5ce84cc9ca66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527690, "uuid": "a7b8c9e9-ecfd-490a-8558-3ebb9e8dd992", "value": "ea62272b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e15eb8-b9aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542794, "uuid": "748a152d-7703-4a63-ba25-4f99201093cb", "comment": "Malware payload", "value": "d0786ad778073f85aa899b551b5681f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542794, "uuid": "7f99e184-508f-484d-ba33-2c05d54e6005", "comment": "Malware payload", "value": "29d627afd4f2713911edf9ce3cb8a86503d792ec46e664ebd2d5353245b447f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542794, "uuid": "ac40801e-4e36-4df4-a763-6f6391c5358c", "comment": "Malware payload", "value": "aa085aac9f5a597c4f4c46a8026ff9a8b51e22a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542794, "uuid": "fd6f5f4f-5f1c-406e-9d45-ced5fc675f3d", "comment": "Malware payload", "value": "6545297f9e74c54fa335d8c29a3f71764ff5ccf6113fd41b021efe44ced5e8b40ffd21e5b5716d344533ed6c6ebe977b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542794, "uuid": "70dc854d-3b6a-46dc-8e54-8e7c4f9563df", "value": "F804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542794, "uuid": "7ee58b5b-d789-4ad5-85b8-b4afbfb9dec8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542794, "uuid": "d647c831-7116-47ff-84b4-adea618fc9d0", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542794, "uuid": "4dfe5d4f-3123-496b-a480-307281812959", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542794, "uuid": "2536e010-2c02-4f35-b34d-3873bbccd89f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542794, "uuid": "8aa1ded1-c073-4cda-a761-7e99af14168e", "value": "d0786ad7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0aa8d9-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533991, "uuid": "64c906c8-fc5e-49b8-a6d8-5c6f85c4ea7f", "comment": "Malware payload (Dridex)", "value": "e45f0be5d7649e2d1aa163039d2a7552", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533991, "uuid": "fb3d217d-293a-46b0-bf7f-62b96ba3917c", "comment": "Malware payload (Dridex)", "value": "29d74ce46c96442630ae67bbf22cad7e206eded18e4ca2d720d5e43fd5afc69b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533991, "uuid": "301bd48c-041a-42f0-a609-50c5ea655395", "comment": "Malware payload (Dridex)", "value": "85731062fce28e9ce761f5cf9498cad5431341a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533991, "uuid": "aba7eb3d-f9c3-4100-aee0-b77bc9e8616a", "comment": "Malware payload (Dridex)", "value": "5d016f10a10bf2296c0911780a51b1d4010228596d5044048f0e69accf22b37fe549cccfd4ec13ccc4c4bb9741ef9ea1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533991, "uuid": "05c4da94-f86b-4fb8-ad4e-e43eac742b6b", "value": "A504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533991, "uuid": "d9e14218-5f5b-45e3-b8d1-76be00b281d0", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533991, "uuid": "768140b6-5ca5-4154-9079-9cd7504f163a", "value": "3072:Ii49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:IH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533991, "uuid": "b7775b9e-1e28-4770-9bf6-f0c93178b1c8", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533991, "uuid": "f7866013-16fe-41f5-8392-4f9127751b28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533991, "uuid": "8ef9910e-4e73-4212-8719-760aca2a1afd", "value": "e45f0be5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f484839-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483425, "uuid": "6ee8f7b3-43f5-4852-8e77-6e9991fd3cc2", "comment": "Malware payload (Dridex)", "value": "422e2f4c058aae33d39e564c0a7ba61c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483425, "uuid": "1c5d9b2c-b185-41e9-84db-8bcae1f0aa16", "comment": "Malware payload (Dridex)", "value": "29e7a5fa155b6852d5950fffc700943207c6437df97c3fd3dc9d4ad9c51768cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483425, "uuid": "6d4ebe6f-5291-41f3-b640-13704e4851dc", "comment": "Malware payload (Dridex)", "value": "275d60a1b1ba2b5b2144d458791245e88cfeae74", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483425, "uuid": "c3a18b81-3f7d-4f64-b107-3ef98df058ea", "comment": "Malware payload (Dridex)", "value": "0955d5635ef21341167535f440f7258a7e145f4176c0f83fa2ea39f1050e5182b174c8b354d1c5688e0e0c58dc73d8da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483425, "uuid": "e7f69ec2-1fe8-40fc-93a6-3639d0be05b4", "value": "0004D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483425, "uuid": "57b5c8fe-d186-481d-a6f0-b08ad9f7c875", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483425, "uuid": "1e79b590-f7a5-41a6-b41f-1c374ac823c2", "value": "3072:8qWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:qVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483425, "uuid": "74018101-5b33-4da0-9abe-7085b833cb64", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483425, "uuid": "15802414-259c-48b7-bf40-271a97e5d28d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483425, "uuid": "1d8a9600-4f92-4cf5-a840-4a093d45cdfa", "value": "422e2f4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caee963d-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533857, "uuid": "2ce76c28-5795-4460-a4f5-cde1d7bc29d8", "comment": "Malware payload (Dridex)", "value": "579b33733f8ccbe1a876b7485ba8bc2c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533857, "uuid": "6575bd2a-8a41-4464-9111-e0e8a8c1ab92", "comment": "Malware payload (Dridex)", "value": "29fb470ef3728e95c765a55bac9e21904a5a46a0eb349b0351841d37f86d57b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533857, "uuid": "600b0ca8-12de-423e-87ea-94cdfa2f2ee3", "comment": "Malware payload (Dridex)", "value": "f3a8a9b7b4ec924d399c22238a70d70ac42341f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533857, "uuid": "d586ff2b-d0d5-415a-a3ac-3d830273c1b6", "comment": "Malware payload (Dridex)", "value": "d0745777f796c0a705c51aacbfa109ab4cd2498f9611a61342019977457595c48c0b8f5d9f289540d19b44d9516490f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533857, "uuid": "3c991d0c-bcf0-4041-bcd2-dab3a7e6c8f6", "value": "3804BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533857, "uuid": "5f3fd5bc-0b83-4e78-9494-1937cdc69b49", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533857, "uuid": "9912eef1-86c3-4877-980c-eec9b543679b", "value": "3072:Hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:HH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533857, "uuid": "af2c3b56-935f-437e-8461-c0d6369b2802", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533857, "uuid": "0f5c3c66-1fbd-467d-9958-aa4a798650ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533857, "uuid": "2b1d2a64-fe7f-458a-be7e-b269e49b0e6b", "value": "579b3373_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78405e3-b942-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621498149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498149, "uuid": "d3a885f0-406d-465f-9559-b876020f4add", "comment": "Malware payload (Dridex)", "value": "c389608ec63d30c2d36486bd7db8668f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498149, "uuid": "0cff546c-96f8-4d4d-b804-17494e1ac7c4", "comment": "Malware payload (Dridex)", "value": "2a028fa5ab6d0615c2d6c33793b39f12bb09ff196e07bf1801d6e7751491d7fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498149, "uuid": "d4451e26-e8ad-4d78-ba55-c5339b22b3c6", "comment": "Malware payload (Dridex)", "value": "92774095c7c635c27750dadd1a5bcaab89741711", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498149, "uuid": "ec9fe82d-1e39-4dc2-b0ff-b0aaf57e4525", "comment": "Malware payload (Dridex)", "value": "a32af85da61d55297694e71bc62700d2085c4657e93d4c6ebc0fbb3d6eaccb08941fb856c22ab592df8a7e002d6b7419", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498149, "uuid": "a826593e-e5e9-44c6-908d-8c9f160ba920", "value": "56152A65B694CB26D6670E310CAF8ADF2339AD40CE7183076E9FB70E2E3639C9452751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498149, "uuid": "b02fe3d1-7cbe-49d0-8386-40ce207821af", "value": "6144:Sk3hOdsylKlgryzc4bNhZF+E+W2knA1DYJgTq4:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621498149, "uuid": "84e66ce6-87d6-4504-aff1-5b58d95a1bd5", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621498149, "uuid": "ac65f523-918c-4144-9249-8c86f3c5b8dc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498149, "uuid": "60496000-4348-4dcc-a782-b1cd571ee45a", "value": "SecuriteInfo.com.VB.Heur2.EmoDldr.14.6875DE7F.Gen.8007.1620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867f59d1-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468888, "uuid": "bdb090ca-80ed-4355-93f2-c543322376aa", "comment": "Malware payload (Dridex)", "value": "5fe6b6cb692755fe9ee33c44ee06c4fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468888, "uuid": "d730fe59-1d0b-4330-b16a-52baffa9b3bc", "comment": "Malware payload (Dridex)", "value": "2a0abdd64a1d62ce77d52d7bdc80782eda92edacea44b625ca4e5fa1eb65679a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468888, "uuid": "88e891e6-6dc6-4ff0-85b1-c587f7c4835a", "comment": "Malware payload (Dridex)", "value": "55477e19fdddea875074dab7e8cd005d2c9925e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468888, "uuid": "3e9b790f-3eab-46f8-8437-dec32a7ffadc", "comment": "Malware payload (Dridex)", "value": "696a9fe67d1389921c17e8bed67b7c8feec2a6083989a5a6ac5391b1017b9bdc9006ffd3046a1bf69706d4e683f636d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468888, "uuid": "3b346161-68b4-4256-ba35-86f151676fe9", "value": "33F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468888, "uuid": "c14b86fa-85cc-4204-8c51-d4fac761d974", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468888, "uuid": "39ac4e89-7f1d-42cb-8ede-127029a71670", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468888, "uuid": "44c38b8d-2246-497f-a63f-8f3b44e7dbe9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468888, "uuid": "7ab362de-d306-4e69-9f24-8eaa63dc662f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468888, "uuid": "c5174233-c075-4442-bd88-70cbf14c3d60", "value": "5fe6b6cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8586e819-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529016, "uuid": "e9e9b7a3-89ff-4e36-a6b5-25a9b81e01f3", "comment": "Malware payload (Dridex)", "value": "5c7958500458b714f72176722648d5c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529016, "uuid": "dbf86cb7-b3b0-4ff0-b80a-bb72bb085244", "comment": "Malware payload (Dridex)", "value": "2a124c0412f145a28a726aaf6a94d5e71a79942072b5154b1386bd17c5279e79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529016, "uuid": "d1541d0c-bd49-43ab-817b-13406ff7ad8b", "comment": "Malware payload (Dridex)", "value": "fabe26924b7f396a2026d71b40e66c7f3a473477", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529016, "uuid": "5f912117-b28b-43c7-829d-1758b223d32a", "comment": "Malware payload (Dridex)", "value": "2e612693bfd59467aa1df44abd632bff375f2de870fe3d01757ef575745a3a8c76ffb526a7dfd72ef2845fccff795fbf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529016, "uuid": "a4d7f66e-6888-45f1-bc85-caf8685ebbf9", "value": "6704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529016, "uuid": "e4269add-83da-455f-b18a-9a9f3dda8158", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529016, "uuid": "fa726baa-cf4c-4fa3-9424-889d89c067a2", "value": "3072:SV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:SV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529016, "uuid": "c5a725ef-c6d8-4cfb-9262-543a2a077823", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529016, "uuid": "2e84c7c1-8048-46b4-b243-e21091ac118a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529016, "uuid": "d8dcc671-0eab-4336-bfa4-7a51254e0785", "value": "5c795850_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337b3b60-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531885, "uuid": "5f58a570-a637-44d7-99db-565adb45a4a7", "comment": "Malware payload (Dridex)", "value": "c6a3f2ded7d5fb7688e911487d409a84", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531885, "uuid": "75d9def0-a50a-4839-a789-6ed305d0ebba", "comment": "Malware payload (Dridex)", "value": "2a1fc5a1e575ec39e6a6fcf3ed52c2f8da16517ce79363e44ddca5fd2cf930a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531885, "uuid": "40c1aa78-9b43-4288-8426-e1dd06745a7e", "comment": "Malware payload (Dridex)", "value": "49d3c1f4117fcde8e45130bdd00d883e6971f44b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531885, "uuid": "2c028fd3-9c40-45dc-bd9b-4e67251bdabe", "comment": "Malware payload (Dridex)", "value": "e1ff135429933f08ace286c40389b21a2705ba5c6ff879d65f6d71c6206549432f24169471a3d07c1e31b2f64409a960", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531885, "uuid": "1f528cd9-f286-4fd9-96f3-f09f2af53b36", "value": "EF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531885, "uuid": "bcb95eb7-87ad-409d-8f10-fa3570f80d85", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531885, "uuid": "9df20b98-e06a-4133-a933-e763e76b85fb", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531885, "uuid": "cbae8d2a-a9b9-4303-93a2-ca8a3ad0e2b5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531885, "uuid": "55274bfe-6675-4e39-ac5f-c2a90350a849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531885, "uuid": "cee5ba47-df35-4411-b631-393a1ca48d0d", "value": "c6a3f2de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41caf280-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621520312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520312, "uuid": "b771804b-5b7d-46bc-9982-4b4fbe45d76a", "comment": "Malware payload (AgentTesla)", "value": "2e0aab0136479d56aa5d9c578f7beda2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520312, "uuid": "c6df2c63-7ca6-477b-ae91-1e8c9ba65fa4", "comment": "Malware payload (AgentTesla)", "value": "2a2c207fc0cce7faa6a354f6b35c905aea9090c3e09410f38ed95ed13709bc9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520312, "uuid": "53a7441d-65be-4d76-a8ae-110ccc79591f", "comment": "Malware payload (AgentTesla)", "value": "a6914be9267576fcaf96562402f61907ba10ac3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520312, "uuid": "6ee0e83f-79d1-4079-a228-5c69085f0755", "comment": "Malware payload (AgentTesla)", "value": "d2111668104bbc7865a65a04f6f091c7d3999118af61028b15171c0f3ce9fbce070346a6c0381648e09d4803a8a17e2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520312, "uuid": "f9a156a5-3b42-4c82-8aa7-fd01ff67ef89", "value": "9D259D122AA4679DF13F83356920041493F0AC07DF2ACB4DFD96B2EC1EA53D28A57B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520312, "uuid": "02c0f853-f53d-4026-9dfd-f7d71e848599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520312, "uuid": "131451f6-11d1-4940-afb6-0b92ac04d693", "value": "12288:IVCQYr/lKr3mAtUV/itPeu4J+LSVNPmpZbTXARKR7xxlbkl1TpEflFIT3eCWK2+C:Sirwr2EQ/itTEPm7nwE7xxAvuVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520312, "uuid": "8164dcf2-93ce-43aa-a4f4-2f302bcc4ce3", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520312, "uuid": "d9914ad9-2c00-4877-90a5-97efe7c47720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520312, "uuid": "c7351356-df62-48f5-852c-3ef921e84605", "value": "2e0aab0136479d56aa5d9c578f7beda2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1077a746-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532685, "uuid": "f424ce5d-d5fa-4ab3-b331-0d5629b0b1f5", "comment": "Malware payload (Dridex)", "value": "9199ce0ef2399e43d705e0c48540666b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532685, "uuid": "f6c47363-32c2-4b6e-8a17-fe99700c81ba", "comment": "Malware payload (Dridex)", "value": "2a3dbf58a8563bf4ae5e6e4f85c86e18aa219a7e31ad70c171156c6a22f76c3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532685, "uuid": "44035bce-babb-45ca-a07a-7d5052947c71", "comment": "Malware payload (Dridex)", "value": "93a3f47f87f8db96615a4142903634d69cfcf0e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532685, "uuid": "26b9ee2b-aa77-403c-9c25-9da0ef2cd5be", "comment": "Malware payload (Dridex)", "value": "15397996eaf305b75152fc55739a34c4e0993216e8dab6c08a60d524e343e48849fcb5c4cfba493009e344e7d33fd60a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532685, "uuid": "c1f80d34-55d4-47d0-9ad1-216834a9d758", "value": "5504B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532685, "uuid": "af2da56f-3c59-4981-bc12-30275324a9a4", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532685, "uuid": "51db1819-92f8-496e-b3da-84478de33d31", "value": "3072:KWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:KWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532685, "uuid": "505e6f82-6d0b-4762-af70-57ebd6bb794b", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532685, "uuid": "ca84d577-2423-4c26-98e4-a45004435d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532685, "uuid": "57bf787e-ce09-46be-a66a-8717d1041cec", "value": "9199ce0e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ad85d3-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543572, "uuid": "ca7a1316-f9d6-4d26-8f20-6df1c203b9a0", "comment": "Malware payload", "value": "c53b33ab6647a6ecad5eeef7f49b2f6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543572, "uuid": "b21c0387-3eea-452e-b74a-3c8f29ab56a0", "comment": "Malware payload", "value": "2a3fde6a65c27b585230b04cf9814972f5e8e9669b455408c73dacf168a37c8b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543572, "uuid": "ccb533ed-3d9d-4fd1-bd59-24b8b205564e", "comment": "Malware payload", "value": "f509b997618aee105be3b5738350bbeb4a0c703a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543572, "uuid": "07b4d4f6-db2d-459a-a6b3-60db095fe9f9", "comment": "Malware payload", "value": "d32acc28c341c93d9439b9890854c24d149539fa52755226e60438f5ae0540bd278c6a43cfa2c86abc976293ca04e389", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543572, "uuid": "d079a9b5-0d28-4052-a08b-adbf26abd354", "value": "6304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543572, "uuid": "b47f9430-e17d-49c3-aed3-e924e86c9246", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543572, "uuid": "ca6d2f61-6efe-44bc-a291-dc99c7d6a4f6", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543572, "uuid": "b58fe73e-93d5-471a-a62e-e3ca36c96f03", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543572, "uuid": "91c6d665-b85d-47d6-89ae-5585ea94cd4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543572, "uuid": "d745ac4b-edea-4093-a700-0650db492497", "value": "c53b33ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66c024a-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539513, "uuid": "9e3e9c0f-1e79-45ca-a5df-75c0b04fc588", "comment": "Malware payload", "value": "43972e218e71229ca3a9f5fa823e3db1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539513, "uuid": "f4066ce2-53b0-4184-8dda-1873460c3251", "comment": "Malware payload", "value": "2a8afa31b006da8f34501140cce7ff924304f2f4451f1693d1119c8c6ea9f218", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539513, "uuid": "4a0da6de-004f-4cbb-bc8f-b6c8135212f5", "comment": "Malware payload", "value": "1e90b9e79a0b63a4662b58e4464ea90e12cf0dd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539513, "uuid": "ea4769e0-12e8-4150-a99d-863fb6dec729", "comment": "Malware payload", "value": "961b9c9d99cc5c488080363ecfa17d62ebce1726e636c63f5e00d4d06a09a0fddae365e7fe75b6970c3fdbf83ed4684f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539513, "uuid": "d2a2ea9b-d601-4ceb-a86e-2026a8e61375", "value": "8104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539513, "uuid": "c382c275-1666-472e-8227-6b6701c08102", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539513, "uuid": "82ed77c5-3f7d-45d9-a1eb-73d9cdc0c27f", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539513, "uuid": "328ee0c7-4f82-4256-b28d-745ba8c8125a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539513, "uuid": "8e4cee06-73b8-4a49-8ac4-07eab0d6e420", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539513, "uuid": "547cb6d0-615d-41c3-8f74-ed4f4c63c61f", "value": "43972e21_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f2013b-b978-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1621521254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521254, "uuid": "079de2e9-0fc2-4001-8c2a-b1d792a9e826", "comment": "Malware payload (Stop)", "value": "b1363351ac7310f4e6bea75ff8617c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521254, "uuid": "a76eb661-8059-47ec-85f7-af076141dcc0", "comment": "Malware payload (Stop)", "value": "2a8f13cc0d990ecfd9c2a6f3120b97bc9faa27251e54c1d2e27f80453f29f60a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521254, "uuid": "89e6742c-3dbb-454a-a091-e0b91cc0a394", "comment": "Malware payload (Stop)", "value": "195439c15e7af0279cf946cafce09a021270d736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521254, "uuid": "23a68c3e-af5a-46e1-bc24-73092d5480b6", "comment": "Malware payload (Stop)", "value": "82093d4823e6525a7ad82d92514a3a38dd69eb3102be67d1e51a9a3f8162778120d775aacea03b369a8cc7750b765e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521254, "uuid": "a8943886-c1d5-4196-a0e6-bc0116374027", "value": "2805F1206691D031F9F722F48AB5D27D663A7AA12B3480CF22D41BDE4677AE4ED30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521254, "uuid": "a0ef4891-6c3c-4841-a993-f53073603a4e", "value": "b7513c9180d9c4b81797d95ecb76f0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521254, "uuid": "9245cc43-c5c0-4308-847b-454e47290926", "value": "24576:WjjitWwPC8bc9LeLNqyYIxFOYJ0MI4TfzwNpt7o:WXwPC8bc9cYEas3TzwNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621521254, "uuid": "02a5519e-7d95-4135-a2f2-aed9e4f42002", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621521254, "uuid": "14d0c4a8-6f3a-43d4-8771-b89659dda516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521254, "uuid": "749d51fc-b212-48d8-8df2-73e24952f961", "value": "b1363351ac7310f4e6bea75ff8617c6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ef4114-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533798, "uuid": "90928000-b189-4789-8fd9-8ffa4429a61c", "comment": "Malware payload (Dridex)", "value": "06ea274c5ec6c332db0091bc3ede81a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533798, "uuid": "960657ca-8293-4465-aab3-cb88bf5dff25", "comment": "Malware payload (Dridex)", "value": "2aad1a5967ff1737016d4cb5216888f400b41d00462b46c1f9676b73bbdea255", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533798, "uuid": "b52ce911-c357-450a-8412-66c8febd150a", "comment": "Malware payload (Dridex)", "value": "59f572a214065566406f61aa1aa3b3777e5b11b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533798, "uuid": "8a8af795-cc44-4071-b44f-cbd0feb3e566", "comment": "Malware payload (Dridex)", "value": "b488ef78054469c37bddef34dc0e8a2f1bc0b7b1d5ad1a9368c7b3ee66a09184db0537211522453feb4bab0939a82088", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533798, "uuid": "dc541c12-8f02-400b-8206-5e5f2d162519", "value": "6A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533798, "uuid": "05a58634-1d6c-4b37-856d-d376a95249e8", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533798, "uuid": "d0af746d-3466-4707-9a6a-2f37186b7f56", "value": "3072:Oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:OH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533798, "uuid": "2a678dcf-9835-43b0-8d88-012e3cdb3179", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533798, "uuid": "ad0e5573-d9a9-4617-bdcf-ffc92c6ade28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533798, "uuid": "ddf429f1-be8e-4a35-91cf-cce559c98e4f", "value": "06ea274c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22708c72-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "6cb02787-6fae-4676-b27f-b3f03717bd38", "comment": "Malware payload", "value": "07bc1dbb7c4b026d3367e6399db41076", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "97f4bf7e-401f-47fc-b4a7-9b90ce0526f5", "comment": "Malware payload", "value": "2ab570d07edd953272dd3b33ccdb642b0de0a4adb0aea73df1b1cddc8c671811", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "05e21588-cf35-4a2f-a8f2-932d882c7c2e", "comment": "Malware payload", "value": "f818df43452aaf305f08c33e32cfc7c21df76dc4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545600, "uuid": "61152a4e-294c-4509-801a-7d3965209ede", "comment": "Malware payload", "value": "12553394e2cb6d6056be3546034c794bf4707bfcfecc692cf2a7f14a66f055b1153bdd058140e8c2c94f5c548daa3b22", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "6564662f-4d79-4353-91a0-014ae289d8e4", "value": "C804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "42b36090-9a50-43b9-9989-540fcfaaa5aa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "e3b342f1-3281-456e-bdd5-49e076b23ae9", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545600, "uuid": "842a7017-f8e5-4679-af9f-f0936bf9442a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545600, "uuid": "f448410c-a5c4-484f-917f-7c54844a0cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545600, "uuid": "c5c2c639-4a48-44e2-a277-58f9532300aa", "value": "07bc1dbb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6339420f-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539266, "uuid": "2055aff4-0edd-40f4-916b-3bcb8a78ce86", "comment": "Malware payload", "value": "0b3f2ef1efb180b27f39f057337533be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539266, "uuid": "c79441d6-40ad-40d0-bae6-8ee34f9a9d4d", "comment": "Malware payload", "value": "2ababcf7e4accac815cdabc43e5f9b444194c8b09909102fa791e92c37097efd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539266, "uuid": "7e17a289-7c0c-463c-8a25-1e3993a09406", "comment": "Malware payload", "value": "ba85db8354b1cc2754bba03c862a71fb8bf3a274", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539266, "uuid": "329ad6e7-8f2f-4549-ab14-e502ffa4708e", "comment": "Malware payload", "value": "78aaaacb97d03627c27ab0032217be02ff5ebe668b42f2c9b9144242fc6d7bb370e6ddbf05a99eeab9e7daa5efb48612", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539266, "uuid": "6877082f-4d6d-47e8-a020-25a08f326254", "value": "AF04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539266, "uuid": "1ddb7394-e902-4953-9af0-e0734117306d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539266, "uuid": "920fd0a4-d293-487c-8ce3-337ffc4ae124", "value": "3072:wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:wH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539266, "uuid": "6c88b851-3ce4-4db5-85f7-679ff3aa61f5", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539266, "uuid": "1a2ae36c-987f-49ab-b5d5-451281b44776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539266, "uuid": "1ce9da6f-96d7-4cc0-a851-306d56f4ab03", "value": "0b3f2ef1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cb3e74-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546058, "uuid": "7e475e01-0149-4a18-909c-0bab3bcaa8ec", "comment": "Malware payload", "value": "759d3558cceb441082abb4d786e9b8bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546058, "uuid": "8b509a39-621b-4dcc-aef4-fa6218a00f03", "comment": "Malware payload", "value": "2abd9b24dea112472533069cc4ac37e7f5250755593f2c2ef659039b845f8f9d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546058, "uuid": "f047bdd2-da4f-4573-908a-8c5476eecae8", "comment": "Malware payload", "value": "deaa36ba2a4fd30baebbd0c69c6639c160b27acf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546058, "uuid": "26980c15-f97d-420c-9a9f-310a0bf3a4a1", "comment": "Malware payload", "value": "f8cdae87db4cb606606383ea00d92ff7a05dcfb83b0ed283c6192de3644ae88183b36b47ee0a8f28fab304f9579af70e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546058, "uuid": "091394d1-229d-403a-b0fc-a78be1cc5f1e", "value": "32F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546058, "uuid": "c40944c3-b5ec-45bf-bb40-bff0a07be8b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546058, "uuid": "d9ae04f8-0e28-4736-a37f-9bd5e25af9c3", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546058, "uuid": "f44b855d-5443-4267-8c9f-d2cf3f788139", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546058, "uuid": "5d30c03a-df24-4178-abf5-37229b4b2ee5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546058, "uuid": "f1392df5-94cf-4ddd-beba-220f6d76349e", "value": "759d3558_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd1b69d-b98f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531043, "uuid": "200703a3-0d3e-42bb-97ea-095d10bdb9ae", "comment": "Malware payload (Dridex)", "value": "d2bb3440ada53b61569912bf099fc3b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531043, "uuid": "5c23efb5-02dc-4d6d-9b87-68424bd0a2a1", "comment": "Malware payload (Dridex)", "value": "2b07858b1529507504dac91f65aa4f04802cc841ed49ba9726f0cdd744ed2136", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531043, "uuid": "57e27906-b813-401c-90f8-f40f7d7a7c83", "comment": "Malware payload (Dridex)", "value": "dc2b350e5e3f880164fa6ffa01fc1db3152d555e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531043, "uuid": "5c710e6e-5dbb-4a66-b56a-37723487ff5d", "comment": "Malware payload (Dridex)", "value": "ee83a46493dca7408234a871df64e1ae5c8f3cc340627e42fd110389efaa3f0432cc42f9654f80d4b0cd3eeb18a22d7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531043, "uuid": "b3af281d-e845-472f-980f-c98a9558990d", "value": "FA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531043, "uuid": "4c190f8d-9e4b-4c87-a8e8-4238c5bcbe04", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531043, "uuid": "f4aabac0-1ea5-4864-8157-a52d63b52212", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531043, "uuid": "d6081075-4672-4647-97e5-9908b07fad14", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531043, "uuid": "ce93480b-ce89-4e42-83d0-9cbf4218511a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531043, "uuid": "8c801b5b-4a4f-4fb1-af22-1b22e089779b", "value": "d2bb3440_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f7de6d-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539910, "uuid": "55a39245-dd5f-47d2-99d8-7070cfad13d8", "comment": "Malware payload", "value": "d96c17722d9deb62e7ac674f26fae70b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539910, "uuid": "a24a9755-fd17-4460-a64c-6839bad776cc", "comment": "Malware payload", "value": "2b091306671b49c8d703135cceda29a6b8c3dc4b12489ce593f226a1e7b59316", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539910, "uuid": "72d1aff7-5f02-4395-8b1f-f60d0a698501", "comment": "Malware payload", "value": "775a344e787081d39a426a57b3d68809453e1f7d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539910, "uuid": "3cec6cbf-d682-4153-be8b-d800e40c3b60", "comment": "Malware payload", "value": "a75b4707789897473b3e79e4eb92d25fc73b8d17e4baa43447d220f94b4f170cb25539be3cd1b714c96f232ed725a634", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539910, "uuid": "a28883af-248d-4e0b-96a2-c09951a8ed22", "value": "4A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539910, "uuid": "6b8d20e7-639b-4239-811e-136612a7237c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539910, "uuid": "27f230fd-dc9e-4369-aab8-96fdbfad0374", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539910, "uuid": "c443e1ad-c138-4f20-9af3-92067fef720d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539910, "uuid": "7f3357b1-06da-4fec-a844-5c9b0e4ad941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539910, "uuid": "ae3b9a54-690c-4ad5-834f-030d1a39927b", "value": "d96c1772_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb452159-b980-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524838, "uuid": "1e2530ba-d8ac-4684-8492-f42386c879db", "comment": "Malware payload (Dridex)", "value": "b663f7ca65cdef523b32166d8ba4875b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524838, "uuid": "e243683a-be78-4579-9e43-cdee126d7a74", "comment": "Malware payload (Dridex)", "value": "2b1b6abf52ce387b250bc359422bad268b15855031d6185e1188b77a539eef77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524838, "uuid": "d9bbfbee-de70-4dda-8579-bc4a413342d8", "comment": "Malware payload (Dridex)", "value": "c5f0859ca54ffe62c35955191cbbfb541b219977", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524838, "uuid": "43d5a788-7e0a-426a-9bf7-acd7298db153", "comment": "Malware payload (Dridex)", "value": "e910690e847592cacc07688a1a811cae6faaca54e42c3272a6dfbb529582f09dbd1cf684f7a899358f179051713701f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524838, "uuid": "82da2d99-9c26-445c-82f4-e4cf26c2b21b", "value": "6A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524838, "uuid": "fd365712-0e0d-4fcd-83a6-f87e6fe5930f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524838, "uuid": "dd3c9999-5211-41f4-99d1-129df8e2d043", "value": "3072:ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:jH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524838, "uuid": "c29f65cf-52e0-41d8-959f-453f2f8ff36e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524838, "uuid": "4993a2d9-567a-410a-9067-5845c952d851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524838, "uuid": "b98c9938-5305-43be-b50f-09a555f4cbc1", "value": "b663f7ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91b899b-b9b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548913, "uuid": "4018a4c1-a24e-4901-ad94-f28439da78b8", "comment": "Malware payload", "value": "1cacb160b081a36c3e0ee495790528be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548913, "uuid": "03dd5ecd-71a4-487e-9f30-8f06574c1ded", "comment": "Malware payload", "value": "2b3995f6a68899804edd94637809c74fe4a179fe6edb2db52c29d21fe986e45e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548913, "uuid": "56764547-d5a6-49ca-a31d-f34bad71656e", "comment": "Malware payload", "value": "62d6f8421eaf91d5f14358faef09ab9132bfdaa0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548913, "uuid": "1357dd90-ef50-417e-85e2-3b36247a1c29", "comment": "Malware payload", "value": "4e5a803706a273bafd7b03f484123693c9b3ab74c365e18f1d6102eafc6913b43cb16ff413786780594e7735030716a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548913, "uuid": "7d23004e-4147-48df-ada2-111d430f2405", "value": "6204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548913, "uuid": "2beca7a4-98d8-4441-af2f-d6900b0f453a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548913, "uuid": "437ca8b4-07a1-455c-acb7-79865f658549", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548913, "uuid": "0836c5a7-c02b-4a0d-8cde-b90582ca1492", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548913, "uuid": "de0ea544-d61c-42e2-87ed-b7293e5f78d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548913, "uuid": "abaa4b81-6729-4ff1-9eed-f9b8f37aa3fa", "value": "1cacb160_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f793987-b9ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544092, "uuid": "7261d7c1-7085-4811-9e0b-67a77655f634", "comment": "Malware payload", "value": "bedb08f31b545dcf95820fe94a69c3bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544092, "uuid": "90ca8eca-f5fa-442b-a494-d801c92b78d4", "comment": "Malware payload", "value": "2b78445c0f6da73b58238af8dfabc2f68159fe125d52c89bec2261c18b23a7ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544092, "uuid": "cf2794f8-dd06-4044-ac8c-f2a23bf58093", "comment": "Malware payload", "value": "b67aeed34dca6c51e279e510529616b0d9fc2027", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544092, "uuid": "51152e74-57a1-4191-9ded-4b5477f4d612", "comment": "Malware payload", "value": "15c6036c263b7ee5b136f31ef9992a20ce9d90c87c7071448aadd5520241688398e6e073f6c34aba20cdd2a45849d111", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544092, "uuid": "21c1395c-e6de-4b0b-bc06-56dc20e29e44", "value": "1A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544092, "uuid": "e0dba19e-0712-4b3e-99bc-37cc7d5b75c6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544092, "uuid": "e67788f6-4002-462c-bf19-e6cfc8aa7e8f", "value": "3072:wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:wH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544092, "uuid": "db180f75-f187-493b-a736-4c86f40bbfd1", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544092, "uuid": "58d4e7d0-4d33-4822-b932-14145f790797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544092, "uuid": "422aeae1-09d0-43f7-adf3-3a7b4eb5acad", "value": "bedb08f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9920b430-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540645, "uuid": "a6a63e3c-8006-46c5-acae-eae454f3f20b", "comment": "Malware payload", "value": "c5109f13a0812fd2cd116490943e25eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540645, "uuid": "ff6f25d2-e8d5-4082-bc65-17a7ed650a79", "comment": "Malware payload", "value": "2bed3752ed977b440bd25799d272a99b7c1fa7c0887f34342ddf29e338602a0c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540645, "uuid": "c6c72ce3-216b-4862-a507-39a44a703cd0", "comment": "Malware payload", "value": "da4ab61c37a0553d4769649aad6da670c5f1bddb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540645, "uuid": "971830ec-610b-4614-a143-b6b84921ae6a", "comment": "Malware payload", "value": "fbdfba9e9dfb66f70061da858abb2923d221472c395f38c872e47edb25a7f959f7c117d5a04bda6634032d5ba4594eab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540645, "uuid": "e0262ac8-40b8-47b0-9348-860eb6d40a2a", "value": "3404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540645, "uuid": "79018d39-3a61-4e05-94b7-ed19ba2c01ee", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540645, "uuid": "b0cea6df-fa29-48fb-8c96-86b97b755cf0", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540645, "uuid": "c817f574-2851-437b-a46e-8f7182dc892c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540645, "uuid": "f00e407a-1499-4997-a012-12dc171efe37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540645, "uuid": "c16a7c6e-acc2-473f-9635-5d098d96d4ff", "value": "c5109f13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73de165a-b9c7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621555185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555185, "uuid": "dfd5f0ef-6904-4a27-9fac-d85830189dec", "comment": "Malware payload", "value": "73cc1dc2c6d5cfea0fbc5e1dd47dc4b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555185, "uuid": "d36ae247-7956-4085-a919-0db7b6bb228a", "comment": "Malware payload", "value": "2bfa4eeb1d4d1314702d426296fa27e7923a970c8c4c1e6f14dc9615367d9353", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555185, "uuid": "a177181e-98a4-41b9-a1f7-7986fe171dfc", "comment": "Malware payload", "value": "8328d865db0dfbd896975c52cba9e2aea2cbecc0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555185, "uuid": "dfcb22ea-87ec-4f80-8210-e3c49a078295", "comment": "Malware payload", "value": "8253d193c3374504a64e8b8ee95c33b953f74095d3b889ec60fd77d4df56aabea5e439bcd8a6cf7ac9c74df47788286b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555185, "uuid": "70065a4a-8953-41fd-9ff8-ff4ff26a317d", "value": "FF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555185, "uuid": "0d1778b2-5044-439f-b416-5acaf7eeefa4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555185, "uuid": "1cc7f13a-f24a-4aa2-a9a4-ca3731931e11", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555185, "uuid": "7f4092d9-8328-458f-8f68-c0a06b6d32fd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555185, "uuid": "e1ad81e9-ab82-4fc8-9dbe-2939f7e1c09e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555185, "uuid": "07f8017b-639d-4238-80b2-72d13cffb831", "value": "73cc1dc2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe11edc-b998-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535073, "uuid": "6ff4028e-54f2-4952-b87e-48755ff5120d", "comment": "Malware payload (Dridex)", "value": "b8b7f06993aca3e71dbf48784c7d6368", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535073, "uuid": "028edaa7-8f4b-444d-a6e3-c2a79db26354", "comment": "Malware payload (Dridex)", "value": "2c375ecfb950b1f5744a4bb96566d841ea7dd4872c88835ec3469bb643dd9ce3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535073, "uuid": "3939a6fb-8a6d-4306-9ddd-2c7973ecabb1", "comment": "Malware payload (Dridex)", "value": "2ba495a84840b5596f29423ef3b0216f0a402661", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535073, "uuid": "2df06dcd-037a-42f7-9215-471b974575a9", "comment": "Malware payload (Dridex)", "value": "c94c035d2837d0026651bdc6b0cd3d4837ede0b500b32a631bfae4c2cf7b2b10a6cff49bb91e5348cb41053d67ba99af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535073, "uuid": "cbad4d67-5f05-4a39-8bb0-510dbe01036e", "value": "A104D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535073, "uuid": "1615e255-f671-4d58-aaf1-b9765fb7840b", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535073, "uuid": "469b756b-c52d-4282-85d4-5b9bc35ce4b7", "value": "3072:uqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:gVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535073, "uuid": "4b8aec9a-7906-4eff-bf4c-08da56b0026f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535073, "uuid": "2b0b7975-6bb0-4c74-8798-f43eb46583a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535073, "uuid": "86e15ed6-7106-4a80-b410-1ff4d889d241", "value": "b8b7f069_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688a99ed-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536698, "uuid": "e1133361-bd56-405f-ab4f-bb15ce639fb8", "comment": "Malware payload (Dridex)", "value": "f8e4cd6d5fddb1ebcc36db2722e3a528", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536698, "uuid": "ed9494e8-ff64-4b3b-a9c2-0bbb45c0583a", "comment": "Malware payload (Dridex)", "value": "2c66554c190ebdf0c8e1a0699ae96c81709ca78538c669b835f828644e9a7418", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536698, "uuid": "296a7a02-468e-474c-8176-c082477ac23b", "comment": "Malware payload (Dridex)", "value": "0e6c7fc489826fc69aaa86c2c5e0e97cb5a3f491", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536698, "uuid": "dd6a81a1-f472-4e02-95f1-9e5440b3209f", "comment": "Malware payload (Dridex)", "value": "585a6f1b4ac27c12c8d3bd0ecad665610857dde125adc609b5161f30b029c567f07d47c46c2db4f3a2744941ae4f0b83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536698, "uuid": "77709e7c-b634-4a7d-9009-35f85733cba2", "value": "1EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536698, "uuid": "e414e806-ddf2-4739-a834-9211a0bb0b09", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536698, "uuid": "0f3d2da8-689b-4299-87b2-87af65e6c46f", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536698, "uuid": "0fba3189-c049-4c93-b735-51bbe79e8214", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536698, "uuid": "2c2c8a4c-609c-4e16-a139-8ae103967225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536698, "uuid": "b6e04c32-c3ab-4f8f-b087-41b061fd3158", "value": "f8e4cd6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5725a26b-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528079, "uuid": "0085596d-1cfb-4e86-80e0-b232adfd68eb", "comment": "Malware payload (Dridex)", "value": "450c202b67c1f993df0c6284971bed1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528079, "uuid": "79f2f30d-385d-4c34-b186-fbf0de8cd0b2", "comment": "Malware payload (Dridex)", "value": "2cb405bf3f6567b5e423d9d81c524907c4757d89961da3ce8f7ce2a047d72d40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528079, "uuid": "2915fffe-28f0-4d35-b468-6691c9e0800b", "comment": "Malware payload (Dridex)", "value": "bb03d67c2c895fb8fa62f69dec91a4e2285c0cdb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528079, "uuid": "591e2f61-b90c-4cef-a8d1-92fd93fc9866", "comment": "Malware payload (Dridex)", "value": "6d4cfa6f5dbb12995a5a39dd9528c81d1eaba28a7e27d0d20889451a1f8498dd74ccc70e5a23d67a193a801f7b18108b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528079, "uuid": "9dc43ffe-ea4b-42ca-83a1-10644f982bae", "value": "1A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528079, "uuid": "8cc40db7-e98e-45bf-99d3-8cc7b127eb26", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528079, "uuid": "d2677677-2614-4b63-b65f-ec7ad96f875b", "value": "3072:Oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:OH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528079, "uuid": "2b63b926-885b-4f1b-9307-3fd614291953", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528079, "uuid": "f4488836-abe8-45dd-8e8d-0ce63fba4c03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528079, "uuid": "7ac6c16c-d5c1-4cde-bd5a-51ca1cd62280", "value": "450c202b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999b411b-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520459, "uuid": "74785b6c-5ea9-4713-a9b0-e6fc3c405ac4", "comment": "Malware payload (Dridex)", "value": "991796448180ef54627be1c45d1cf51d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520459, "uuid": "2ef195f8-fb0b-46bd-ab76-5a3147899b4e", "comment": "Malware payload (Dridex)", "value": "2cc739783f531f866fb91205e811af139f2912d54ac0e8b7066ecffdd34ead5b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520459, "uuid": "0a70d513-98f5-4f30-ad5e-8184f4fd12be", "comment": "Malware payload (Dridex)", "value": "44e3d82144b937801830d3d0925da253a30f665f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520459, "uuid": "4e687ae0-8d95-4ad4-b9fc-be806041c1d3", "comment": "Malware payload (Dridex)", "value": "1363473f0c417529a4404422498fc0320d8dffbfa435fd79417aec09554a10ac80a17f34db69b3eb9903881dbee4c3b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520459, "uuid": "dc35b633-da98-41ee-98ef-7ecfefb5a2b9", "value": "16F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520459, "uuid": "b4595154-318c-4e15-a83a-93fffaa97cbb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520459, "uuid": "a8333385-c4d4-4c24-aefc-35ce6ec74b1c", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520459, "uuid": "2a357bd7-6014-4720-b2b6-45cf6afb3d82", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520459, "uuid": "3b3033da-904e-4a1f-9972-530c300c95c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520459, "uuid": "fff99b27-513a-4c20-8135-f2b8e74c808e", "value": "99179644_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e0d0c4-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538729, "uuid": "841e54c6-d6bf-4764-a33f-5d9d2fd1f35a", "comment": "Malware payload", "value": "8de952ab1aacc9bf0a115e2a7845a061", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538729, "uuid": "803d6443-f8e3-4b24-8384-561a2e8861a7", "comment": "Malware payload", "value": "2ce0c4afcee0a131593fb244636767419a700190fe9184637ab9a0b5169a88f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538729, "uuid": "f043672e-e979-45af-b94e-3fa134b5b182", "comment": "Malware payload", "value": "64b2669803e07edb3cbc14f972fa99a36e8f52ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538729, "uuid": "40605294-71f7-41cc-a2da-8a744f59ffcf", "comment": "Malware payload", "value": "265536612eac7ba676209cd5094006303535955f601ae9cd21142904ab4a84fe020484a705d7d61ad8ebc5cac4f90a80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538729, "uuid": "a735469b-1bdc-4e08-978a-f7cce7b425bf", "value": "2704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538729, "uuid": "72cf5214-ac4b-4e54-8f9c-7af91974b219", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538729, "uuid": "61d93331-54d1-4084-b596-3f32e4e9dd0f", "value": "3072:4i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:4H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538729, "uuid": "ac4a9348-dd72-4562-95c1-8e9f4b927aee", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538729, "uuid": "3c8997b0-3493-47ab-b4b4-a2c7c1c80cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538729, "uuid": "7e099976-10bb-40be-9be2-6b06d31d2a27", "value": "8de952ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54adb9f-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533471, "uuid": "bc6ee2bb-a3e2-4a49-813d-1a72c3b9211a", "comment": "Malware payload (Dridex)", "value": "7f07f37ada3c798e31034c2ec1286c22", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533471, "uuid": "0fd880da-9eb7-4330-9e71-731723434b93", "comment": "Malware payload (Dridex)", "value": "2d04bec9fe8d2714768cd301112b2e1cc65b9d9517dcf8954f9f7f7b65ab2d17", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533471, "uuid": "8911de3f-acda-4fc1-b737-d76206bd3968", "comment": "Malware payload (Dridex)", "value": "8e85424f4a785ef9d0869771dbff70643b1274b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533471, "uuid": "b48c14ee-db7d-4e48-b6a5-a421336da308", "comment": "Malware payload (Dridex)", "value": "c51d59ac05d423e696e707d7e19d2605667bbab6e1755575000c5815b16629c8a79e33c1558cda730c49ef83a586ba25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533471, "uuid": "828368e1-fe86-49af-a9ac-01d413445d80", "value": "4104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533471, "uuid": "cbf2baa4-9574-47be-86b0-79bc3fa045a7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533471, "uuid": "927b7674-0af9-4238-8819-e568b8cbffba", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533471, "uuid": "145a9bc2-665d-472c-aa59-361db36773e9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533471, "uuid": "464fa99c-c18b-4da7-8a82-ee0dff60a863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533471, "uuid": "5325ae7b-be7b-424c-9d7e-63e7f0627f16", "value": "7f07f37a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3058fb28-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537892, "uuid": "92951c3a-3f7e-485e-8e29-b745328719da", "comment": "Malware payload (Dridex)", "value": "a2b714e018386d65098478486215d5f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537892, "uuid": "e739e661-2b75-4d25-b28a-d818cbc0b9f4", "comment": "Malware payload (Dridex)", "value": "2d05a0bd0655746ab783b9649483e33f8ca13c86f9c0ab82c6022e1fdab43ded", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537892, "uuid": "afcac9d0-ad6c-4eb2-b7ee-759f449c2158", "comment": "Malware payload (Dridex)", "value": "3382cc8113cb24fbdcc3870420ff3c878f429f36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537892, "uuid": "90de8305-2c57-4f4a-aa65-6bc1de59a9d2", "comment": "Malware payload (Dridex)", "value": "8b13ac59c9762728f592744f5eaec8cec7abce67c0fa3d7705244a56f891fa84545189d78f12a3c18b96bccb7c693d4c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537892, "uuid": "0b4984eb-d980-4071-b23a-970904e10169", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537892, "uuid": "1f351c48-7430-44a6-b728-0b56df2dd4f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537892, "uuid": "067f4eff-c672-4227-a857-b59620eb83af", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537892, "uuid": "fa8e50b1-b034-4b8b-acff-e7e18a40e90f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537892, "uuid": "0f1637db-1b2d-411f-84e2-a3a3885fd669", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537892, "uuid": "ae176cd9-c4e5-4eab-ae74-92ad214243cf", "value": "a2b714e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e8fa5f-b990-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531719, "uuid": "cc433c28-efb9-4b94-aade-8da70b575efb", "comment": "Malware payload (Dridex)", "value": "4cc9170d723046022e62f558fac429a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531719, "uuid": "760d6736-4911-491a-ae28-0c4681db9763", "comment": "Malware payload (Dridex)", "value": "2d0912b4af1149365795412ec77bb074afc56f78cdbcf31b261faa3677b1ec12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531719, "uuid": "1669a277-d8e2-4a29-afad-2a8f75c85bac", "comment": "Malware payload (Dridex)", "value": "d625530b6f0891b131482b53f7faf842a25ce35c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531719, "uuid": "611a9d07-17e8-45e1-9732-70f76456ef3c", "comment": "Malware payload (Dridex)", "value": "f9f41358bc89a4f3f6f3ac3966095e8e76dcd288270030f637a3dddf0630e850ceeb3a47713edb444e1cdf6302112e85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531719, "uuid": "2a7b9805-8f0c-43e9-b73f-4a9fbdd8f556", "value": "B404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531719, "uuid": "a3f6974b-b81e-4630-9cfd-3b5b53932570", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531719, "uuid": "f36345fa-e0ac-4ff8-a3d3-725717fa40e6", "value": "3072:Fi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:FH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531719, "uuid": "1545d0a6-b095-439d-ae7c-132c0f242d20", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531719, "uuid": "36b07b71-6988-484e-b00b-6b6d117fe270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531719, "uuid": "b17aaf2d-29a9-4a15-9bc9-42975ce703f4", "value": "4cc9170d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094d5851-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531814, "uuid": "ea228dda-6fc5-4191-a2b9-63f1355668c2", "comment": "Malware payload (Dridex)", "value": "d14a8d6856d81f71b5cc37d0f6b4e541", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531814, "uuid": "e8af428e-752e-4e74-a811-86f7d6df380b", "comment": "Malware payload (Dridex)", "value": "2d1f3438c6ea32a8b71f2b75c2ee0eff456be7305a35df94653b8b9d07556007", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531814, "uuid": "1975bbff-f0d1-486f-b513-a59c696ca6f7", "comment": "Malware payload (Dridex)", "value": "f6ee19944800628d2c042188b8a5d446b6c5e6a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531814, "uuid": "a3d52cf1-92d5-4dec-a0bd-b6a394c9b9ac", "comment": "Malware payload (Dridex)", "value": "3254fa8c70af39efb7799b078698786a188024f7039509058a56d2df452b49abaf829639c842aada49e72789afba91b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531814, "uuid": "4985b7f6-30a4-431d-915e-e5169ecf15ff", "value": "3A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531814, "uuid": "12f7977f-8db2-4b2b-afa1-a1f8c57f446a", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531814, "uuid": "f7e210a4-5e8f-43b6-8a0b-d305805ac5d6", "value": "3072:Pi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:PH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531814, "uuid": "87279c61-5abe-497c-afaa-cb38b2cd3c2a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531814, "uuid": "e4d22a35-c1b6-49d1-ab7b-c426daca4cae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531814, "uuid": "c56c8bdc-1beb-4aae-bbc8-bf642c6c0cae", "value": "d14a8d68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9366a5e9-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468909, "uuid": "87471485-e4f9-4467-bed1-1ffffc2427f6", "comment": "Malware payload (Dridex)", "value": "2473bba1d86f7ce205cfb2d4fd82f82a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468909, "uuid": "d5576cb1-24e8-42c0-a040-5da9e4af6f7a", "comment": "Malware payload (Dridex)", "value": "2d45035d2e2dd11ac9f2276fac5af640af91239a12b6801a0c36888ee5f097bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468909, "uuid": "6369d32f-af8b-4d8f-8d17-fa5b02b35f29", "comment": "Malware payload (Dridex)", "value": "ff56f1ca3a5406fe546e87d6123352af388faa55", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468909, "uuid": "ca16447e-868e-440a-ace8-acfd76281ca2", "comment": "Malware payload (Dridex)", "value": "c7308243fed950b71c610806c70e0513c7b2574ff565b874db8470ee9e44d40c53724b79f9bb12e56ea21fd422a38bb6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468909, "uuid": "44395e3d-21d4-4a03-8b7b-590260f333b1", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468909, "uuid": "43e2de06-ceea-4963-860b-f74c36cc4f61", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468909, "uuid": "6ed3d64b-edbb-40e3-bb1d-af3c6342f02c", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468909, "uuid": "f4bfc930-d00d-4aa3-aa37-3619dd757add", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468909, "uuid": "7d909c81-e4b4-4896-9eac-738648ddc2b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468909, "uuid": "2ea6bf56-e053-496e-947f-bc8d07f374c3", "value": "2473bba1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d248038d-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537305, "uuid": "60e91e02-f705-43b0-8141-a1478fbcba94", "comment": "Malware payload (Dridex)", "value": "cd90955e6f969b6cd83ace5b234172c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537305, "uuid": "c4f4ca93-0131-4063-b259-be6d8157b59e", "comment": "Malware payload (Dridex)", "value": "2d7573074ca5b06cf10456d2546c4ca95ab368146b9b043a1e64a96554ea90b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537305, "uuid": "4fc389a9-a9f4-42b2-aad7-ec95892336e2", "comment": "Malware payload (Dridex)", "value": "19440e599146b6347c45734e7653ab5721d7ded3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537305, "uuid": "7b62c6e0-ba2a-4399-ae1d-9095fd411bfd", "comment": "Malware payload (Dridex)", "value": "1a8e4728d040bdf23020433832836715724306045c6e656143ad59f9f42e34fcbaff3ad519e7a6c0258a3087a984088a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537305, "uuid": "f06c16bb-c506-4885-b3b3-3691a6e55e66", "value": "7B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537305, "uuid": "f2afc595-2a8e-4724-be4e-726fecc58baf", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537305, "uuid": "206d45d8-eb15-4008-b120-d023726f0404", "value": "3072:/i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:/H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537305, "uuid": "86afc69a-c112-422b-af20-f409cfbb3259", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537305, "uuid": "fea353f2-3230-40d3-84fe-e4ea078bcff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537305, "uuid": "adc92488-b28e-4b6b-86de-6833b9070a30", "value": "cd90955e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ca9d6d-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541022, "uuid": "acdfddf5-1421-437c-b1e7-f1484e57bf30", "comment": "Malware payload", "value": "e34ba09eb437df024c5989de96fc4b7e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541022, "uuid": "b372d5a1-8628-4002-a9f3-6dd27f61353c", "comment": "Malware payload", "value": "2d7b2c27f6e8844c845e729d0ed684d5eda21c231303db0eae75780ccda0236b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541022, "uuid": "91a9621d-5578-4195-ab06-63bf1195ac62", "comment": "Malware payload", "value": "21b86b8d11018ba9da2a06a61480d359bbb48aee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541022, "uuid": "be0bd7b5-cfd7-4406-bc61-74ebcd677031", "comment": "Malware payload", "value": "4dc4300152cefb1711ec7664718fc49aa7186d9d036d46b06a912b2a2941e573ba0b8a5850d5ad13d90b6259b438e670", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541022, "uuid": "acd131bd-d75b-4c08-9534-91d7d4c21ae2", "value": "9A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541022, "uuid": "ff483326-4f66-460c-a1ca-7764ba562645", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541022, "uuid": "ed392faf-173e-4b6f-83ac-85a0620994e3", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541022, "uuid": "8cc327a9-5f55-41c7-8891-6a6a77ff4a74", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541022, "uuid": "2c5754f1-ec67-4130-9176-765aa7a4bc57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541022, "uuid": "0f8b24b3-0d98-4f3f-9a7b-bd1f5da17360", "value": "e34ba09e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70bec53-b949-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621501262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501262, "uuid": "55cb9c32-4c73-475a-aae7-a97bc72297d3", "comment": "Malware payload (Dridex)", "value": "0f545be5f23503181e51f783e7723400", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501262, "uuid": "ecd2bfcd-d901-4c73-918f-2b76aba7a542", "comment": "Malware payload (Dridex)", "value": "2daf78247161e506e521afa16830ab3e96fe5ab49460c0fd81cd47ed9e39901e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501262, "uuid": "f2e991af-6b51-40f4-bb54-1dd36d45db25", "comment": "Malware payload (Dridex)", "value": "c3797fc984d6c81871106a18cf300da10024b4fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501262, "uuid": "f0bf8c29-57ab-4d4d-80ca-6cb754a47e16", "comment": "Malware payload (Dridex)", "value": "a47b7cb1046b60af3b8198bd9a57e6ba27028079217a7a26d32828a9030d8cbd773c3ea03a1283fe739c721da7f0dc8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501262, "uuid": "29448539-e6e9-4444-987b-ca7435eaacb7", "value": "89F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501262, "uuid": "ce100053-0284-436f-a3aa-d4bdac5c8b2b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501262, "uuid": "42edb6a9-0117-4e54-acf9-4e64349a5e6b", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501262, "uuid": "01f1488a-a344-4b62-a51d-3ceee14402d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501262, "uuid": "d2a48a11-cb10-4b44-bd86-9abfff934868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501262, "uuid": "4ab0e522-538d-415a-b495-d5d938edeffa", "value": "0f545be5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ca6519-b9bc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550275, "uuid": "985fe8d1-7f40-4ea2-b4b5-37644b3d12d4", "comment": "Malware payload", "value": "02c1c635b81736bbd06f6bbc46cb403d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550275, "uuid": "1d1b82ec-5439-4479-a000-6f2dd0f9d803", "comment": "Malware payload", "value": "2dc4a761c6ff98826d7501423a98c75bab7851a2bcd3f6d8cfea3157ffeec169", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550275, "uuid": "6021a086-ceba-41ac-b87b-726cd68fe66f", "comment": "Malware payload", "value": "3601d8d34cdf91d572698f8b42405f1a591c3bd6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550275, "uuid": "068a2841-5969-494a-bca1-c4d54963a436", "comment": "Malware payload", "value": "d5091754fcd89e77036a2fae5f0c9fa9e0707b4e4857f6611ac8ff31b010e7330ca74cae68cd3141865d19dd6602ec80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550275, "uuid": "67db8bd2-3107-44bb-ace4-99b80801c0d9", "value": "9904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550275, "uuid": "c371221c-0d27-4fe4-b78a-96c44f508205", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550275, "uuid": "b2708c95-06fc-4e08-b6bd-06b39700b1b9", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550275, "uuid": "e386f784-6dde-4659-b62f-c2e697cb3e48", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550275, "uuid": "e6370691-fe58-48d6-a3f5-30f273c96ab2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550275, "uuid": "9642fbf4-1bbe-4a1f-9681-2238fa396bc6", "value": "02c1c635_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11b9715-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528257, "uuid": "20997d46-5a08-4a13-b0c1-788757330cff", "comment": "Malware payload (Dridex)", "value": "4b4a319425defef9c09fca825248d057", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528257, "uuid": "c9728a8a-9dee-41b2-84e6-e92af575b1c3", "comment": "Malware payload (Dridex)", "value": "2dd610568be8adc7d5eed4f59a350b463756850560be75f0733ff6cc28709ed4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528257, "uuid": "28d4ebcb-9d08-4b0f-8c3d-869f120b38b4", "comment": "Malware payload (Dridex)", "value": "597a23bf82f9d23663d216459d8d2f99c089add8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528257, "uuid": "6047c3fe-efe7-478b-91d9-b0877f183c15", "comment": "Malware payload (Dridex)", "value": "9af423e8edcf57c7e0e5b1f1f0bc57db63f2fd7960dde21db0d109b2bd8d26bfdae2cd6b2b779c815beada91f49531e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528257, "uuid": "be9336a6-0480-408b-90e0-d96b560b3f65", "value": "4304D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528257, "uuid": "c60c9051-8155-4af2-88da-c090c40baecf", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528257, "uuid": "c34bda52-d71b-4687-9ae0-fcb4ea8dc2c5", "value": "3072:dqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:TVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528257, "uuid": "e0b4047f-f48a-45cd-a01c-1435f8fa0b0a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528257, "uuid": "fe81caff-88bc-4448-85d6-41ae15fce8ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528257, "uuid": "89b4aa20-cb5e-44ae-a930-e11ab2606743", "value": "4b4a3194_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6f09e4-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528891, "uuid": "74f45c59-98d3-4c8a-91a4-f5507fe5ff4a", "comment": "Malware payload (Dridex)", "value": "f1fbc86660275dfd1a197687fb336027", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528891, "uuid": "cbcb289a-fef6-436d-98a5-aeca117230ac", "comment": "Malware payload (Dridex)", "value": "2e06df746e9b9f75f076efa0964b296b1c254539ab8ce575cb28e325e6768c70", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528891, "uuid": "1971ce50-16af-4c35-9b01-f4d43b06a1ad", "comment": "Malware payload (Dridex)", "value": "92bb25327fb9f421139c7ad496f00170f3bca504", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528891, "uuid": "039e3489-d853-4b85-b71d-0590c8ab9253", "comment": "Malware payload (Dridex)", "value": "6c85926dec90394a19ce30fed73debe512151f553e2fc5619ee2608fefa86d57865f8b9e0d6f9c6af94cad01f4287e90", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528891, "uuid": "61d7ca0d-13fa-429c-a593-5de7fd95d23e", "value": "5B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528891, "uuid": "80a7835e-2506-4058-aea1-06d5d9a57824", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528891, "uuid": "66b4a89d-4908-4c0e-bd88-a008d617416f", "value": "3072:9i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:9H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528891, "uuid": "b5842b7e-cdc0-4aaf-b730-90570094479a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528891, "uuid": "cbee1ad5-2d52-4b55-9d22-766056b00c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528891, "uuid": "a30d7cc3-0e50-42f5-ab00-32c51b906072", "value": "f1fbc866_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874aa7b8-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621530737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "f56d6fcf-3510-4e75-aaf6-9267317e591e", "comment": "Malware payload", "value": "8d23916f82d27407403223ede470b556", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "498f34f1-afc7-406e-93d6-cbc925d371ef", "comment": "Malware payload", "value": "2e13a55e883a5a82d397d989b73f6a732460ac892ef768db475a004c24c93811", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "3f741e8b-52e9-485d-a8bd-dabf1b89ff37", "comment": "Malware payload", "value": "da6fea5bd1e81f9cbe9cd6f3bfad5fa6c67af362", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530737, "uuid": "9c4db7ee-9b13-40eb-b8b1-13dc5466fb0d", "comment": "Malware payload", "value": "16dea8ebba1888bda26bb569a3940943e21b4245b11bdcf45d915d6176b8fdbad2d130457333bdd63bcc426fe743262b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530737, "uuid": "75674ca2-4c77-4620-9301-a361c726e439", "value": "08F3122CD81B495680E924B3ACB5C106AC332211FEFC59ACB76C7994F9679F21D36F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530737, "uuid": "2d35c861-7802-43ff-8ef8-944c283ab27d", "value": "3072:f1I+DuTZq4ydUCi3ynhJ912A7RF8IreLwKg55MiYTTcJGOYW:f2+DpRXky/RtHv5STQJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530737, "uuid": "2572e507-df28-46a6-94cf-c867fcea2585", "value": 172872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530737, "uuid": "f3d04239-1f27-4edc-a098-0365a3de43f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530737, "uuid": "b88d9b94-812f-4ff4-bac8-a950e7518ed0", "value": "8d23916f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74717941-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539295, "uuid": "ffcd32e8-9c2d-4fbc-972a-b6509dcddae5", "comment": "Malware payload", "value": "96db1e9c0d7bf2ffc7c9d95b49bf170b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539295, "uuid": "e29f4ab8-b744-429d-a98b-d7bdea2c023f", "comment": "Malware payload", "value": "2e1fc1ce3137c5fa86a0991ad733b7c14f199ee3d5626008201bee9b499b7aeb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539295, "uuid": "17951c8a-57d3-4f53-a983-82758adfa08b", "comment": "Malware payload", "value": "92c63686746dbed4aef2884c84d6c8e4d08c24e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539295, "uuid": "ad25e55b-9606-44d1-a68f-315f1beabd32", "comment": "Malware payload", "value": "eda1c78dbdb726a8ab661ea0ed120cb63e4d9738c898390c7892c0c241ce22d9766c4015094c39b5033aae3b27212e0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539295, "uuid": "0a757185-de25-489e-a88f-6d873580b0b2", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539295, "uuid": "499e60cd-4bbf-4708-a294-f794ab5e50ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539295, "uuid": "d4e19648-332a-47d4-b3d6-c553f01bffc4", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539295, "uuid": "629f9389-935f-466e-a07c-3cbd96cc391c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539295, "uuid": "4614cf57-612d-4f2f-8110-03f6e506307b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539295, "uuid": "6d3f07a8-6bff-4d7f-9295-5596ffe5ad5f", "value": "96db1e9c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa7e0c9-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483873, "uuid": "8b4c67d0-6a5a-4bce-a54c-02c0b1647b6c", "comment": "Malware payload (Dridex)", "value": "21ed512bf052345d03d991d6157850e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483873, "uuid": "073ea334-433f-4f5f-bdb5-cb89b42a2b19", "comment": "Malware payload (Dridex)", "value": "2e22e00f4a81c29065f6e1aaeb5ca59ab8231a1067fe678c2fffdf30cee81cfb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483873, "uuid": "7f1e0972-4413-4356-84b6-4a33ea104ec8", "comment": "Malware payload (Dridex)", "value": "5027316d180af46e466270353e603a7fe68cdfd1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483873, "uuid": "48339ba3-0b30-4d3c-ae93-052ca8c0e53a", "comment": "Malware payload (Dridex)", "value": "b6fcc14f47b905982c01905103d42651e906feaf60c29d43091deb32f7059bf70f98c6aa022fd8cab7ea94bc9f2feda1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483873, "uuid": "8e8e16e6-f89b-44a2-b638-34e27f14f473", "value": "EFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483873, "uuid": "d07420b2-2a14-4076-9dcf-7819d8313967", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483873, "uuid": "a9457f1a-52f0-46f0-b7a8-b5eb91d26943", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483873, "uuid": "d1d0e27b-5637-452d-b5da-063003679eca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483873, "uuid": "db28e34e-b358-4dd8-8899-3ca9037c292a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483873, "uuid": "27e34dce-6620-4e8c-ad02-c97422dcde0f", "value": "21ed512b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3a2c55-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530482, "uuid": "6927f883-db2d-4794-b811-ad51b37b6010", "comment": "Malware payload (Dridex)", "value": "f85062fc583cd536fba625a2a6949bde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530482, "uuid": "52b3e5bc-c6a3-4c81-ab36-371d39964e4c", "comment": "Malware payload (Dridex)", "value": "2e722dc1e0b76373b4ecc68b46843db8e30b8ce927c39637846da93455b7579c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530482, "uuid": "7cf74a0c-1fb4-4114-b9b3-810ccb8bfd4a", "comment": "Malware payload (Dridex)", "value": "8215e140307ffdf96cd49388c5a1a1517d897253", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530482, "uuid": "db292f95-2d3b-4f01-8dfb-7f91637c9df6", "comment": "Malware payload (Dridex)", "value": "248bb93f3ec36d256d59bad88011572fa2f156f05afaf5fd23ab8ae08d1a2e6d02f27bfc01254c9065dfbf12173fd73a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530482, "uuid": "dfce0543-f43a-4e80-be37-7a8eb4a5991a", "value": "A804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530482, "uuid": "44de9efe-e9e6-4005-8ca9-ef7366ddc6c4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530482, "uuid": "41fee6b4-826f-4429-aef7-a1237236f25c", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530482, "uuid": "ffd2d221-d845-48a9-a812-31e937a63718", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530482, "uuid": "8d99fc91-34d4-409e-8a51-19cfb058feea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530482, "uuid": "6ebca5dd-438a-490b-bd17-b029226cab29", "value": "f85062fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99079023-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541504, "uuid": "e8321dab-8f77-4073-b1c6-e9740b230546", "comment": "Malware payload", "value": "818a999e09a0ef315a8b6e0413948c22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541504, "uuid": "14934b5d-c369-451f-b72c-5e549eb06c28", "comment": "Malware payload", "value": "2f321cf937e180f4949a03eabc5831a1c5d4c3b2365511112cf3e8b039fe4d00", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541504, "uuid": "c45e6840-e3f9-49d9-8d6a-e9870a836901", "comment": "Malware payload", "value": "722ec1578ebb5c527a4bcef2f0a3ba39839fe4da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541504, "uuid": "299d5645-aabd-4c9f-be74-7b63a838e378", "comment": "Malware payload", "value": "0ac4739f099f3a96d84c64a469e6f81ec31ed15ddf758536a8852b196ea2e9a86fff67e0b34df0b1e427bcb5685d0bf8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541504, "uuid": "db129e3d-f0b7-4eb8-9ea4-2c32134a92ca", "value": "1C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541504, "uuid": "08af7ab5-9371-4998-8c71-f0f5bb756b5d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541504, "uuid": "c7e51cbd-ce2c-44cb-9fb8-e2047a5d84a4", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541504, "uuid": "e45705de-1494-4e21-95f7-663b2e92be94", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541504, "uuid": "a866314d-b5db-4674-8062-6bde5fa0f7fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541504, "uuid": "a7dd5c4e-d448-4325-a76c-78d5f5379de9", "value": "818a999e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea14e84b-b930-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490530, "uuid": "19a7a6ac-4f1b-47b3-a698-ef25005eb173", "comment": "Malware payload (Dridex)", "value": "271aedd58c8453eaf855a19d8bca06d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490530, "uuid": "97448393-8c5a-4315-8f97-89833c81e99e", "comment": "Malware payload (Dridex)", "value": "2f36f714f75a9ecc64e3f77f0f4988dddb7c9c5f37959370e1ef7ce296e47f8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490530, "uuid": "0d8ebffb-1909-47e3-b0c5-d91387106231", "comment": "Malware payload (Dridex)", "value": "24473316b7217019516c489a4a641b82d2992ea0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490530, "uuid": "80872539-0405-4369-ac51-bacc30b870ef", "comment": "Malware payload (Dridex)", "value": "9710763c775615d9febd59d32def86fea2461e90f81a4eb17413b624fed901563a899fea52960348473166d231b480d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490530, "uuid": "411f306c-5496-4e2c-a193-a8ce91e61892", "value": "EDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490530, "uuid": "0223fd84-c07c-412d-b619-d02ef1e4f473", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490530, "uuid": "47ce5e87-38aa-4f2d-ad8d-c1617e684524", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490530, "uuid": "f1bc81df-2eb4-471d-9be9-edd3092a841a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490530, "uuid": "c100dafe-c50f-4194-a6fc-b01f58488000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490530, "uuid": "b4393aa3-c5b7-4773-90bc-ea0d3457810f", "value": "271aedd5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab9205-b9b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1621545449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545449, "uuid": "ad6a210b-80b8-4221-a0c6-e0f97632c926", "comment": "Malware payload (IcedID)", "value": "0908437fc7e4c07db9a2b7c6a0017732", "object_relation": "md5", "Tag": [ { "name": "excel_v4_macro", "colour": "#9F5D6A", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545449, "uuid": "e52bf2d0-ae69-4502-966a-3f029f4e2fda", "comment": "Malware payload (IcedID)", "value": "2f4193a77175cf0c173f556840b1d36cabbc1e0104d11a3f4c629fe02c915a43", "object_relation": "sha256", "Tag": [ { "name": "excel_v4_macro", "colour": "#9F5D6A", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545449, "uuid": "a8f7d6e1-a3b2-4785-9d6f-58b9edff2b24", "comment": "Malware payload (IcedID)", "value": "83dbed0cee62627cee7db44d83c9eab336047fd6", "object_relation": "sha1", "Tag": [ { "name": "excel_v4_macro", "colour": "#9F5D6A", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545449, "uuid": "1860d40d-53e7-498b-91d8-0ca070a1d055", "comment": "Malware payload (IcedID)", "value": "b1c62a0f9973bbd1403c4f5aa0f5831ac2f23b3d7312159cfcc9c785afc00e290fcfcfe9480aacca11471e26538f5ac4", "object_relation": "sha3-384", "Tag": [ { "name": "excel_v4_macro", "colour": "#9F5D6A", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545449, "uuid": "4ae7425e-cfcd-48c6-9fff-e84ccf38f71c", "value": "6204123CD0764D49C2D5543BDC58C2999C262162ADF8B49D658C7998EB237F30FAFB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545449, "uuid": "963f52b7-6547-45ad-ad3e-167cf806c360", "value": "3072:cgKAXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGRL:cgK4E5SDvbXAyHbVt15wTQDYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545449, "uuid": "d988af49-186a-49bd-a01b-c204044b727b", "value": 178240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545449, "uuid": "6dc290ee-b8e1-4aaa-86b2-84f942724668", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545449, "uuid": "90903704-fe6a-4425-9423-4a8af4e0103b", "value": "92025095413_05202021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abfd6c0-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "9bf96621-239e-481d-b370-06a49a42186f", "comment": "Malware payload (Dridex)", "value": "e354e9a3eb3c2a07582d1ab4934ae79b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "bcdd0eaf-9375-4cf7-bdea-e9291bdf2dad", "comment": "Malware payload (Dridex)", "value": "2f6cb0cd5864fa63becc614037283a6ddd9e746592c7201fbeb5d934acbc46ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "adb364d2-ea2b-496b-91c5-b57a882c1319", "comment": "Malware payload (Dridex)", "value": "78a787b495115d865b4ab4f77b6274bec16917b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "1c19073f-400f-4879-8c45-4e3ceeacff5f", "comment": "Malware payload (Dridex)", "value": "331c49440518c4e47671e7cfef0619c8316f98bfb55a055b870cb45eda810a611bc691ba6d9999ff93daea77a18694fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "f94285ef-16ee-40a7-957d-82a15fc9edca", "value": "8204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "dbcd3238-1af6-4426-a3a3-1f2d2d7ca148", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "6d7b4e41-8594-4b6a-94b1-3995bba584f0", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531870, "uuid": "2160cb51-033e-47b7-b0a2-891ac0d585e2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531870, "uuid": "a813d11f-cd92-4ebb-b8da-27c56f043d3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "ffe91281-ee06-41c8-8dfb-7b8e4f7d3e37", "value": "e354e9a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa96ef9-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529776, "uuid": "a3ddb466-7b55-450d-aba6-8dcc3d502ba0", "comment": "Malware payload (Dridex)", "value": "f5b995dde296144577e4eae0e8dbf06f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529776, "uuid": "9682fefb-de1b-484d-b32d-d4ef3afdcbcf", "comment": "Malware payload (Dridex)", "value": "2fe85bae6c0e30d7590ca8ef41d8a3ce5a0aafc78e7be334d441667f35727ea2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529776, "uuid": "5e48e38d-5c1d-47ad-ae53-fa03378fe6ea", "comment": "Malware payload (Dridex)", "value": "40d2178ab2ade7e3d47d89d7e2ea1f84a25cff85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529776, "uuid": "1335fbb7-bb2f-4d39-8967-902b0dc09777", "comment": "Malware payload (Dridex)", "value": "2a7e66dc875ecfa50d940d5a86aff7f491cdff7c35a19ed1e717db1f0d6cd6e590de0c9e012402df83acdbdeebc7d29e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529776, "uuid": "ced7e654-9aae-410b-bbe4-ab1276074d00", "value": "A604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529776, "uuid": "bcf83586-24eb-4534-8012-6a0c1d844276", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529776, "uuid": "00a6eb5a-0bf8-4848-acbf-eea18dda9bf8", "value": "3072:Di49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:DH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529776, "uuid": "e1ed4d62-e21d-49a9-80b7-0c7a48dd98d9", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529776, "uuid": "a8971862-785a-4fff-b3b3-60f81de1b18b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529776, "uuid": "298d3b49-968a-4168-9de5-a1b999317a16", "value": "f5b995dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710d69a2-b96c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621516096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516096, "uuid": "dfa2e9da-0ee3-4ac7-9e5a-c27f3d673475", "comment": "Malware payload (Dridex)", "value": "ed4c9af76fcb061ca50684f796fed8f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516096, "uuid": "8c8a7596-8bd9-4cd8-ae11-1deefe02c183", "comment": "Malware payload (Dridex)", "value": "2ff68862097fffbd5afb8b37d3af4aa59835c55739a781128e642333f0bca311", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516096, "uuid": "76a11713-f8b5-42a4-ac88-6467464d55ee", "comment": "Malware payload (Dridex)", "value": "cc5efad6ba37246eff70187a7753a7e0201b2514", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516096, "uuid": "7034d2b0-db91-4817-9c22-af33b490acd7", "comment": "Malware payload (Dridex)", "value": "d2f29d42d4332cb1b59fb72fe9606dd367c99443c5b273deb3794865beec5adaeb07e15b274249acb968f0816f9e3ce5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516096, "uuid": "fb58f3f3-1925-4fef-a4e0-c80bddebd4af", "value": "67F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516096, "uuid": "397aa06a-ce70-4c81-9fbc-c183f4d954b5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516096, "uuid": "85c16316-56ce-41cb-8526-11ce9c8ea304", "value": "3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516096, "uuid": "9ca3cf34-435a-4f8f-8667-4422ae568113", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516096, "uuid": "3e6276d2-471d-43d2-b95c-73dc5e3609b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516096, "uuid": "7f627320-a1cb-4803-91c7-e2f0561a8a52", "value": "ed4c9af7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4ba087-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533131, "uuid": "1c990990-d518-43d7-b4e1-9bc1a22d85f7", "comment": "Malware payload (Dridex)", "value": "65048e80c4cbdbba683eeca164082802", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533131, "uuid": "c4c6068e-763d-431c-8a81-1181c992b1a5", "comment": "Malware payload (Dridex)", "value": "304b3b1d9e7be10b65cbcef5110f6b01afc2256f56558adda03a8c08e3e79304", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533131, "uuid": "46ab8c8f-dfe8-4d90-986f-965a612317fa", "comment": "Malware payload (Dridex)", "value": "ad04d57c8038437497c7532b81351979d883bd5c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533131, "uuid": "fba3f46f-1a13-4bce-9dce-0e639025d6ef", "comment": "Malware payload (Dridex)", "value": "0fcbe50bb5a36c20e280391eb0316d86db3304a2e005046f37c18a5b7a503e5543f742ced28c2bd683fcde7ff7eed183", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533131, "uuid": "c48d1363-8e6c-4915-a12b-0ea7ec843058", "value": "9FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533131, "uuid": "70a52e78-61eb-4032-8262-542a05013855", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533131, "uuid": "f01dbc28-b110-425a-85de-51c7373cafcd", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533131, "uuid": "ae271414-80a0-48a1-b3f1-2dbb22e537d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533131, "uuid": "848ae1aa-9a67-4907-aa83-293b30ec7d97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533131, "uuid": "975828ec-6d27-4de1-aebe-b4f4104f2028", "value": "65048e80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29c0f58-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621487054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487054, "uuid": "d2debd22-18ea-4b5f-8808-b8029c289918", "comment": "Malware payload (Dridex)", "value": "a5b4511e517fd4c0b2c9078b145de2e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487054, "uuid": "3da9bda4-d93c-47ec-b824-6711d77ee1cb", "comment": "Malware payload (Dridex)", "value": "3059176edbbd871f0709331c513f26ecd9a2818cf18a808bbfb1d6cb2b5d1a97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487054, "uuid": "eacfde02-c13e-4689-954b-ee4369901a2e", "comment": "Malware payload (Dridex)", "value": "b60eb4e17aaed918519b955fca66dc429eb70bbd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487054, "uuid": "68b9d086-c75e-4983-8251-552f0de3c2e1", "comment": "Malware payload (Dridex)", "value": "1b5138e3d2efba5a626b15fe21074783049504fa99d557fbc54f1ce81c3d567c4b363bdc3d62fcd8aebab669bde6c037", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487054, "uuid": "60212597-e558-4842-ab9b-6e0b546bd3d0", "value": "42F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487054, "uuid": "66b022bf-0ad3-400a-9213-e153e876319f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487054, "uuid": "558b89f5-8e75-4c59-88b4-5d0555eccf40", "value": "3072:RiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ieAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621487054, "uuid": "0b012d30-2d98-4ba4-8257-82933784d754", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621487054, "uuid": "80748663-98a3-4bd8-8ae8-7f8b1fb2a504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487054, "uuid": "a22fc1a0-890a-427b-8a87-f3df3f01c868", "value": "a5b4511e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff68d29-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540200, "uuid": "c5d377b4-d828-431f-b20a-a623173b45df", "comment": "Malware payload", "value": "19dfb578e9fcc93d3acb821baa986a23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540200, "uuid": "41d667a8-2df3-4061-a810-aa25ee1f4a7c", "comment": "Malware payload", "value": "30ce91faec4f67207180773aa798438ee52b7e349cd464ba5d58b64cbab8e90c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540200, "uuid": "6cb1bb1f-b83c-4e5f-8763-c4288820c6b5", "comment": "Malware payload", "value": "686d1b11ef612d1c5ca7793b24d4b298d1f773e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540200, "uuid": "13768352-e274-4fde-8bae-dd1cd58566fa", "comment": "Malware payload", "value": "fa0f1d8f97bc61315eb19c37604972a5e42f20ae387af157887770b45eee0138dc3fe4cd9141a4920487d8773c1dab65", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540200, "uuid": "e08088b0-ea32-4c96-8cda-9b33d24f6cc6", "value": "1404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540200, "uuid": "470fd8af-3e78-4639-999b-2b865507751a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540200, "uuid": "35b2a3cc-47ff-4b6e-8696-93711d7a1c9c", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540200, "uuid": "d641677b-c8a8-43b0-ac31-6ddbc3d776d6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540200, "uuid": "25e2feb7-8d21-4218-a001-6f9a0fd86f88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540200, "uuid": "c355f08c-31d2-4892-a164-e42835dd8fc0", "value": "19dfb578_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfebeb9-b954-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1621505646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505646, "uuid": "0ef8aeb1-011d-4948-8e44-5747866014bb", "comment": "Malware payload (CoinMiner)", "value": "1c710fe1f3a4fd64019bc51cef0c4b55", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505646, "uuid": "d2eae7ef-12ec-42e3-85e7-1907362c81e0", "comment": "Malware payload (CoinMiner)", "value": "311d8d2015aef7abc15f91fbfddb956ff1ffe7b869ab26835ffd709f26ff02b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505646, "uuid": "8eb68b8c-89f7-47bf-bcaa-59e94c3f686d", "comment": "Malware payload (CoinMiner)", "value": "17e1a40542591b6a5405a3b681ecc89e8c11fa42", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505646, "uuid": "5ee07109-a07b-45c5-88d2-f7a130826356", "comment": "Malware payload (CoinMiner)", "value": "2d82c51ef67be5aca03ed22e4b2c9e25f0f813e8889d6aa876fb1a5ab1b6b1114ecab2bfe6ee15e8cfe8e975e1303a54", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505646, "uuid": "797aeb7a-81c5-4fc1-8c4b-6fe0e3b0d864", "value": "734633C5953B083356C4FFDC64E178B478B30389F7B72AE9D19E564C692AF18D4206E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505646, "uuid": "ddf9f48c-ff4f-48b6-9cb3-34b43bfe2f69", "value": "98304:PCTYHiuI8iJuwwMp/ATgqHlz3Mq3aZFqL2CGnFXMopu4kfHaQ4lcqO2sgTkW/KzZ:P5Hiu9iJwMpWFLMq6qL2CSeq66cqO2sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621505646, "uuid": "6073411e-e886-4928-ada3-457b580d9221", "value": 5720088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621505646, "uuid": "db94cc46-0261-4bac-9e02-9c71aee79f38", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505646, "uuid": "94e84dfe-a4c5-4223-9aa9-baa2c75c3210", "value": "1c710fe1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1280864c-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545573, "uuid": "c3d158dc-d97e-48ef-90da-210de3715d6c", "comment": "Malware payload", "value": "579183a2287845e99ebaf57ecef113e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545573, "uuid": "1342015c-7a59-4cfa-9c27-ec2a6296cdda", "comment": "Malware payload", "value": "311deaaa01b92ec1ed27a6b6253435d0a25577cba199eff8c3ac6eefde6fa11e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545573, "uuid": "ba56f417-4ea4-4c89-a861-241487c8fedd", "comment": "Malware payload", "value": "54e57b65bfe4b1cd3834309068d8e6032357a48a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545573, "uuid": "72a67dde-20d7-4113-ad17-06a08f5d23c6", "comment": "Malware payload", "value": "7676d0677835858941d5fb30d9dea2ebd33989f32870e46903023a10dc0b8f302b1ba928c673b7c51952f0ac4caac67e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545573, "uuid": "d6ade334-0709-4255-b83c-6482f4ea8b82", "value": "48F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545573, "uuid": "ed43d301-29ca-43c0-bcf3-6607425b7902", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545573, "uuid": "8bade0f8-36dd-43df-b27a-3e9a77e9aa0b", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545573, "uuid": "dfac930a-bc93-456d-beb0-d42c74462fac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545573, "uuid": "6b210fd2-e7d1-42ac-bfa2-7b9ea7b3b422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545573, "uuid": "4001f922-b1fc-4504-b252-2bbd92d0f9da", "value": "579183a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab10fbd-b9be-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621551466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551466, "uuid": "950b034f-9193-4e26-8a94-5e56e7f9e903", "comment": "Malware payload", "value": "b82735cdb37e245411ae5e010a469b1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551466, "uuid": "7aa5590b-95ea-41a4-afc4-3c5b2847e0dd", "comment": "Malware payload", "value": "3122a671aa158cdd1e99a9be7faeed4cac91f5619db4784a3f47359f1c548624", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551466, "uuid": "d93db329-3858-49aa-80dd-e35c1df14b44", "comment": "Malware payload", "value": "e26bfa35d1146373089a09eaadd25aecad90857e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551466, "uuid": "bc480a29-7748-4d3a-be9b-81cceaad02e8", "comment": "Malware payload", "value": "bebc4eea7b052d2c9d98d7fa1594e9ff66cc3be072a53d67f9b7eb38568e8e05d6914b326125396a9e36f1fe91279e4c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551466, "uuid": "cbcac205-8713-45a9-a2c2-55c8c59746d8", "value": "5004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551466, "uuid": "b75ce1a5-a5b3-42f4-88e7-f70036ee51dd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551466, "uuid": "552c20f8-0fc7-41e9-ac7d-c5c71696c29b", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621551466, "uuid": "11676151-a0d1-43bf-917c-7360e4cacac3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621551466, "uuid": "a84225b0-a7c3-48c9-86cd-60fa3aefa4c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551466, "uuid": "a4f5dc00-39ce-4720-bc89-12e5926a5ae0", "value": "b82735cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f168e78c-b95c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621509440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509440, "uuid": "c0fe02ab-c0ed-4bfb-892b-612d792d88b3", "comment": "Malware payload (Dridex)", "value": "4e4b0a426fb511fc9fcf4683b8c77e40", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509440, "uuid": "c6586ab2-6be2-49d3-82bf-7ffc51f60b6e", "comment": "Malware payload (Dridex)", "value": "315495867622c8c4112b7f3bf26b20f62dfe2727aa425b65f437e996718be3f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509440, "uuid": "7c2bee71-ac7f-4b6b-8d68-cccbe4ee1f05", "comment": "Malware payload (Dridex)", "value": "34fdd711b04ae9161a87b78301cb5b4e3bf103b8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509440, "uuid": "b8e48659-bf98-4230-8681-3f1a99007ade", "comment": "Malware payload (Dridex)", "value": "2479bb83681746c8b1ae4eb292ce7781be7945f6afd8ccfd0be2f81624e578d1203d7e99490df0642dff06a3fc4a475e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509440, "uuid": "8a6f6db1-8632-4d40-915e-acaba8b981fc", "value": "94F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509440, "uuid": "f713b8ac-d25b-4415-be6e-6a67f58edbef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509440, "uuid": "43b909b1-ef60-436c-9d9e-3aab6fe960f9", "value": "3072:3IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621509440, "uuid": "11aac353-c205-4795-9a76-60b8203b2de7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621509440, "uuid": "58c4965a-c32c-4149-8336-393b59080e63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509440, "uuid": "2c1385ee-4535-4419-a7e4-6ea6706811ac", "value": "4e4b0a42_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9753d3e2-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529905, "uuid": "c2da8606-271a-4752-89a8-ba63b17d2a81", "comment": "Malware payload (Dridex)", "value": "d831febaef1a05fb4d248e5874e4e428", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529905, "uuid": "a26ef892-97e8-4611-95a3-8d8500ef64eb", "comment": "Malware payload (Dridex)", "value": "3160c5c3c64f0bf1aff58a8b0281251cef334af3fe74891f188b2695c97951e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529905, "uuid": "5252a3a5-8204-4c5b-a26b-fa6854772887", "comment": "Malware payload (Dridex)", "value": "44c135bd48cad1893cc3a7b296598c01f288b53f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529905, "uuid": "dbea61d1-fc71-4277-8158-3c54819cb454", "comment": "Malware payload (Dridex)", "value": "6c6320f8b59488b2168864e226e0fad5c6a8ed07c420e4ebaa42000b320731ba1a9da57f32bdc0a4be820753d18e1142", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529905, "uuid": "f0f3c387-6605-415e-9df5-5716a1bbb6f7", "value": "0B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529905, "uuid": "31811456-1eb4-4610-a322-506f875ae67e", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529905, "uuid": "9aaa316a-dacb-44ae-ab8d-d0bae012756c", "value": "3072:ni49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:nH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529905, "uuid": "abbb6b54-7898-4b8e-a4e3-093e30243870", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529905, "uuid": "41f9ac60-50f2-49d5-b8b2-6b58a66ec1fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529905, "uuid": "9ff40a17-d728-4b7e-8386-c3fc4ee840f7", "value": "d831feba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992733a0-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537209, "uuid": "de00d0a3-56d9-4293-b6cf-aa4d21762363", "comment": "Malware payload (Dridex)", "value": "2f93c5a566b7a277ee463c932249418d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537209, "uuid": "f4113a2e-ed78-4e1b-bfe3-622f96232f79", "comment": "Malware payload (Dridex)", "value": "316d4371ea57c9eb028746ce32c426d7a9c0af46c5c41e83ed929cf7103faf2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537209, "uuid": "6962192b-51ea-4edb-b3a1-90171593df1c", "comment": "Malware payload (Dridex)", "value": "40e40d832f946d86af95dcfc79137e5598aee209", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537209, "uuid": "2740bd2b-b32b-4ab9-a123-3a0147b46efd", "comment": "Malware payload (Dridex)", "value": "3a4fbc34eb0c5a65a087e2e40f51dea0bb5ade4018ea973d173597109e918bb75e505c18e45f197c48d38c223688b82c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537209, "uuid": "e8f36ed8-697e-4d3d-bce8-06cc6df26feb", "value": "5A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537209, "uuid": "d4e599ad-67b9-4f4a-bc0e-d1755b230e95", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537209, "uuid": "52e9f400-5c19-4628-8566-968061835ce1", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537209, "uuid": "5556dfa1-c0d3-4908-b3e7-0739b83176d3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537209, "uuid": "4f4272b3-321d-43f2-989a-b9482f795d82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537209, "uuid": "cd801e4e-cb89-435b-a44f-b9bcff3c48f6", "value": "2f93c5a5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f541d50-b970-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1621517838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517838, "uuid": "84a62a6b-dca7-407e-ac2d-d4c921ff6d60", "comment": "Malware payload (AveMariaRAT)", "value": "ba238aab80697e0c6479431b775fd98b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517838, "uuid": "3f0433ca-5d86-436f-8573-084f9570c72d", "comment": "Malware payload (AveMariaRAT)", "value": "316defa7aba9f42e2e5adc55ba4669303c1a341b68d2e6cf8e1ae3807cbac1e7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517838, "uuid": "15025e1b-7ad5-42a7-8ac0-41eb245f0b5e", "comment": "Malware payload (AveMariaRAT)", "value": "c8ecc52cc128a599eecb34b51e3dcf4f5fd17aae", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517838, "uuid": "bc34cc95-f747-4b4a-9c52-4dff038bee01", "comment": "Malware payload (AveMariaRAT)", "value": "a48037b7826f01d011c9b7e29a41f7d3d1a84dd3c42a945326582f391070b047fd6a203d4dcc6bcc4ff014e863882b11", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517838, "uuid": "3eb9c0a6-464b-4247-9e47-6b216503cf29", "value": "AC24ACBA2D8ADD1AFC1C0AB1D43576CB412CED2278C1AB59ED81F1C557A322C36E425F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517838, "uuid": "c575d3a0-80db-49c9-8a37-f8b9cd6f42bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517838, "uuid": "91e84a8e-bfa5-4ae9-92f5-8be31c6054de", "value": "3072:gBGZOn+qYYyCSw1urulYTjhUAGCPBJdjrBHrNGyHtignXRwzfs4Sx7N5ivgOHKWg:1On+N16lYTSuftlnX74Sx6HqWY15yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621517838, "uuid": "a29a0c09-f0de-481b-a824-01f546519470", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621517838, "uuid": "cd25088b-df6d-4f1b-8658-c1f20d1c7ee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517838, "uuid": "412990b6-d265-4edb-86ac-c0a358b4f2e6", "value": "Order Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf84831d-b96e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621517087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517087, "uuid": "4284dd95-ac4d-477a-a818-2216426f921b", "comment": "Malware payload (AsyncRAT)", "value": "05881230e3ce34cd29eb4275714664df", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517087, "uuid": "8ecb2a28-0e2f-44ce-928f-36b62dd8459d", "comment": "Malware payload (AsyncRAT)", "value": "318c01d9dd181cb0103214b7ad6752cdf8fafc47348942e2b6613d64d52f27cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517087, "uuid": "672d135b-37af-44f6-915e-3c4ebcafadcf", "comment": "Malware payload (AsyncRAT)", "value": "9b9700fc008f6208f13b40ee4030f429cce468e5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517087, "uuid": "984c9ba2-09b9-4c64-a1ad-cf68fcca160e", "comment": "Malware payload (AsyncRAT)", "value": "c52ee3181b7cdf2519373c4ee8890893273a0c3938d03775039b4296dd6762a9737c43dad507e3cd4683f7409ced90fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517087, "uuid": "27d77355-28ff-4513-b667-e256a2f97630", "value": "8FE11A7C950A0850E6DFD9D6589F3DB30272F2D789CB1649236DF974AFE31432E05884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517087, "uuid": "de50c7e6-22fb-498f-807b-0db31784bebe", "value": "96:cB+33v4PRz3TzvBL7e+42ntSVkc6rDCLxNDF:2If4ZDlLRVtSV2rDCLxNDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621517087, "uuid": "57447ddf-f1d1-49fe-9d8b-925d19c223e5", "value": 7341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621517087, "uuid": "28820a0a-0f98-4661-a507-59ac9aa4311c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517087, "uuid": "3761c75d-7fc1-479c-b21c-d42439315ad2", "value": "faktura 0835.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ff5d07-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472484, "uuid": "b971e4df-7a31-44c8-819b-950ce1519f04", "comment": "Malware payload (Dridex)", "value": "5f5d2fe5d1cf5b8c05e9708b27b16b51", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472484, "uuid": "e291a73d-561d-4712-97c1-36ecaca3391c", "comment": "Malware payload (Dridex)", "value": "318e7d9afec18e8a538a0f757a1003c2025cb42e8826c2a071d28a3ee91c516a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472484, "uuid": "bbfca1d5-2b52-428b-9dc6-e569f358a634", "comment": "Malware payload (Dridex)", "value": "127cd82d469c7ab1e642077ce3000c5deeddef1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472484, "uuid": "18d60c26-aefc-42b8-8786-b7432902780f", "comment": "Malware payload (Dridex)", "value": "857c5d784aff798eaeeb18836bbf2813c2a483d63e6020c6d1403004e67b9dcc16f79fcb3eb1e9269207a2f7918df461", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472484, "uuid": "daf7cded-d35a-47f9-843a-0e55c1778a77", "value": "DC04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472484, "uuid": "5eccd086-ea79-4004-89d9-ef14d1b7efe4", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472484, "uuid": "b1bc5451-dd07-4126-b837-4c1b17ad5165", "value": "3072:hWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:hWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472484, "uuid": "9ecd991a-cf76-4482-a2ae-161278bfc22d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472484, "uuid": "411aee9b-44ba-43be-bdc0-4b6a728ca2a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472484, "uuid": "a8248653-a91c-4ebb-9e79-08cf094af138", "value": "5f5d2fe5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e511cbeb-b930-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490521, "uuid": "5bc5dcb9-da4a-4b0b-9757-3cc5a0776c8a", "comment": "Malware payload (Dridex)", "value": "47d1204cee14f176c75dfbd1e61291bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490521, "uuid": "bd364bf6-a45e-4575-a0f7-9bd874af41e7", "comment": "Malware payload (Dridex)", "value": "319f16c25d2feb2554d0250269d19449c42245d23dad1a3bbec6d36d69d968c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490521, "uuid": "97bcebf7-e9f4-41ad-8a3c-042ee4179cb8", "comment": "Malware payload (Dridex)", "value": "3f3fc1e78f50eea342cf9b51ac39ddb4e9ccb32f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490521, "uuid": "22a39892-fa6e-4ae2-a647-e744795b7db1", "comment": "Malware payload (Dridex)", "value": "8a330832277565b791c06bf82c8953a3ca0e068a04c01c89a6523318bfbbf42d4ab6c9b21e5401c21903f484930bd88d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490521, "uuid": "330f4567-c82e-4a8d-87a7-dd7e5716576d", "value": "7304BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490521, "uuid": "937b7848-27c9-4599-abd2-cf38d7c6113d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490521, "uuid": "caa028dd-4630-44e5-a4ac-b7e0028b7314", "value": "3072:8i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:8H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490521, "uuid": "90f75ba4-b5f2-45af-b992-3aa5ed075032", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490521, "uuid": "d92cab10-70f6-467b-ba63-1483bbaaa117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490521, "uuid": "b1569ffe-f63a-470a-9312-ea679ca4bed5", "value": "47d1204c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563b50c6-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536238, "uuid": "41396f57-4fc7-46c6-80c0-b6febe15085e", "comment": "Malware payload (Dridex)", "value": "25623cb27fd69ff13e8f2992300152fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536238, "uuid": "2b179468-6c51-4c95-97e6-81b2e6310355", "comment": "Malware payload (Dridex)", "value": "31e383122361f81e9ed034dee632c73594acde592b3914a9b843cbc74bd14aa2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536238, "uuid": "8df2c7fc-98d4-4ce8-9f17-9f516d9ccc50", "comment": "Malware payload (Dridex)", "value": "74f053f7551822f9c99322d7c1902c199c49a675", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536238, "uuid": "2a50abe2-591b-4a90-bf81-0ffe4ad13755", "comment": "Malware payload (Dridex)", "value": "0b8f78327efe568f5c16150e246b8244997171ca2ccd19deb3147f04fddce5497454855b01b7e69c2414e9b1a7bc1c71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536238, "uuid": "a6963acd-dd10-47a0-8ad0-3d4021de9b93", "value": "B804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536238, "uuid": "d8fa7841-db60-40bd-8a3e-d89b5805ca5d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536238, "uuid": "24e87f1d-01f2-4d47-a429-3aa3c81b51dd", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536238, "uuid": "bc4cc72a-1cee-4f52-a4b5-47abd2ff4329", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536238, "uuid": "3e188077-c367-496d-b797-b7b2f28837ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536238, "uuid": "344b29a4-f709-4009-8f2a-5ea58a5757d6", "value": "25623cb2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992f6a7a-b939-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621494259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494259, "uuid": "5f5067f9-9184-43c2-b26e-82dbd0f94c47", "comment": "Malware payload (Dridex)", "value": "29c36dabb34aee35c711250089bd0592", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494259, "uuid": "37a21fbc-6d2f-47fc-abc8-27340114a62e", "comment": "Malware payload (Dridex)", "value": "31f412f40318fc477d173d8b51fcaf37214e9e91724eb17adee96eda216ec708", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494259, "uuid": "68e49208-8f4f-48b6-8175-d732dfa62ed4", "comment": "Malware payload (Dridex)", "value": "93c6ade51a404af1e965f58867c9a09f357fee91", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494259, "uuid": "c39db00a-559b-42dc-84ea-375463d644bb", "comment": "Malware payload (Dridex)", "value": "49198ed8513c3f19862805e4117d9b6bd9ed2cc9afb8cafefd603a5f8f01bc2e1e39e590cf77def104506bd329d0945b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494259, "uuid": "672c3b08-2d44-41e8-b3b9-401abe572718", "value": "1D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494259, "uuid": "7cce5b93-59d9-48c2-a453-7b8a351718d5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494259, "uuid": "7f9fb73d-98bc-47d1-bec4-faa6dc2de262", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621494259, "uuid": "197037bc-1192-4445-bfe0-426a66dd9c9c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621494259, "uuid": "9ab57bb2-8b4f-4741-ae1d-da6c33dfe7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494259, "uuid": "93a5c58a-de8d-4bf8-bbc4-9ec5376a2544", "value": "29c36dab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9ac296-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479719, "uuid": "3f8b11f4-9d0a-4598-b17d-b270ea12eebb", "comment": "Malware payload (Dridex)", "value": "3954333ad363efe04042abcdd1bd8097", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479719, "uuid": "5ac71836-c07f-4f32-9f2e-d4bbaf7f9446", "comment": "Malware payload (Dridex)", "value": "3238dc303b4817e576077155d253ae4667816eeffae5c193b33fc0c2a3a0101c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479719, "uuid": "854c116b-c438-4189-9c2a-8a5f226cffbc", "comment": "Malware payload (Dridex)", "value": "3c666360b25d0c11fd856f17aa65284edf1b285e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479719, "uuid": "df3dc5c2-bac0-4cf4-bd5b-66636228d06a", "comment": "Malware payload (Dridex)", "value": "e1b37af4b9aaeed538b580352cc47ede235d285390bacc539a30fdf01fc34cac39a7dbda5fb34dc6c641460dd2e71535", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479719, "uuid": "eafa26d3-ac8a-4ca3-aa4f-7798216e6f85", "value": "C7F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479719, "uuid": "fcebe1c7-e6ec-41a9-86c4-9dc1af123a29", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479719, "uuid": "e3437f7c-d99d-4b49-bb00-687de6acdb79", "value": "3072:5iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:qeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479719, "uuid": "9b28aef4-d400-4c90-a5ce-37b4fb985a76", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479719, "uuid": "28b01820-9cfb-4ba0-9a85-3ff70c3636a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479719, "uuid": "2d1a817c-be66-481e-8f64-c0b9e4180089", "value": "3954333a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd65c40e-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539874, "uuid": "5151e9ab-84fb-4426-a393-8a41b3d7ab35", "comment": "Malware payload", "value": "c21ecdc6b64d85a3be4e5b53e33f6d71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539874, "uuid": "3dbd4dda-0499-416d-bec1-0920b1b7d140", "comment": "Malware payload", "value": "323a770a0792b43ab7fcbeac3abc1f753e4e22aced59b43063a70dce8a22e73e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539874, "uuid": "fd484881-00c7-4810-8ace-2c6fe31a5df9", "comment": "Malware payload", "value": "0e9859b674231a6eedde137c195c473ee144fd60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539874, "uuid": "2f17a4c1-0348-412a-a8a6-c8bfdd4ff6c1", "comment": "Malware payload", "value": "52a3ed997e694764d7a328c28284cf94a2e1138ed9b21d9e4c05fad18efd7379389c66276fb38a5e9ae3e61fea8ea03b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539874, "uuid": "284dc0f1-21ed-4971-9cf7-3e8c85451ad2", "value": "2604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539874, "uuid": "159d3b09-6587-4561-82bf-c21ae6b460a8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539874, "uuid": "5811d878-b2f0-4ea5-a668-6be3a00d86a7", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539874, "uuid": "97d1818c-5555-4c1b-92a2-50fcb5c63963", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539874, "uuid": "a61c764a-7619-4dad-90aa-85e3edb5a5a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539874, "uuid": "ef57b7ff-6a2c-4ca6-b627-256e2df6b2b7", "value": "c21ecdc6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62272302-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539694, "uuid": "797051db-5736-4f7e-8e39-92affb5640c7", "comment": "Malware payload", "value": "a1b96ceffc48f1f3b69602ff7f275063", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539694, "uuid": "2ceb0b1b-d7d4-4565-bdec-d91f608b1668", "comment": "Malware payload", "value": "324291e56ce71da88fbb6a50cb309788320840033089fd1de2add95aa64f4796", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539694, "uuid": "1a79f954-249c-4ec7-9546-71acad3eaeff", "comment": "Malware payload", "value": "d827034684e935212ec7f22c93f32d214cccf850", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539694, "uuid": "7e7ae59c-3ee9-4b83-9750-8c320816395f", "comment": "Malware payload", "value": "b86b32905a958441a329f63f1c03ea2deaa77d4d3e8ee7bb513e65591944d37b1632a92762984c016c8e1345b5f3248d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539694, "uuid": "70cb08b2-c86e-49b1-a4a8-b96ab995d44f", "value": "5A04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539694, "uuid": "6f1a8d33-1e97-4548-9820-d85434798aef", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539694, "uuid": "46448937-dc84-48a2-b7e8-e988dc2aa02e", "value": "3072:6WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:6WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539694, "uuid": "0e92b5b5-c5a9-4e27-9173-92afb410118d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539694, "uuid": "edf8a1b6-9795-4783-b70e-cd69490c58ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539694, "uuid": "13afeeab-2aa9-4af6-bc6b-7ee391d4d352", "value": "a1b96cef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613782df-b969-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkComet)", "timestamp": 1621514781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514781, "uuid": "e27469e7-ab37-4d2e-8306-4974b6a4e281", "comment": "Malware payload (DarkComet)", "value": "003b08b0ce8bb863e5a9bcfa7a20a2a3", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514781, "uuid": "ac2fff4b-6b01-44a6-ad17-1835f442b37f", "comment": "Malware payload (DarkComet)", "value": "3249eefcf27f03ae89ef3c85074bf00be3e5dd251ec8d52200a731912487bbe3", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514781, "uuid": "5db34327-4e26-4520-92d0-3ddc622d93b9", "comment": "Malware payload (DarkComet)", "value": "df93956e25c6f799f5976d9e633c5646a2a20638", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514781, "uuid": "cd27de7c-6e88-4cf0-b27e-7a89d77fab66", "comment": "Malware payload (DarkComet)", "value": "fd16d6f265ea341c647109f77ec0b048448603526c1d63c1b7660d08f565040ad314579cca5ac4f28d1c1453e6c34403", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514781, "uuid": "6126dc40-c295-4b9a-96ef-a42489f9bbb3", "value": "4405233C7442D229D64AD3322C73552C5B2AB047E6993BA716C81973F75B80EFB2CD92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514781, "uuid": "098fd7bf-b462-42be-923b-60d78e0abc98", "value": "13edbd590e2231e6371820a3d2d85606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514781, "uuid": "45079b83-814a-4e45-b0ac-d3b6d2ffd525", "value": "24576:SN2HlIPFwGvhaYt/vc1iHHNsgnTpZ9lOv+lZ:reFwGg1ihnTzO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621514781, "uuid": "895da29e-1f75-47a2-af9a-a60189219b61", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621514781, "uuid": "d3bf454d-d38f-4171-b19f-acb47f68868b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514781, "uuid": "e536f360-bd38-4ed4-8451-dfd252c697b3", "value": "AntiVM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677f5997-b9b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548722, "uuid": "42c0ec64-cb08-4520-ba1a-b05169f69063", "comment": "Malware payload", "value": "afd2a0d6e3fbeda5f1a0d1abb91773ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548722, "uuid": "ffd8e27b-6c04-47b5-ae14-2d4cd63ee92d", "comment": "Malware payload", "value": "32e511255690388a214f6d1b2a100def71510d267f4ebb96677e2448b441090a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548722, "uuid": "4b2d6119-562e-4b88-a661-1c2566fd7ca7", "comment": "Malware payload", "value": "64530755ba45e15c6901123c3fb424f0356f477d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548722, "uuid": "61e67074-36d1-48cb-ac03-5ff952a5dc4d", "comment": "Malware payload", "value": "c5f6e2fbf28b4886ea2201708ed0c3ebeec21078eb30a463ce1dd66a57f38f424b76f865efb622ef836256912cb4dba0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548722, "uuid": "c1d7dec3-db1a-4612-980e-48fcca538fcb", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548722, "uuid": "02e2c837-e3d6-4fda-b954-9cc9e7c719ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548722, "uuid": "cc8697c4-9779-4c2c-8a09-476acff3997c", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548722, "uuid": "8bce9ffe-d199-443c-bcaf-07a45685c2d5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548722, "uuid": "aec76e7e-3337-4dab-97ad-b4a9e9ab6f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548722, "uuid": "69580e83-0e0c-40c1-9441-1f5bedbfc35a", "value": "afd2a0d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa478bd-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535520, "uuid": "aef373de-e808-455f-8d2c-da59ec87458f", "comment": "Malware payload (Dridex)", "value": "a0fdada34a601fe841fdb521e55ce240", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535520, "uuid": "aaacdf13-5145-4e3b-924c-514cfec6e6e6", "comment": "Malware payload (Dridex)", "value": "32eb6ac60803f91855950fa6576111815f48419fae0045ae1221fa71804c6c53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535520, "uuid": "49872b3e-9c4d-43d6-bdd0-a856db523bd5", "comment": "Malware payload (Dridex)", "value": "5b194ca6e1290089c32e7b7e18e1fe1a460ae96e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535520, "uuid": "1044cab2-179a-44ca-9d54-12ff7739bbae", "comment": "Malware payload (Dridex)", "value": "3a029527613c2901aff1cd7ce7f8f921ad5ee473c7e9cf59d0a2550d7364b780491dfbb8cc810bb12085877b57dae919", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535520, "uuid": "63c6814a-614c-40c1-adbf-64ddce323293", "value": "FF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535520, "uuid": "fbb1d669-05bc-4eb6-a041-c430fc1303eb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535520, "uuid": "0aedf29c-eafc-489b-ae27-7f098d22818c", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535520, "uuid": "f8aedcdb-2ba1-46f0-862d-59fa48278176", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535520, "uuid": "2477e930-e625-4029-97a0-33dbdc9e1801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535520, "uuid": "627134e6-ee01-45dd-a19c-33edc1351a7f", "value": "a0fdada3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4f751f-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529757, "uuid": "b03f62d3-8df8-4e7f-8296-330ca2cb1dfc", "comment": "Malware payload (Dridex)", "value": "67494618d5463b81bb17b690f662094d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529757, "uuid": "7ca34d5f-f65e-4eab-ae51-0b417593a3d4", "comment": "Malware payload (Dridex)", "value": "3318fbaa438c4a78963aa0a59676887d46a57af5f05675ccf0f8217492e43469", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529757, "uuid": "7b004c73-4912-4ff9-a086-a71f7534bf59", "comment": "Malware payload (Dridex)", "value": "2dda270e4b812b2daebe282d214d2b4d58ab28ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529757, "uuid": "a75600da-4187-42bb-9bf0-2bc794f3c324", "comment": "Malware payload (Dridex)", "value": "00301acd612c9f4959d2bc55057088fdbd4577803dbc0bc9890c5078e7a31d5e8296814e46d07f61fcd6cf307c150c33", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529757, "uuid": "3bf79c3d-c734-4fd7-95a7-094a561d5f34", "value": "CB04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529757, "uuid": "4a3dc148-e8b5-4776-ab4d-70bf43b7e558", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529757, "uuid": "0d650365-6ab2-4569-9533-a05f1666802b", "value": "3072:hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:hH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529757, "uuid": "1e1b60ee-c545-4770-a857-16dc6112ff3d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529757, "uuid": "b30f4586-8467-43cf-8adc-d08abff0ad6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529757, "uuid": "9eeb25f1-3696-4210-97a5-d6bf0e3abb75", "value": "67494618_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720e33f1-b983-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525977, "uuid": "1027a0a4-fde9-4891-9c42-5e1f0c2fbf9a", "comment": "Malware payload (Dridex)", "value": "d4f69836d62be889efa864cb50376954", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525977, "uuid": "91848f64-80ed-47c3-8921-720d161fcbd2", "comment": "Malware payload (Dridex)", "value": "337d866148698871065c772449f2846098545fcf87c28766e6692ef43f4d9e8c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525977, "uuid": "90e8f5a9-068b-4248-8235-44d24dc0887d", "comment": "Malware payload (Dridex)", "value": "dab76fddaecbe9b44e200fd5dde7bc3abb79c7ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525977, "uuid": "d072a36e-3209-4a21-a771-8b6db67b4d2c", "comment": "Malware payload (Dridex)", "value": "35bde9ef801d571374a1b4ac9186ca411d4a3de8dab463273574503114ccae8140bc8143b9ed375afd4f5538a63baf20", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525977, "uuid": "d1786766-2010-4ee6-81a7-38642224aaab", "value": "FD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525977, "uuid": "829782af-455a-4df2-bc06-302c499c4499", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525977, "uuid": "d7d61b5c-d353-423f-8d82-f3d6e1cbd803", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525977, "uuid": "81f7fb7a-dccc-4b72-a66e-62a1de3b3c3d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525977, "uuid": "a7eb28e3-b649-42f5-883b-fa387736bfe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525977, "uuid": "e6cc3a43-8d3a-47e6-8b1e-040a4b4fa659", "value": "d4f69836_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c1a2ac-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535960, "uuid": "7790b23b-4bac-460d-a326-eba100e53060", "comment": "Malware payload (Dridex)", "value": "294f6ecb8b08f7a19ce8deb3fc90c225", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535960, "uuid": "8edd25e2-ea41-4eec-9d21-142e2977b5b7", "comment": "Malware payload (Dridex)", "value": "338e34ae02a0036cd0cac05d7fbfb2e222697ccd48896e824c1b41f11ddb7932", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535960, "uuid": "f8cd8a8a-2866-4d38-877f-06ec38d5889f", "comment": "Malware payload (Dridex)", "value": "a5056e255efd7bfea2259f6215c706f7a32df312", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535960, "uuid": "344de5e5-7aac-4175-a508-e33c3dd61e8c", "comment": "Malware payload (Dridex)", "value": "800c365c5626b01b864e6ce4e3ef3a62b88748e380dc1ca48b4f9422721f92bfda82d16a5031308d419efb9989aca70d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535960, "uuid": "96b83725-e175-449c-b368-f77ecbeef982", "value": "39F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535960, "uuid": "aa645a2c-ca96-4b6a-85a4-b9b590c5d028", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535960, "uuid": "d0a09ce1-c4f3-4210-82b7-d5703cec6563", "value": "3072:+A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:+3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535960, "uuid": "be911fce-e8a8-48fa-8063-56c687eedb72", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535960, "uuid": "9dff458c-f3ec-4cf8-b31e-18ed012a51c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535960, "uuid": "e2f60148-168b-4931-a2b6-6fc9a9bf0cd5", "value": "294f6ecb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed7342a-b94b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621501839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501839, "uuid": "5c05da69-ffad-474b-b42f-052eec13b1cd", "comment": "Malware payload (Dridex)", "value": "81e5f6b7796b96dd4fe7de6b006afa4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501839, "uuid": "d3bf9f7d-3d89-4feb-aa11-8f13425479b5", "comment": "Malware payload (Dridex)", "value": "33e986cbb1196199d5c3bcdefc086c22b8f93bfc38e154e4a1994cdc52b481fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501839, "uuid": "3b17d3fc-bac6-4d9d-97c3-68035d497e15", "comment": "Malware payload (Dridex)", "value": "0dccfbc80ce217547bbd2f8b732dc2f9fbd75b31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501839, "uuid": "eae1f827-9a57-4a13-b55d-1754cc2b8cd7", "comment": "Malware payload (Dridex)", "value": "d250e853778f90805a320c9205860d0fabaa3f08efdbbf6ac59e018285c338689e93413c0f11783baf37ff0f774a81b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501839, "uuid": "12ab9891-7da4-4489-be29-9a1792553625", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501839, "uuid": "3b13347c-135e-4275-96c7-0e2de201da91", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501839, "uuid": "3be6b6aa-6eae-44aa-98bd-223753b1d97c", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501839, "uuid": "36e23cc6-fd2e-4516-90da-e9212860ede0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501839, "uuid": "66a6ed89-3684-458a-8d28-b6e239ddc5b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501839, "uuid": "f4d1ebf5-2e41-45c6-bd27-c5cd4599d384", "value": "81e5f6b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3206582f-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537466, "uuid": "81ab8fe3-f70e-446a-9dc7-ab61978b90a7", "comment": "Malware payload (Dridex)", "value": "38018b5eb8dc4f8c91bd765123b74ef5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537466, "uuid": "f6140c78-6b6b-4b29-a3ee-5981af21d84c", "comment": "Malware payload (Dridex)", "value": "34276d242488bbc57c606ae1d5f64aecb333e1ccbdeb299c12d41c1f74560eba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537466, "uuid": "406b5bca-c851-4338-bb62-680f14a73bb3", "comment": "Malware payload (Dridex)", "value": "afd19ca32aa1ee3a3ad73faa368b66fc23e27a2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537466, "uuid": "273f09c0-aea4-49e5-b7d4-0f52961377b0", "comment": "Malware payload (Dridex)", "value": "d1535794f575f3486ae5d3e7b1e2e203f1f99c47bd9906ca9946450e8c9880843417a84cee082cf0951676f70fe5e82f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537466, "uuid": "d76bf4fd-32c7-4cf7-8b37-6d486eeb77b1", "value": "E604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537466, "uuid": "08b763a4-c0cb-41fb-a99e-8c0b9d7902b5", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537466, "uuid": "e2ddac8a-ed15-454e-95f9-95ad5fa6620e", "value": "3072:wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:wH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537466, "uuid": "822d87a6-ec82-4492-86cb-3661293921d8", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537466, "uuid": "e50b468e-29b8-477a-a4a4-09e952b8f689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537466, "uuid": "ce028243-f3b2-4c46-a834-6c6336e66a98", "value": "38018b5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50c3305-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "6ace8493-b1c0-4698-ba4f-413beddcf90d", "comment": "Malware payload (Dridex)", "value": "0a8a7a93c39ff93f6f8ecc2d29d576be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "af77654d-b9da-4f3a-bbc8-904f0df1fdc4", "comment": "Malware payload (Dridex)", "value": "344410bab090edc3ac22646519ceee8bce4d7922f1a89d9f5693ca7f938345d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "6fc4bf7b-34f8-428e-b0f6-5be62e26d646", "comment": "Malware payload (Dridex)", "value": "3984b98eb72ce47aca57571d8bb235f4cc92a739", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529203, "uuid": "2c7df6de-25b9-4ccc-a41a-5cf1baeddb7e", "comment": "Malware payload (Dridex)", "value": "97044deb7c69466981e67ee8a27b284558e00dc818d9c4a753308aaccca60a36cf007af47caa8396da0251dfd43376c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "3e33fea6-4c3a-44fd-965d-fcd250566d1a", "value": "5404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "44d134ce-68f4-4f00-a128-a0ac2b3a1c26", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "ac36cdf2-ccfe-4e45-a516-96edcc6e3c35", "value": "3072:oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:oH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529203, "uuid": "5222d508-a9e3-4715-b687-fbbdcaef7a0a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529203, "uuid": "60a5a4d9-fea3-4555-9729-7858b5ed2dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529203, "uuid": "f1801c57-a6cf-4bdb-87fe-647cf2c8ee4f", "value": "0a8a7a93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112da640-b94e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621503051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503051, "uuid": "36b9aef4-1f2f-4f9e-921d-88a84a8fbcd4", "comment": "Malware payload (AgentTesla)", "value": "0d134ee4884ff20533183ae8da35aeb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503051, "uuid": "c79380a0-5ce0-4267-ab35-2c9f85023c76", "comment": "Malware payload (AgentTesla)", "value": "34447645d08047aa1dc93ea1883cdaa78d32a9fb8db859d4738df40ff4e6515a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503051, "uuid": "c854ea86-a69d-4cb7-9b02-9888b0a404ff", "comment": "Malware payload (AgentTesla)", "value": "baca18022d3baa75c1e72a961ab82c6e298c985c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503051, "uuid": "195629f7-915e-460e-a870-e9de32345231", "comment": "Malware payload (AgentTesla)", "value": "0899df39d19c1cd4f926224373c6397a1203f5156388eb945663bef9a241b3088bd0f7dc205bef251b6fdd741cd9f9a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503051, "uuid": "a8d2b6f1-1047-4d57-9f5d-f534cb861498", "value": "0F058DAD325071DFC96BC976CAA82C64EA60747B530BD20790131AEDAE0DA87DF141F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503051, "uuid": "c30908ba-d0be-4967-b08c-01866143665e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503051, "uuid": "3e4daa41-6a38-4b91-852e-d0a17361844a", "value": "12288:mpAEjspVeFaZjxCT0hF20b9GW4sKhDukd+gZcyetBaV5dlDSLlSigXzH+zAI/aga:psuvZNCT0/db9r4gCcZoW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621503051, "uuid": "ba603e87-ccd3-4443-a917-33b778a22f53", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621503051, "uuid": "0750eec1-030a-4b31-b7fc-3c72058c72c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503051, "uuid": "2c9e9a2e-56f2-49af-b070-3e3ff1da7a1a", "value": "#8077272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d8f320-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534417, "uuid": "7a1430b4-8c42-4736-8930-0ad28ff18570", "comment": "Malware payload (Dridex)", "value": "a6fc87dbb28efa71b0a3e46177ed35d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534417, "uuid": "7c78c155-258a-4406-b857-67aefb2ddaea", "comment": "Malware payload (Dridex)", "value": "3451f740343eddf765eb188851c455ea09ba0c1a083efb906791c4e158605a15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534417, "uuid": "3734cf03-4f9e-4b16-9d8c-6e167db444e2", "comment": "Malware payload (Dridex)", "value": "8c0548b8f66b84d2c3993ab46e87796aa5c5a77e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534417, "uuid": "226bc5f8-01a9-4ce9-ae15-16f902879e24", "comment": "Malware payload (Dridex)", "value": "b57383c975bb4b5bc53a16908af9b67035ec902e6bb9be1d02b3693f9a490700b9f7cb1f49b7b53b749de7a22d0d3711", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534417, "uuid": "dfb9ad06-9c10-4827-8d15-d776c2765a2c", "value": "1204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534417, "uuid": "5f5ce50f-3108-4457-8bb6-35716329c868", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534417, "uuid": "6824d623-5c4a-4038-862b-815837a448b1", "value": "3072:ri49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:rH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534417, "uuid": "b358b7f8-e3c9-4d35-ac8b-ed6f5395b8e6", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534417, "uuid": "38663a8b-4ba1-46fe-b14f-d3d966fc6d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534417, "uuid": "d13ae00f-9526-4b75-8483-5a62d59aeee2", "value": "a6fc87db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69f0d61-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541231, "uuid": "53a14fe4-7651-44c2-a03f-48980f48b497", "comment": "Malware payload", "value": "4e6f8ef562c52ceb04afb14a36f63959", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541231, "uuid": "ae35ff48-c339-49fe-bd80-a9bd85194fba", "comment": "Malware payload", "value": "3456332b59657363b76e004f9c351b2d66088d0d843eee938a5c35615029f2f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541231, "uuid": "56056ae3-cba7-4309-aadf-36f791a1bc6e", "comment": "Malware payload", "value": "5dba7ebe37a90b739352c9eab5409c1b87fa1618", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541231, "uuid": "3a1f2683-85b2-43a8-850f-fb871095c300", "comment": "Malware payload", "value": "deb214f2bfddaa07c65a8ab840c701884ae04171bf23b1e0c23c2ee630b83b2ce849cfa83e880c67eae594bee52f418f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541231, "uuid": "e7f1d403-d337-4040-9892-f6cecfee6575", "value": "6304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541231, "uuid": "79ff8b08-390e-43ce-b09c-47719355be2a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541231, "uuid": "336634a8-c78a-457f-b8ae-2a3ace155371", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541231, "uuid": "19870e2e-d94e-4a56-8f64-9b15ea66bf45", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541231, "uuid": "86ce428b-837e-4186-bea7-665266d6fb4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541231, "uuid": "914fe1e0-0d07-436f-919f-1f8c3bb8be6b", "value": "4e6f8ef5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390a33f2-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528458, "uuid": "765e35aa-9b5f-4a60-a542-af6ed3b88ba5", "comment": "Malware payload (Dridex)", "value": "3092fd39fb57fc41fdacaa0eeea99583", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528458, "uuid": "9afc3261-b9ae-45b8-aff9-139240139a64", "comment": "Malware payload (Dridex)", "value": "34cece04e88d1c16b63d972f66df5f4c6a667c91a167d69d3665a0e145f48b53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528458, "uuid": "6ae63ef1-7a33-4a6f-b7eb-3117e1b27000", "comment": "Malware payload (Dridex)", "value": "eaa7bcd90b59bff5714d6869e9de295a073efa19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528458, "uuid": "cce28330-42a2-4538-ac8a-bd4f189bb3fb", "comment": "Malware payload (Dridex)", "value": "dcf93c5114cee2567a2bebc8794469a85f822b8b18a3182c5681142760df6e0a8a52bb5fc8ee3d1e9624fdec6136fbd8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528458, "uuid": "01d51238-91a5-4ae2-9bea-bab31169188e", "value": "0704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528458, "uuid": "36643288-f7e1-485b-b738-80b90115fd3f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528458, "uuid": "b72240f6-9bad-4baf-a2fc-feb769ef90b4", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528458, "uuid": "6d061871-64f9-4b4c-8f78-acd89034c330", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528458, "uuid": "bba54ea7-c8e0-4211-8a99-4910f90144c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528458, "uuid": "610a94e1-700e-468a-ae47-8a3fb989e1e8", "value": "3092fd39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d659bead-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543754, "uuid": "3ff814c4-7248-4cd9-a0d1-6cc9d6d48c26", "comment": "Malware payload", "value": "c7365d4a1a0d7a2cba122d1517ed8033", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543754, "uuid": "7474895e-7c28-4fe2-8a6a-a3bb24e0cf2e", "comment": "Malware payload", "value": "34f9250c053176669b65849669dbb2892ab9ce4dc0dc0a3eb968bf8c04790ab1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543754, "uuid": "3eed29b4-1566-4f39-b65d-518798ae8f89", "comment": "Malware payload", "value": "f5154a6f792a117b4800b60663975e1b0e05e73d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543754, "uuid": "74580b7e-b359-42a8-bba3-568bfd4c2ab1", "comment": "Malware payload", "value": "cc07e3cb62b282aee552257812ae59b60b3445002263d4cec064b5faf70f70a00ec8c645d9e0829f41276a2427da2d87", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543754, "uuid": "c035d13c-bc4e-41eb-91ff-0f42983a7de8", "value": "3C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543754, "uuid": "0135acac-0719-464c-aae6-7094af650a33", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543754, "uuid": "3af59fdf-a7fe-4aca-95ad-0b53e2c32d60", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543754, "uuid": "663854d7-915c-45f0-9c1a-705a723be8a9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543754, "uuid": "c94c3681-8e96-47fe-af2c-b52078cae162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543754, "uuid": "642b54a0-8fca-40cf-a51a-4a6f2b4cddb5", "value": "c7365d4a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b1bb6c-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540805, "uuid": "1cfbb17b-7029-49cd-b67e-5f3195305d52", "comment": "Malware payload", "value": "ae79d4042ed5a82b1a48dc453e49c5a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540805, "uuid": "8030beff-1db7-4713-811c-0478b89f441c", "comment": "Malware payload", "value": "3509465a5f0d89a35a5e893d774da402b1c7bb575d538fa9026652d48f9ec2c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540805, "uuid": "67b22728-1ed6-4e61-a813-fec0e0314ca4", "comment": "Malware payload", "value": "b70875641d82631a86c1a2260fc755c75efface8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540805, "uuid": "a1d1fb2d-0690-4b96-8ca5-3db4bb29b3d9", "comment": "Malware payload", "value": "a33fba621962bb02c2c5956d6c6c6c4b372faf379c65eed0fcd826801670fd9b955cf632ea1d0185d8b39882b13edcc1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540805, "uuid": "0936b568-b00e-424c-9712-1955702db017", "value": "6B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540805, "uuid": "d1641141-8ce4-435b-b9d9-a064006da616", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540805, "uuid": "ca3838ad-9b00-4cc1-bcb7-557ac58cf2a0", "value": "3072:rV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:rV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540805, "uuid": "5701b94b-74bc-49e7-b880-7e697219e49a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540805, "uuid": "8302003c-d283-4afb-a308-8d2aa11f12e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540805, "uuid": "eddf2138-a6c0-4cba-97a9-75a85bf71812", "value": "ae79d404_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707395f1-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529410, "uuid": "0a6fd46c-d7b0-4fbc-add0-96a7330382ef", "comment": "Malware payload (Dridex)", "value": "7974eb87b3601907c881c2c0fd5c3627", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529410, "uuid": "378ace32-974f-41e7-a84a-3774e1cca696", "comment": "Malware payload (Dridex)", "value": "351226850bad69b7d45c6a6ed3a01fa04e9bbaa2f692d8942e26935eb7f210f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529410, "uuid": "2abd135a-08bf-4462-9fed-f38d61ff2ee9", "comment": "Malware payload (Dridex)", "value": "e7cb5cb8ce36247bcf09e2f3ac874f02e4c091c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529410, "uuid": "2223c60f-e361-4394-8472-df05d114aafd", "comment": "Malware payload (Dridex)", "value": "a95476a13e2e854c85cad9129e4d471f0787c0c6d80d40c3219b0129cb11699af7b19d04012848f0999888dabfc7b4a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529410, "uuid": "83ec884f-e689-41d4-916f-40d3d188683d", "value": "4F04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529410, "uuid": "41ee835c-ad0b-4421-a861-886c90b8d9b7", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529410, "uuid": "ba8c77ee-6ada-44b3-a094-f86e1f5b0fb5", "value": "3072:Ri49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:RH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529410, "uuid": "f726a35f-dc25-4933-972a-7fb37bb6faeb", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529410, "uuid": "c2fd6704-efb1-4078-8ba4-2c6dc45a788e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529410, "uuid": "f522696c-f203-425a-be8f-64745f04b4b0", "value": "7974eb87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d418c893-b974-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1621519699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519699, "uuid": "36070460-5fb2-4095-a017-f9991413630d", "comment": "Malware payload (BazaLoader)", "value": "c344e0908b85d5fda0f5c51e815d977e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519699, "uuid": "2a17637f-746f-4f42-bac9-eb84e87f04aa", "comment": "Malware payload (BazaLoader)", "value": "353bb0de2e0c9f16d17f74e81708c2cd7cbf07cf5845a8652f0f27f97d8a3161", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519699, "uuid": "d202268d-6b26-4014-a34e-bc8685c5b7d4", "comment": "Malware payload (BazaLoader)", "value": "89ac7dda13ee5d38f33b069fa190b49ab1a10055", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519699, "uuid": "bab2bb63-c372-422d-856a-43de12852b2b", "comment": "Malware payload (BazaLoader)", "value": "25acf61dec9d011dc4b17d30e80f72b3e1a07934fbbb00753625f511af5d5ae337022a930e76617b2457753651628464", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519699, "uuid": "1999d474-b989-4291-ac66-50563f094ae9", "value": "5D548DA576A514F5E07A823AC9966A6BF771781247209BCF835417634F23BE0FC3E780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519699, "uuid": "a5c4fa20-fedb-47e4-bcd6-00423db3db16", "value": "f141510b7f0f89c34de124db5eae649a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519699, "uuid": "f8d4f648-b8e7-4873-887e-e5ea44ea80ae", "value": "6144:kI1Fscig7jAE0g6n3rPB4b569ncFqea9Z/2TB+ZAqIU4YA6SPhnAcX+4Jt+x9EEN:Yb1R2TIGqIU4YJSpt+4JUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621519699, "uuid": "be659a98-3b96-467f-8c11-008bab0161d0", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621519699, "uuid": "7f5a3a42-7244-47d2-9a37-efc0f6641c7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519699, "uuid": "a55d95bd-90e0-4000-914d-d7288e15905d", "value": "c344e0908b85d5fda0f5c51e815d977e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d74616-b929-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621487135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487135, "uuid": "c1561a08-0fbd-4763-b7de-f0cfa6805488", "comment": "Malware payload (Dridex)", "value": "6b01d420e7c9bd9abf64c134d1b6317e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487135, "uuid": "a6216253-534b-4336-b3eb-775ff893ddc9", "comment": "Malware payload (Dridex)", "value": "355a42f1702f09f511657d3bf0aec9f7d40af0c6fc4aa368c23963872a30f66c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487135, "uuid": "6abdfec3-1a54-4623-981c-71d9d4ee72e2", "comment": "Malware payload (Dridex)", "value": "a82322db605456a9440bdc450a11713196e7fe96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487135, "uuid": "a530ffb7-ff86-49c5-b9e4-f7d1f1ecfbad", "comment": "Malware payload (Dridex)", "value": "d66cd4755856e146584de347c04c263cedfbcc48c52f7cc4bd250fff5798521601d7303aeb3c876c2528702b53510ea6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487135, "uuid": "5ead4eda-bf6d-4250-b304-aef359bcb770", "value": "64F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487135, "uuid": "955362ab-5179-44e5-b9ca-74c69b484a55", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487135, "uuid": "bd9b971d-72be-4772-bbf2-371c869b7a98", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621487135, "uuid": "05192d85-1458-49c6-9a3c-ebbb6f9c6ed5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621487135, "uuid": "04cee28e-9edb-4047-8998-8067dbf267a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487135, "uuid": "54aec80a-8552-490e-995b-96fbe8c27590", "value": "6b01d420_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e495952f-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541201, "uuid": "7270c589-60e2-48e9-990d-a47d4764dffb", "comment": "Malware payload", "value": "fa16c779df2027b28be7786d68c4aac3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541201, "uuid": "3f17ba45-b1a2-458e-9da4-0ac45ac06312", "comment": "Malware payload", "value": "3576511a637879ceec1b2d8b7eee27aab43e687cb059595ad0ff379fd6b3d84f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541201, "uuid": "a21fa779-a906-4937-89f4-4dca6fddaccb", "comment": "Malware payload", "value": "3d4e1f038470fcfd472d039302b1df7c74dbc3eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541201, "uuid": "7353c938-6ef8-415c-98dc-e9927a5400a0", "comment": "Malware payload", "value": "b4481d14b4abb1b0133c9a109e2c5a04fc475ab87170b90ec2940709911d63a798f03c4c41de1c18801d5ecef13794e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541201, "uuid": "b70c2dae-2784-4e42-be50-d841e133ad11", "value": "0E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541201, "uuid": "ad5098a9-90ba-4e02-9844-afa0c1c4857c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541201, "uuid": "b8eaf7ea-2bdd-4d84-8e39-3ab2fc47a3a0", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541201, "uuid": "dc4f083b-114a-45b4-98f2-f26d88c73f88", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541201, "uuid": "8acbacbd-0829-48c4-90da-875a9184ca1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541201, "uuid": "974aa32e-beae-435b-b960-8a474c725ed8", "value": "fa16c779_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799e217d-b97c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621522983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522983, "uuid": "c1e45376-b5cc-4c7d-aa81-81ba4fb547a1", "comment": "Malware payload (Dridex)", "value": "6877f5efa3c34f9bff5ad23f2edf4c15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522983, "uuid": "c3d3f42d-c5cf-4e3b-a5b2-37cb3a88b910", "comment": "Malware payload (Dridex)", "value": "35ac81c2e403c5dd868ea8e9b00cbbcc7e9d56aa8a6a3f9aa49061ab85acdb81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522983, "uuid": "c4a2c2c3-44e2-469c-8b1b-180818fe0294", "comment": "Malware payload (Dridex)", "value": "ae0bce69ebcef7d322971947ba3619c8576bbae1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621522983, "uuid": "faff3a2e-3280-44c4-b0f7-83fa1e8882e8", "comment": "Malware payload (Dridex)", "value": "f0fc77cd16f3f97851251f1cdb6116045a52f74086f009ed6da1c9852c40f1d5b0e99e7c1e77571c7fabf821df612486", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522983, "uuid": "f8ef180f-00a2-4c02-b64b-89450fcfd927", "value": "B104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522983, "uuid": "82e0c97c-a490-43e6-b760-820648827512", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522983, "uuid": "ef9ec546-6cbc-4d37-9c43-d6b6a116fbcc", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621522983, "uuid": "3fc9cbf9-2f1e-481f-aa53-0de1732e84fc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621522983, "uuid": "6d349205-583a-4988-aede-da7cc8560bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621522983, "uuid": "2c10fbce-0162-4fac-a04f-3e06b1697f26", "value": "6877f5ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cb3954-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534061, "uuid": "893f2d0c-5897-4be6-9236-348d4c8ca823", "comment": "Malware payload (Dridex)", "value": "eecfe8b3208aba1d80d9a02332457908", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534061, "uuid": "f8c22cbf-45f7-4a6b-a4a5-0c648189d4c9", "comment": "Malware payload (Dridex)", "value": "35b9ac2508cb14125a467ded0fc670fcc3bf49d7ee878349fae0ee9764ab1d30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534061, "uuid": "4bb669e5-2e8e-476f-aece-65c8af1ec757", "comment": "Malware payload (Dridex)", "value": "d90248aff57df55e375e8af3cf3b148caf4fc676", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534061, "uuid": "bfb12ab5-c3fd-4e32-955d-50c58a4cadc8", "comment": "Malware payload (Dridex)", "value": "dfa5c02a39e7c01ddb77b12010808e95d55792857173be91e94ef469dfdfd5d97aaacf558486939039b0b38aed8d3b77", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534061, "uuid": "09172cba-960b-44ac-8bdb-41b4d6b4c9ba", "value": "F604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534061, "uuid": "7f212d77-5a1a-4b27-bf3e-25717dc39d9a", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534061, "uuid": "fb0c2398-0db6-4c4d-bf4f-a33a9e6fabf0", "value": "3072:qi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:qH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534061, "uuid": "4bb36ec2-73a7-4661-b435-99c06cd44597", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534061, "uuid": "8410f673-aeac-4c89-ba0c-2f94595d5440", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534061, "uuid": "34e6df07-b2da-489c-8c44-32935166bde4", "value": "eecfe8b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2761e161-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483331, "uuid": "244595a7-08de-4d99-88cb-086324245610", "comment": "Malware payload (Dridex)", "value": "1a7f6775ef4f7437c078cf6bb1adff82", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483331, "uuid": "b4c94869-98ea-40ec-90b9-b82563af0ad8", "comment": "Malware payload (Dridex)", "value": "35c00d2aeb942374d1d45b088895341e8bdd0322203f19f975e1dff7478c0c08", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483331, "uuid": "11b8aea4-b9e9-4785-b175-ab49215b7895", "comment": "Malware payload (Dridex)", "value": "86d7bbeac85a4d452057bf8aa132d0f3ee53c918", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483331, "uuid": "461e9516-ed6e-4195-a83f-5b21196b189f", "comment": "Malware payload (Dridex)", "value": "3b29982d5a2df417021fa1df3be6ce1fd7a6c63ed12fb23b426e2b26b405f842c45d41d68b142f29464aafed6eeae220", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483331, "uuid": "9b9e8c7a-c3a3-492b-9536-a9e9c6fe2c2e", "value": "0404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483331, "uuid": "c720c131-845b-438e-a89e-3c1a554a105f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483331, "uuid": "ba2d9338-d362-40b4-9e7e-c5869c1375b9", "value": "3072:mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:mH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483331, "uuid": "18dd88ed-a1a1-4d1f-a685-0eeae8e6ef87", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483331, "uuid": "8e9f0e2a-95f7-48e2-93b7-9baca0ad0fa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483331, "uuid": "b8e0b8e3-9ef4-4943-8f61-9d46bb676bb1", "value": "1a7f6775_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fd5fbb-b94a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621501686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501686, "uuid": "7e31ac89-b6b1-42c7-bb80-a9b39961e732", "comment": "Malware payload (Quakbot)", "value": "667621cd9c6bd9fea5e3f39c3e86d5c4", "object_relation": "md5", "Tag": [ { "name": "HANGA GIP d.o.o.", "colour": "#0B9FFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501686, "uuid": "4c8ec05a-dcae-4e84-b555-9e3ab4c5f6c1", "comment": "Malware payload (Quakbot)", "value": "35da4d2933a33cb05a95e16d24ee1ff7c47472b03927b7cee7c3d912c6058c0f", "object_relation": "sha256", "Tag": [ { "name": "HANGA GIP d.o.o.", "colour": "#0B9FFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501686, "uuid": "5e9003a2-9764-4f81-bd5a-57ba225ef681", "comment": "Malware payload (Quakbot)", "value": "38fc59ffb4424b5f84a6ed111637e3751452d26b", "object_relation": "sha1", "Tag": [ { "name": "HANGA GIP d.o.o.", "colour": "#0B9FFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501686, "uuid": "63765677-b628-46b6-82a4-3eb270a81154", "comment": "Malware payload (Quakbot)", "value": "dbcaf983b3caf6ec02928b33df1cefb6b94675dd340634605539a77341bf71b2e108f72575345d4cfd0aaec03abc0d18", "object_relation": "sha3-384", "Tag": [ { "name": "HANGA GIP d.o.o.", "colour": "#0B9FFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501686, "uuid": "c4048f6b-ee13-43bd-a234-b186b835f0fc", "value": "6AD4AF27F6A0883BD23737399C9B5294AC35BE403D25684B2FE81E485F7C7C13A66197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501686, "uuid": "25df286e-f38b-4884-a266-7d95ffef291e", "value": "10e37e0ce018a4fd350f9b7a5ff59306", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501686, "uuid": "98f5fe64-86ef-4301-a61d-379a84e636f5", "value": "12288:dEvFJKbtxj9tpSs8cXQ/Vuphf30l6+3HwIKrX1U95RcYPXjnNt:diFobtDSIXEVupRy3QXrX2ZLnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501686, "uuid": "159fa587-5171-472b-ad41-ed0e766ca0cf", "value": 635336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501686, "uuid": "b00802f9-bc4f-4fe8-88b3-7555acf19ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501686, "uuid": "3586f517-8e94-450d-95e6-c2d04af83359", "value": "35da4d2933a33cb05a95e16d24ee1ff7c47472b03927b7cee7c3d912c6058c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8db570-b930-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490507, "uuid": "57bed23c-65dc-4a50-9904-b200606b134a", "comment": "Malware payload (Dridex)", "value": "0f855bbddb956a422dc8c4818164d44a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490507, "uuid": "a697493d-7a32-43f3-ab03-d6ffaa710e3d", "comment": "Malware payload (Dridex)", "value": "35ee289939e9b6b5e1dbd11ce3cc7b3c55fc2fb37ec9d2d376bf224ed50bfcca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490507, "uuid": "c7f0ac31-1c24-4637-b18b-a25dc93314ee", "comment": "Malware payload (Dridex)", "value": "c3f75e97a4b8a5afb050985d4b421564b2e5abd4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490507, "uuid": "937f9fe7-cf0a-41e2-8d5a-eace3fb94ef3", "comment": "Malware payload (Dridex)", "value": "c0cc9264f756ca21b7edfef69079fc0c371457eb5d1180921190335d477b67c5641624147efe338ce64776fd2038db55", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490507, "uuid": "619a0e85-c558-4965-b33b-224767a32e86", "value": "42F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490507, "uuid": "8b1eea62-2760-48eb-b1d5-693d93a14a44", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490507, "uuid": "82cbb14f-feee-4887-ab83-2551668cf7cb", "value": "3072:VA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:V3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490507, "uuid": "b388923c-39f7-4ef7-ab8c-bebc72d7643e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490507, "uuid": "0e6e4cb9-06ed-4a90-8f16-d08b3414cec5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490507, "uuid": "bb5353b5-f455-4822-95fa-a870f3071d68", "value": "0f855bbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f09b1c-b9b5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621547384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547384, "uuid": "f685408d-c780-4273-8124-7464a81e26f2", "comment": "Malware payload", "value": "bf89fafce6a7948a9b5b21dae0a3959d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547384, "uuid": "c7826831-772d-49ba-a2c4-e1b451560cd2", "comment": "Malware payload", "value": "3616315ffda0b517e7171d04bbef918e50686a668ce679a9066166a2a918b519", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547384, "uuid": "f146c359-2b54-4bea-832d-788283b97634", "comment": "Malware payload", "value": "e4918d7b4812c373d9dbf9732c229953df5352b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547384, "uuid": "b3d2e792-00e5-4509-bd30-413a2ab3e3a9", "comment": "Malware payload", "value": "81d6ec4f3aa00b539868a3d4d5f8cb9be9b825b64206843ecb0a4acaebe03c2dd8bb545566e7f6514c74b375287f62d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547384, "uuid": "e36dc971-809b-4f17-9efe-0dac161b179a", "value": "1E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547384, "uuid": "353366b5-9271-471d-9d7d-e782fefc1be2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547384, "uuid": "7ab860e0-84ab-4b2d-bf5a-e040e837717b", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621547384, "uuid": "a628d87c-e368-4eea-8b38-735c7f098869", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621547384, "uuid": "79c94737-d82f-4364-9fda-d65250cf5691", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547384, "uuid": "c93de486-bc3c-426e-a139-6b31a1881a14", "value": "bf89fafc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d271dbc4-b9c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621553626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553626, "uuid": "6a73ee40-956b-40aa-a8dd-62e3baea3a56", "comment": "Malware payload", "value": "22abf6933a8f5b57c3e4e6f244d11020", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553626, "uuid": "de446eb7-46d7-44ca-8f05-1d733091a1da", "comment": "Malware payload", "value": "3673052df24f1bbe4e819b20bf6ec3195d9c70607a220a5de9d23d77e74b3205", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553626, "uuid": "ac792b4d-11fe-439b-a26e-27cde48b2f51", "comment": "Malware payload", "value": "f67511e5879947bf6e3bd83499587bb5b9d5d21f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553626, "uuid": "cecf47b8-19fe-4fe1-a3f7-cc2f16c73e6c", "comment": "Malware payload", "value": "29a5e71dfb21cf4692b7e607deea176cce7b6ea66cbb25c7a6e9131d2990b15608132144e03e6b4841095984f6db04bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553626, "uuid": "ba4838f7-4d43-4c8f-a220-a26581bd208c", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553626, "uuid": "b44dad8f-4c4a-4c6e-abdf-cc050d37b7eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553626, "uuid": "62a930fd-0226-47de-9f4d-d8ef316e43d4", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621553626, "uuid": "0558db1d-b4a2-4c55-b8d4-26ed9f2b74af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621553626, "uuid": "577e1cbd-4909-4706-9693-383bd0b3a132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553626, "uuid": "dee114d3-5a78-4b69-94fc-2869d6583130", "value": "22abf693_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb36a5b-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535900, "uuid": "7dd07f97-b018-4dd8-90c1-f7eb4cb88dd6", "comment": "Malware payload (Dridex)", "value": "1ec904e175fd79a741983994e1ebd4a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535900, "uuid": "1344c8be-8115-4324-97b7-1e6bf600ebea", "comment": "Malware payload (Dridex)", "value": "367a913f501bd2d3cb48321ed6dcb070269a1623075d02e9caf8f2deffc623d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535900, "uuid": "0d15c00b-8169-4f7f-899c-17cd19d8c6d4", "comment": "Malware payload (Dridex)", "value": "a0e8a3e02a4cbb2bbd9843d6368951434f03c880", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535900, "uuid": "d8b516b4-5aa2-4a24-8cd7-799caee63dcf", "comment": "Malware payload (Dridex)", "value": "c0bcc17fa82fa9b48df1db2cc5fe841b45eb014e96a34db60a17b50d17cbd04de06b55495749efe6a77ed3fa596e402c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535900, "uuid": "58f9f79b-a670-431a-b88c-6611cd601d14", "value": "A604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535900, "uuid": "dc2229b4-cc55-468f-87a3-cdd33c70ee35", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535900, "uuid": "58b5995c-a812-4cce-961d-f7a9811e99eb", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535900, "uuid": "96a2a3d4-1af9-40f3-84b2-00b5dcaa3c25", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535900, "uuid": "6695b686-a335-44cc-91f1-1d6ded5c0b43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535900, "uuid": "0c2034a5-c72a-44d5-86c9-af8ba0b47a05", "value": "1ec904e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004d526c-b9b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548549, "uuid": "4a1fce72-6d5b-4a60-a3e2-93ecbb5da16d", "comment": "Malware payload", "value": "b51fcf30912d4a115a5c2c541187b7eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548549, "uuid": "e8ddb637-6529-45dd-bad9-eeead475b493", "comment": "Malware payload", "value": "367d5f09531d788a35975d2a9cf1959c5ab1049e2df8046c957f09c0ae301cfd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548549, "uuid": "4e69e467-1350-4cfb-8394-2705b9fedc9a", "comment": "Malware payload", "value": "54f686cd711be3ecb65a80eb09858bf2fa559b4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548549, "uuid": "0fdd38b1-7d23-4ccb-97fe-af136152bd6b", "comment": "Malware payload", "value": "0c478c009495359bc909366158a36b9b91b13681852d13af8eb3b6dac05e03cc4a3c22b569a1d946b7547d8bff014ef2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548549, "uuid": "84cbcc89-ce92-461e-b9af-f0eddc9422ef", "value": "B004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548549, "uuid": "66b2c7f7-491d-4f58-91c8-2d955f845582", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548549, "uuid": "4846d549-8bcb-46df-b63d-3fd40e645b47", "value": "3072:UV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:UV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548549, "uuid": "91373183-a32c-4bcd-8402-bbc6ad21442e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548549, "uuid": "fcc6f3b8-a8be-4e67-acd5-ab111331dafa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548549, "uuid": "ebea7042-e132-4e7e-a3b8-7a1375f6dce5", "value": "b51fcf30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3dd3cd-b971-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621518291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518291, "uuid": "6504eaa0-ff4c-449e-811b-5ae7ab9b40d5", "comment": "Malware payload (AgentTesla)", "value": "fe1ffd092335b557accfa06c3d5ac369", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518291, "uuid": "27e6708d-42fa-4a3c-bbfb-71dc654e1999", "comment": "Malware payload (AgentTesla)", "value": "36a73f74c68119b5648f061c03044204250525b5fd37907ed8d991470aac7a37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518291, "uuid": "124a56bb-f692-485d-9566-49530d631aff", "comment": "Malware payload (AgentTesla)", "value": "a86af14f627e20636b40d147534afcc61f54a7d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518291, "uuid": "ea5412f0-5da0-4592-a570-82d6d78ef21b", "comment": "Malware payload (AgentTesla)", "value": "6cd53c472d9cd2f47430fa2cd7b4e70c45dd694f8b5c5c87604c50fd182aef6258ba2b55f30b1e99c4d0c11c62311dd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518291, "uuid": "6a479440-bfcf-417c-9ac5-218b2145a043", "value": "35B41251239CAB99EE3EE73CB160E01403F4A509D752DB1CBF65A5BD0893F4B8678B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518291, "uuid": "8eb516cf-fba5-4936-a9cc-7780c1d0a51e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518291, "uuid": "36e5a49c-f21d-42d1-b96c-ff35e83349a7", "value": "12288:9ZJKzHdeKsxWeKOLLTomji9TATzJ4ZvE5FmEUrZi3z+:TEzHeWXMLTomjTNmvgFJUr83y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621518291, "uuid": "83ea453f-63e9-4287-938c-7f78d2ff9622", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621518291, "uuid": "855d93ea-a60c-460c-85b0-d7553ab247f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518291, "uuid": "e69d59a1-2316-4514-8ca2-0bb5ba299e29", "value": "Swift.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78315c8c-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535865, "uuid": "5c9d7811-cb75-4772-bd80-8baa9cc39cdd", "comment": "Malware payload (Dridex)", "value": "f9a4e04934e2fc472d13ba2650106850", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535865, "uuid": "0822bffc-2ca6-4441-802c-4fe6ca5469f6", "comment": "Malware payload (Dridex)", "value": "36b1aeea19ad6fe0f9e92ba6050ca47748cc45cef24ac37f7e181508e2631a7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535865, "uuid": "93380ee8-73db-48f8-8779-83b4b6e5d05e", "comment": "Malware payload (Dridex)", "value": "b5760d9ec74b6799222394cd87bc18a054056f91", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535865, "uuid": "d91db7ec-04c5-4f58-b470-ef9d588c1aa5", "comment": "Malware payload (Dridex)", "value": "665097dbb2bc6a89c1898299b794fe28a9e6cfd3367e508ed33b20aebca61fd05a45807cb0c2eed326e707ec31486916", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535865, "uuid": "7938c8d6-1061-4f68-9fec-3277486d7906", "value": "3B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535865, "uuid": "f518712a-7b4d-4769-a698-428f30fe195b", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535865, "uuid": "a83f88fd-63e1-44e8-9886-dea49ddf14f2", "value": "3072:ci49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:cH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535865, "uuid": "534fd013-fbe0-4df9-b1e4-5ac18d69363a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535865, "uuid": "a1f940e1-803f-4e0a-b51e-c753313f37ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535865, "uuid": "0bc443a7-ccfc-4451-a136-63cdbd71a00c", "value": "f9a4e049_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e2ebf8-b971-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621518359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518359, "uuid": "dd073bad-1bbd-4961-881c-e12e25f57355", "comment": "Malware payload (AgentTesla)", "value": "39f86f920105449fdd610cfdfe814016", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518359, "uuid": "ef3131e3-2bd5-4d35-a22b-0b29a0418de5", "comment": "Malware payload (AgentTesla)", "value": "36e3de8af61731609b6256d6d8d112dfb5f63fda5952fa33d78624da46b8320b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518359, "uuid": "18621596-53ef-4820-a1ba-059cea0d3cec", "comment": "Malware payload (AgentTesla)", "value": "7ca3f1cd164bffce45771d645a6b0d55f014a33d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518359, "uuid": "eff475c3-edb4-4f63-b807-9aebd0e49cce", "comment": "Malware payload (AgentTesla)", "value": "4660d98a356d9b7e1cca9f0a860c8479a5dd2a572d839563b4bfaf55e5c07b5ca26f84d6b0d4e6516d009ce8d96a09a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518359, "uuid": "3a229461-1f16-42e9-a415-a7ad935100ff", "value": "E4B4022867A4DF41D83E9B3801F2602403F2F541D653EB0D6F99A0AD7F63F9687A2356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518359, "uuid": "36e9fea7-c786-4e84-94ce-3ce6ba540073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518359, "uuid": "a3112597-2ce9-46b5-9772-95c052b7c932", "value": "12288:acn6KNXYsO8rsLmlzubTZinbvO+6e2IL8Kz:ac6KNX9CLyzElivb6etz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621518359, "uuid": "4f366512-90b6-4be2-a740-6d9fcfeb4a57", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621518359, "uuid": "74aab2d7-dde2-451c-874e-d9969b4abac3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518359, "uuid": "3cb46f59-b036-4282-ad49-3fcf68e857e8", "value": "Q20-274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9c51d3-b91f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483263, "uuid": "7858fc8b-7659-48c9-8340-52fa2b3c010e", "comment": "Malware payload (Dridex)", "value": "61d7e2348e15069cc2a938a5eeb19e49", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483263, "uuid": "3121afeb-5774-4cb0-8191-8d8beb20ccbe", "comment": "Malware payload (Dridex)", "value": "370826c38178ed730f7f5e45e891d5812ee6feaccf9d418543515ee5c6477b8e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483263, "uuid": "880acb13-a006-4a4a-b52d-1337eb957f2a", "comment": "Malware payload (Dridex)", "value": "593c17dcc67c4fb9727a52ff0864d07de8e028ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483263, "uuid": "51ab7273-2b29-4ac3-be9a-f81ec16bc1b0", "comment": "Malware payload (Dridex)", "value": "5cbcf5400ba8e031dbb495c36cad73ef394e9af9b0fb160a6194a7bc7f339e1803cfc618da9421d439721324dcd31a23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483263, "uuid": "9778546f-038b-470c-bb7d-f0bea450b2c8", "value": "7AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483263, "uuid": "8532bf12-e0f2-4af0-8b52-e7e6d0322cf1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483263, "uuid": "332d0c27-8312-4154-9cb3-2fcd896ece03", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483263, "uuid": "c8d25b67-aab9-48c0-b84a-9c686e9e4814", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483263, "uuid": "462e4702-f2b1-4531-b460-04b1a39a505e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483263, "uuid": "ffa3af72-446d-4bb4-8357-866858f33571", "value": "61d7e234_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a0b020-b9b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546471, "uuid": "69ce9a5d-4907-4a4d-8ce2-35a795504421", "comment": "Malware payload", "value": "10011dc53e096327c4b44c1cc6dd3047", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546471, "uuid": "0c3acb41-da68-4954-95e0-5afe9079d64b", "comment": "Malware payload", "value": "372994ed46f0e8b00e4f75472197debc2aa2b15f141596d50f407a854e9ed47f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546471, "uuid": "f6e64cf2-2cd6-4db3-88a3-25349455dae3", "comment": "Malware payload", "value": "cfc0c3c004e397073763f8b16641776965682fc0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546471, "uuid": "27b6e01f-18c3-4de6-a40c-5e978d326d06", "comment": "Malware payload", "value": "80abea018bc8c5400bdac986711131f4aa58fd6c971ba0a2c14208c781728000e2c4c3c3d56a953444f2f0d7c79f9dca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546471, "uuid": "6546c234-0fa2-46c6-bc51-de50d745c9b7", "value": "4404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546471, "uuid": "099d0453-0bec-4b81-8359-af2b0b608f30", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546471, "uuid": "78c404cd-47d5-4a1b-9e1a-b163785a5c60", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546471, "uuid": "258cc29a-d2f7-48c4-ba02-d9b66f7c9849", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546471, "uuid": "e44f0a02-9502-482e-8ee6-f809634dbbbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546471, "uuid": "9fa6da2a-5090-482a-a005-c5469899d3db", "value": "10011dc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1a441e-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539818, "uuid": "5396b204-d624-40d1-aba8-9272e4212ab9", "comment": "Malware payload", "value": "f39111b2f91c41bc919735e168a00c39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539818, "uuid": "9a984f64-d82c-4768-9bd5-d1f099daa97a", "comment": "Malware payload", "value": "374783d0f75b6d62302d42c13e67297866d181405af3206d044db1f2805db13a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539818, "uuid": "bb66da6a-4a42-472f-8e50-f9969e69fd40", "comment": "Malware payload", "value": "b3eb662bf70597318a648c86f254560908d5afe6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539818, "uuid": "d69dc184-d23e-49b0-86fb-20b46057f28e", "comment": "Malware payload", "value": "894fe101f56e64ce25948523b87ecf852dbfdc579276c92d611d0e7bb432e3af5f5dd0f67eff9842a4677b7a1603a7e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539818, "uuid": "f9e0db73-3b8b-4d02-b17e-05dcdce5703a", "value": "E304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539818, "uuid": "faeaecfb-20dd-45d8-aaec-9ab0a16e2bcb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539818, "uuid": "3aee5175-7bb6-414b-9deb-24a9b1c7d2d1", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539818, "uuid": "3f347a0a-a08d-4186-8bd9-8356657a3d48", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539818, "uuid": "7f76dff1-0ee2-42f7-9150-2c4f5cc9cb7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539818, "uuid": "3fc857c7-2a89-4640-9502-4eea4627f670", "value": "f39111b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7b0701-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483476, "uuid": "7455381a-57f6-47ba-9bc7-12054ab960ca", "comment": "Malware payload (Dridex)", "value": "4c48f9b7a4ab944d98f35979e875dfd8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483476, "uuid": "f7b74d2b-b48d-4bec-a5de-ca194b9cbf3f", "comment": "Malware payload (Dridex)", "value": "374a1c4267dcfcfa38001dfe94413d22d575ac0b208ae35d85948868a2336737", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483476, "uuid": "1ecaf66f-35a6-4340-997f-2c6ef7b764d6", "comment": "Malware payload (Dridex)", "value": "2f192ebd7dc37cdc1816cc793346ca141ff388d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483476, "uuid": "93becccc-c0ec-4c82-98a1-b372286193f2", "comment": "Malware payload (Dridex)", "value": "fbf7a822daa374cd418464de2c49baa280b443afb2ec2173e9cb6cdc64d2de2009c52cbd41bd6d39eff369acbbf646be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483476, "uuid": "6e967a72-8969-4849-b594-cf0785cff7c4", "value": "01F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483476, "uuid": "4405d8dc-e82c-46f3-bc92-da726659bb0b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483476, "uuid": "5f6c8535-6743-465d-9e34-b75ece71cea4", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483476, "uuid": "7c73fcca-0167-4233-89c3-3a5cb851aa3a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483476, "uuid": "1fe94036-2d27-45aa-8103-ac318e7a0256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483476, "uuid": "cf8c8c9e-a013-4cf6-9f3c-16b8f54b8877", "value": "4c48f9b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2960985a-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476033, "uuid": "90a91346-ede6-45a9-bcd1-ae50147eb93e", "comment": "Malware payload (Dridex)", "value": "45cc316503e8cbd64d70b60fbca91c5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476033, "uuid": "132cd7f2-be19-4a76-be29-f5b0de42f379", "comment": "Malware payload (Dridex)", "value": "37508ed68d8b96c8cdb02857e234f5a31c8482b4bb56c0d9b1edf58d3af47e2e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476033, "uuid": "a69fb3a9-7f87-4019-9fbb-0c59455105a7", "comment": "Malware payload (Dridex)", "value": "f9d49f009483cae9a3e8cb7f8fa3bbd3b68c351c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476033, "uuid": "9aa1a59d-b91d-4b7a-b3e3-22b4537fe0ea", "comment": "Malware payload (Dridex)", "value": "90f5752cd3d8ab1785fe432ef149a96dc6e68580842803dd89cd059e803e7ef29dac2964615494ccf5fb9aa7b1fad910", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476033, "uuid": "85318173-b9ab-4b93-9f89-9e2dfe20fbda", "value": "DCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476033, "uuid": "3bd230af-7f4d-48a1-b53c-9f8d0ebdcc59", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476033, "uuid": "2cbfb3f3-7d15-4f4a-ae95-470e27383c01", "value": "3072:Ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476033, "uuid": "afef1ea3-a22c-4649-8a81-45c9775c8210", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476033, "uuid": "8afee059-401f-4d76-88c1-23e7b130dae0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476033, "uuid": "2e5cd40e-710b-4282-b442-dafb5ad1f98e", "value": "45cc3165_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4121c628-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531907, "uuid": "ce53935b-ce77-464f-8f20-585a02fad14d", "comment": "Malware payload (Dridex)", "value": "510cb6e260460df25842d2da087019d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531907, "uuid": "f781a1c5-b690-483a-9b3c-38124a147e8c", "comment": "Malware payload (Dridex)", "value": "375e8b796ac3e54aadfd843d0de8dcc4fab1fd3a43363083d5921554b1bcc470", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531907, "uuid": "026601a8-d1ac-4585-8fe0-8e436a5dc052", "comment": "Malware payload (Dridex)", "value": "0b309873755d70b8fdc2dfe13174885e7d95875f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531907, "uuid": "f662c76d-f73d-4c49-b8b2-3cae2d292742", "comment": "Malware payload (Dridex)", "value": "1722bdf097771b5bc60afcfb776a574986de5da0345e4763907759b5208a025a2a8deef5a8db1140866743183a458457", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531907, "uuid": "749575c3-373a-42ef-951e-b262118eb059", "value": "4704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531907, "uuid": "39bdd3b7-e185-4f59-8bc1-1bd03d021084", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531907, "uuid": "06198906-5eea-42e6-93ae-c8395be39532", "value": "3072:Di49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:DH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531907, "uuid": "fac00a5b-f9cd-40a3-b4a8-40ca02304fd4", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531907, "uuid": "721d0cb1-15fe-4a74-8f21-49615001c5da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531907, "uuid": "be86f607-d20d-4fa3-a2b3-b6b0f2a6573a", "value": "510cb6e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eef5053-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621538722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538722, "uuid": "8d9db397-57c4-4dcf-9cf6-b487db8afde5", "comment": "Malware payload (Quakbot)", "value": "62c2b0f91bd5c7817e98e9c60afa27fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538722, "uuid": "724292f0-be31-4d1a-9564-6bc517eb3a11", "comment": "Malware payload (Quakbot)", "value": "37811565805d0410d1f88f67d722b4d51f3279421566878cf9382f57ab4b81b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538722, "uuid": "91e587af-4bdb-4855-b14b-4f027c9cb8aa", "comment": "Malware payload (Quakbot)", "value": "97d968bf8c997f3e98a4e1edd6030304f9c6f12e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538722, "uuid": "a8f7d836-9eb0-4bd8-9132-664c0b50418c", "comment": "Malware payload (Quakbot)", "value": "4c69da508c144eda715a5015ac28e721a0b668d746b35781183f916dc23f3f05d24370b91b7d28face906c96d8460f99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538722, "uuid": "21c48df9-6189-4928-98a2-2ede08b49a8a", "value": "7145BEA43586F132E46510318F95D9FC0728BD14AF5A0AEB37F02F9F6D6CAD26631722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538722, "uuid": "34859678-481c-4bbf-a4be-23e0bf510583", "value": "235afd40c5ee9abc074022775b07e058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538722, "uuid": "6a0af8d8-608b-494b-9069-248d74cdba86", "value": "24576:gpglnVHGGPPn8cedo46suFzpSBz63UUlL:gyVHGGsldotZpSA3UAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538722, "uuid": "434cd671-436a-4409-8712-8363894ccc3b", "value": 1247232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538722, "uuid": "ba187de7-84a7-4e55-93c2-75adfa333218", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538722, "uuid": "97a13748-0aa6-4555-a5df-3655f7df683b", "value": "44336.8072491898.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ecf5f9-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "3247d8c6-5b5b-47a5-b12a-66a243ea5430", "comment": "Malware payload (Dridex)", "value": "9ec707fbcf16aecee2efad78560e8167", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "d1b830e8-f2a2-404c-8d4c-9d0c78f5c2ca", "comment": "Malware payload (Dridex)", "value": "3781de3699190db8f4a01c1f03b7334bf9fbbe7d7c09e4e3c0cf8ef2af37b016", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "7ff1cdb8-a9ed-4673-904f-78c44d7085cc", "comment": "Malware payload (Dridex)", "value": "d82b9252f346cfa9d0ed6a4a889e4bd832cd20fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "a0f5072d-f444-43e8-a476-2c4000a9cf52", "comment": "Malware payload (Dridex)", "value": "d3cf3f446be181df5bdca9cbbe4f5bf97f1f1934c6dd84a730aaefaedffe7e12d8c5b2871aa93d0ea9cd5f6d1892d9f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "58bb7944-a72f-4f01-bc25-c3158ce376ba", "value": "1204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "975a62a1-7a5c-4c2b-86f5-ab4f12175c79", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "6c0d7ac9-04fd-41cc-8183-f363e4d109ea", "value": "3072:ei49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:eH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530223, "uuid": "2b895be2-308c-48a6-b71d-0861fd6f5ac4", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530223, "uuid": "610090bb-2afc-4856-80c7-00302d7b9ca4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "337980d1-bdd0-423e-8843-f6a1885eeb7b", "value": "9ec707fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0835e3-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537455, "uuid": "99459fd3-c671-4850-917e-f663b2783498", "comment": "Malware payload (Dridex)", "value": "52fc37a1b97afced67a39180495c3e2a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537455, "uuid": "84bfef1c-b684-49c8-91bf-062ef9c45757", "comment": "Malware payload (Dridex)", "value": "37b293910862dd47186b27ddbbfaa327eade7ec944e67ce0e3bcbbd5d391eb73", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537455, "uuid": "e1a78c91-bb7e-4f89-9011-7b554bb8bba4", "comment": "Malware payload (Dridex)", "value": "b9a404047a120e365db46cf79893c6575f1c97d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537455, "uuid": "1e33a694-6567-40a9-9467-4d9a9454971d", "comment": "Malware payload (Dridex)", "value": "23158685c9d9fb4ec4d802bd02739e2bc05f73f9de70a7ef8efab5bbcfe18ca5afb28eda3f94df452be68dba93c5890c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537455, "uuid": "ae60e037-6a46-487d-9d06-0e07c02e19b7", "value": "AE04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD28ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537455, "uuid": "b09493d3-5ebb-40a2-838d-4fa65fab25be", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537455, "uuid": "58209a65-20a5-4094-a079-b3f724c6d621", "value": "3072:+i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:+H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537455, "uuid": "7c652cc2-4ab1-419a-ba70-b805f113d9bd", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537455, "uuid": "8dfc8380-2a9f-48fd-9d89-d1c7707510fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537455, "uuid": "95f4f16e-e7ca-41f8-b987-7b5013c2ae02", "value": "52fc37a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee644e1-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544493, "uuid": "59feab71-461e-486c-933e-13ce927aa750", "comment": "Malware payload", "value": "f20598c05970ffe0a021c79d1a8b6b93", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544493, "uuid": "0b9137b5-d640-45cd-92f5-db0562974c72", "comment": "Malware payload", "value": "37c4d6e3d095e888733c56eeb64e73e0dd1afb70bfe4cbf01389bbb80204d87b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544493, "uuid": "330defc3-4a0a-4c8d-8b88-8c5d829b0d30", "comment": "Malware payload", "value": "90389493f21ed2372a3896c45513ac6c53af3a5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544493, "uuid": "8234dd58-827e-4bd5-a4e6-b53fedd5ab2b", "comment": "Malware payload", "value": "3b998b6812a42ddd2492d0d48e753b115cd59c1104a7904567b923d8185dcb8ec35c8f36bb8a979890bcf16b7823d745", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544493, "uuid": "b17d6c5b-660a-4b3e-9ae8-e12504bb7e3f", "value": "AB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544493, "uuid": "2257ac23-3013-4065-b3b2-fb79f89c93c8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544493, "uuid": "15e54ec2-9c3f-4b29-81c4-0d630180a158", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544493, "uuid": "cfd92797-f057-4e28-a4b8-97b6bb0f1cd9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544493, "uuid": "271671d6-a291-4e7b-8f8c-44630050d2bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544493, "uuid": "779f6fe6-178e-4722-b24e-d6c371f769cd", "value": "f20598c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57450abb-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621535381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535381, "uuid": "74647239-d6f7-4369-8670-be45cbe88703", "comment": "Malware payload (GuLoader)", "value": "b5a07242409d812c007e3dadb859fedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535381, "uuid": "c958f8d0-94d1-4c9b-a7b8-bed3c84effc4", "comment": "Malware payload (GuLoader)", "value": "37d08a64868c35c5bae8f5155cc669486590951ea80dd9da61ec38defb89a146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535381, "uuid": "975cc76a-03a5-406e-9d32-0fabbd6d0a9c", "comment": "Malware payload (GuLoader)", "value": "30e33139b101282727f5ba9182d1d856ac96ec6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535381, "uuid": "90a2d872-4797-4f6c-adf5-99054563bd2a", "comment": "Malware payload (GuLoader)", "value": "20be0be21cfad81c53fb0977909e30471ce5cbcc2e7beaa2a3d6a433863bbb8b7ef03570d5813387d41f541c53a6af02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535381, "uuid": "8c0e8a80-4919-4f10-a340-ae800354da2f", "value": "EE835B32B474D6B2F9E145B05768495C0E5B2C3F0F6D8DC73049251C97B2BC2AB623EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535381, "uuid": "c1b2566c-e13c-4a42-a020-401d8ea38b51", "value": "460f9cd83bcc5d612a8fc7838b465d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535381, "uuid": "13438f45-b946-4721-80e1-6025d828ae10", "value": "768:0jHb2YNl7XEFFLj19Azb6CdXyCS2xplRlNZ08nYKmgkWmfz/EhGW4jMALnATPcyF:AqWiFFd9E5yCPRV08nYnATPcyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535381, "uuid": "983f914d-ca39-4b33-9946-d05f602f4560", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535381, "uuid": "9134e9c4-d230-4356-9942-561114a07183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535381, "uuid": "e01037f5-1c81-4403-bad6-5b27aa3cc68d", "value": "b5a07242409d812c007e3dadb859fedc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93913d5c-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532046, "uuid": "390c1fe5-37a2-4c62-974a-ae821543bd5d", "comment": "Malware payload (Dridex)", "value": "29ceb5bf1bce6deebc767df7be08a944", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532046, "uuid": "981f6faf-7b9f-4d0d-bbf7-350d6bb07255", "comment": "Malware payload (Dridex)", "value": "380358fe6cd8307bf240b3ccab5654d87364d0e1a3a5c706bf3b601ce59f6871", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532046, "uuid": "9633001d-43fb-416a-a305-c2def85cf52c", "comment": "Malware payload (Dridex)", "value": "90fc113abdd5b510af1b62ebc4a2942db42efb7c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532046, "uuid": "6f96e3d9-6cda-4d74-a70c-fb9a136b6c42", "comment": "Malware payload (Dridex)", "value": "f638ebf3b8230c8adf90e197c7305eedb05c83d295ed774b7d54f0eb185a528e0076957c65767e5968dd79fba723158c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532046, "uuid": "54f59f52-4192-499c-91e4-575e6bb0f20e", "value": "8004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532046, "uuid": "c1cfb3aa-2186-44a1-9679-e22295076b40", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532046, "uuid": "8ab25689-e86a-41d7-9f5a-3315cfdd0fc7", "value": "3072:ri49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:rH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532046, "uuid": "3f71285b-01fd-44ff-927a-7abf8c972c8f", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532046, "uuid": "4ceb2319-0566-4e57-a6c8-98ad90ba2d0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532046, "uuid": "a0caf3da-2d05-418a-890b-94251ebd11d8", "value": "29ceb5bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1674441b-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621533124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533124, "uuid": "1410f113-d809-4e72-b4bf-60fb186bf85c", "comment": "Malware payload", "value": "2aba0be89cad82f286462259d4494ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533124, "uuid": "1540e457-c1e4-463f-bbc0-816a7388e2ab", "comment": "Malware payload", "value": "3807dfa3f53e38da95f038ce6498ce7cf42a6da290c48d856f45de7ca9ab11ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533124, "uuid": "41b4c632-ca5c-45fe-a07a-4601b46ee9fb", "comment": "Malware payload", "value": "ada0a4ac209e11d8858959f7e6f4f31433184898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533124, "uuid": "7fa51603-7602-4394-94cc-65419d6c618b", "comment": "Malware payload", "value": "5eaad4b8744d27114ec665c313ddceda7247246174496d7739978134d135af22d5570f72382357c6e90b06160a3336f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533124, "uuid": "33caa774-a7d2-4895-831f-344edd004e94", "value": "D8E4D06030E857C3E5BE5FB11866902027F5789DE756E10F3D9A73DE00B2B4146AEB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533124, "uuid": "f382b565-ddc2-4367-9739-aa04ef2e7aba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533124, "uuid": "3f46b23f-89c9-4681-b025-8b65d70828bc", "value": "12288:RzxacKzg2K0GX3eN+Mh6dXV+a/woq3wCAtS8bR4pHLolyAKp:RmzK5e4Me+83qgCAVRYHLolWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533124, "uuid": "91690fb5-9b88-4e29-971e-f23fc9f07b37", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533124, "uuid": "e2197f95-ecf1-43eb-b58f-23ed19180860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533124, "uuid": "35a3dd21-7d47-4790-9340-02d19165d233", "value": "Orden-CVE6535 _TVOP-MIO, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711b96c5-b98f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531129, "uuid": "672d5f5d-d053-44e0-bd6b-3ace75eea9d1", "comment": "Malware payload (Dridex)", "value": "198e0ec096ba9a239301e9cd09b87cd9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531129, "uuid": "4f0c70e5-53f4-4581-ab7c-9ca3d964e5f5", "comment": "Malware payload (Dridex)", "value": "381cbc8f51850b9c4521e62fd9ad163bb3356be6bd3c2d1e80947808d1cff808", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531129, "uuid": "f6623d38-f4b9-424f-bc5c-7d9338069dea", "comment": "Malware payload (Dridex)", "value": "ee8a1155e7329cb0ade6f0aa54991dc6239f9ac9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531129, "uuid": "b058faf8-6237-4765-a123-2975def2fb99", "comment": "Malware payload (Dridex)", "value": "b43ce7d32bfa5ef51bee3dcc4847537b72b5c60becc0e7e4819224b82a9a50cc5e3e8bd74144c0f4344b4e120fb1ea82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531129, "uuid": "57714790-42cc-4bae-ba48-6e7e8dd825e2", "value": "9904E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531129, "uuid": "50a2b154-9ef1-4195-a873-118333204ebd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531129, "uuid": "a3198926-f50c-4b55-af4e-a0c26b32a217", "value": "3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531129, "uuid": "968c2a54-5488-48e9-a6f3-753e79c27c2d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531129, "uuid": "2ac96462-c667-4f14-b13a-2663647ca1de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531129, "uuid": "734d0032-c888-47fd-8e20-2618451d866d", "value": "198e0ec0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ced376f-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468845, "uuid": "049423c1-092b-4037-a425-4ae8f4bbf2f0", "comment": "Malware payload (Dridex)", "value": "cb9e6aa5f175e539bd6e3eb78ff0496d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468845, "uuid": "da56ea62-da79-45d8-bb84-d0af23529a61", "comment": "Malware payload (Dridex)", "value": "381e41908d743cfe4b7f9af1a50b1a84b16a8c4f45df16d3d030915dd2b688a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468845, "uuid": "01c323a9-8894-47ba-a966-3efc28f241cd", "comment": "Malware payload (Dridex)", "value": "49ff363dd08a11cfc7eb94a3acca5716b999f203", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468845, "uuid": "d6f1e456-1194-4ca3-8792-2e00e36511cb", "comment": "Malware payload (Dridex)", "value": "a232d118cfad5e42e5f032772c5342be38688655494fab1d0fee5f189af43d006ad5e63fb15d1fadaf51164cbd8e3a4b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468845, "uuid": "f5fa913a-bb72-47d2-9f26-73e33e408ea8", "value": "BA04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468845, "uuid": "de775a0b-e292-4b5c-a830-35f1b64fe072", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468845, "uuid": "5334c2c8-23d5-4769-8434-6e9906b5b8a1", "value": "3072:fqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:5VqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468845, "uuid": "327e7bb4-f037-43d3-8271-da4735c7c3b6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468845, "uuid": "bb891695-a6f1-4269-924c-553fe49dc42c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468845, "uuid": "9c2a9c61-6e41-4d6b-8df5-6bd5993d9e52", "value": "cb9e6aa5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81fbf39-b96c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621516269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516269, "uuid": "4778ca48-49b3-4262-9ab2-0e7762529af5", "comment": "Malware payload (Formbook)", "value": "803e6fd6fc5eedff0f4fd55f5b7fd6cf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516269, "uuid": "a9fd6d5d-18fb-44a3-a19d-818c7c142fcc", "comment": "Malware payload (Formbook)", "value": "382c6db0092229dc77f1c6efb01237ec270ce4d1479faa2dc299ca4c81947bd4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516269, "uuid": "fd3c9381-fec5-4493-bc8e-ef403f17b11b", "comment": "Malware payload (Formbook)", "value": "7ccf664752d7bcf3aefbf64c5179b96abe4debfa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516269, "uuid": "dcf19975-c5ce-4b8e-bb24-66fec234e4c0", "comment": "Malware payload (Formbook)", "value": "9edc437a18fcfcb577c2a23226ba58b9dce11703f2bf9dbf298de60e142779d342ff12f841b84e0ce22c3c8d7881abd2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516269, "uuid": "1e632df8-4801-4b70-b28d-b8f5924f41b5", "value": "98B40122279CAFA8D4BE5B3B89E9A550D7FEDC11C707CD2A2CF9719D18A3B904131607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516269, "uuid": "56ff5274-f78e-41ed-bf24-0ccb8771716b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516269, "uuid": "035f42e7-1dcd-4411-b4d1-e70f42093cb8", "value": "12288:qN7v+SpWKzYlMJ6dl/3+O66ET0H/NnICp9y/5gEGhyhBgjTH7ein:rgvz6Hf66ET0hNpM/5xGhigj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516269, "uuid": "e1d9541e-18af-4b28-ba96-3233f835b68c", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516269, "uuid": "2f714271-55b6-45c1-a801-ad177f5ea877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516269, "uuid": "50d9bf25-ac4b-45d5-aa3f-88212e0aac01", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6b4de4-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472493, "uuid": "e2ec8046-20a9-421c-a724-366a1a103f23", "comment": "Malware payload (Dridex)", "value": "796c9c392c45434b3e869a04924382d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472493, "uuid": "da3f56d1-92ab-4f8e-bfea-89e4a7556732", "comment": "Malware payload (Dridex)", "value": "385d8e4eb30da390ba801c17bd4e2bded5486138ae18412cddc2d2457e7fc491", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472493, "uuid": "fb15921f-f485-4df4-8f63-68a85a72d121", "comment": "Malware payload (Dridex)", "value": "a592871db7e0aa188122654538b4d4409bb3f672", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472493, "uuid": "4e88c44e-ee92-4a31-94e7-7a0b620b14d2", "comment": "Malware payload (Dridex)", "value": "4d57e6c0dae0d55d42ac6e8d0cd0343149c2ae11e9a3de2b2e9dbed069ca12d2f85b2f5f3e411b74d4d4d638ea654686", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472493, "uuid": "ab9ff889-9add-46c4-aec0-1127f1bf82c1", "value": "12F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472493, "uuid": "c13e5099-c253-4f1d-8fe3-5feded4e7af0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472493, "uuid": "28d5093d-0c5b-4566-bdd4-e88581beefbf", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472493, "uuid": "5d87b58a-cad6-400f-80f2-55d654551683", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472493, "uuid": "9ce48cd8-a9d2-44c1-80cf-4728f6b287df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472493, "uuid": "d11c46d2-865a-4793-9302-cd65be9a82c1", "value": "796c9c39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec23f609-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528329, "uuid": "01d38fc6-1c94-4a1b-9244-1f687960d889", "comment": "Malware payload (Dridex)", "value": "7831dadf447de9d760bb76a9e0740dcd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528329, "uuid": "97b0408f-4e84-4551-98d2-fa9680522162", "comment": "Malware payload (Dridex)", "value": "388173a1636d2cc4d6572b2fb55582799a591b1d79ca0ae6123c6f1d0754454e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528329, "uuid": "3ba5b773-64d0-43d9-94dc-71cc21c85c7f", "comment": "Malware payload (Dridex)", "value": "b92e583c687958936421fa0efb2fa7c9ccf7c407", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528329, "uuid": "30b3cb16-1cac-429a-b1bd-5463ef7f919c", "comment": "Malware payload (Dridex)", "value": "f155f5def7f92559af796a6a80a681fc5525f243998bb076060812cda7862e8c80060942aa781f8941b81b64e85d4171", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528329, "uuid": "a42f5071-76d6-48e5-bd06-82e3519ef927", "value": "0204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528329, "uuid": "b6c3b25d-1a46-409b-a86f-652f60d11522", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528329, "uuid": "cb665205-a7d1-48d1-af05-c73e80c8f4de", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528329, "uuid": "d19e80a5-9176-4f82-9227-b028c181a8c7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528329, "uuid": "125ba204-519d-4fa7-be54-1831b5e2e502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528329, "uuid": "ded62ebc-a598-4321-b6ee-d20af4a241b4", "value": "7831dadf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506213d1-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542241, "uuid": "563841b6-b641-4b86-945e-5dcc8b62d90d", "comment": "Malware payload", "value": "1bfb7355a6fbface2edc7edc6c27dee5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542241, "uuid": "7e67935e-a1ae-491e-95dd-1e23c47a83ef", "comment": "Malware payload", "value": "389ea70aa57f49024164ce701b6c651c627d01c496104899ece380b5bbb5c17c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542241, "uuid": "c6fe722c-437a-4d34-b40b-958c04a7711b", "comment": "Malware payload", "value": "087961e8188d502b02c9eb7851f440b3021c196a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542241, "uuid": "a8f223c3-aa5f-44fa-96a0-f9de64daee52", "comment": "Malware payload", "value": "1a2cb4974a6f3e83f31275f1d9b5e881bdbf5055ee9681ca8fa932926e406a37b729be8642c65a2a0dec766ca1003147", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542241, "uuid": "3e4451ae-3f3d-4971-9335-3d7c3439651c", "value": "9004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542241, "uuid": "e77e8b19-7351-4e14-a1fe-4bf9ead278b7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542241, "uuid": "6ce0fa89-df7a-42c6-bae5-a6b120aff08b", "value": "3072:SV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:SV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542241, "uuid": "8b405109-8d36-4c71-804e-a74b0c08dea7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542241, "uuid": "f43ef314-9bf1-4274-a965-4baab76c579e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542241, "uuid": "d83e79d1-cd62-45c3-b310-ab63c516c2cb", "value": "1bfb7355_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3567fd52-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545632, "uuid": "76e4a0df-1b92-4fc2-b9d8-cba51ee0865e", "comment": "Malware payload", "value": "eec47d850d7aae235f64b76cd02f07ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545632, "uuid": "3697d5f1-fda8-4e46-a792-9020e32bf781", "comment": "Malware payload", "value": "38b9fe8697a5204ee0ea2342a5958f401a6a864cf38a824896514f2a04ed325f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545632, "uuid": "ca198ee4-bb7c-4f72-9835-f7604548bbe3", "comment": "Malware payload", "value": "1662a08feecc32e9161fad8f78de04a4f1e11344", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545632, "uuid": "1373b127-3bf0-4d92-a186-db85ea018d55", "comment": "Malware payload", "value": "3dbfd3cca4a4f50b3a4a6521383840b53314c9980b7116cb8de77c700e7886d7d51dfc7907f4df1058b29334915250f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545632, "uuid": "13c00abe-5bf5-4f6e-a243-b6dfe2152b20", "value": "2504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545632, "uuid": "1cba4fa4-23b5-499a-b4fc-7b45711efa4e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545632, "uuid": "c627a35d-ee1c-4877-8f24-8e31c345355f", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545632, "uuid": "2eb98848-ca86-454a-a559-bfd02ed73e31", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545632, "uuid": "61b36e22-cfc1-401f-b5fc-62c65acadccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545632, "uuid": "0510f6f1-73a4-4322-99d5-abfa935afca7", "value": "eec47d85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6418c860-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527671, "uuid": "cfc31e32-eb0f-4c3a-9d1a-f45d929dc2b2", "comment": "Malware payload (Dridex)", "value": "bf4c26482f7b56e1a6da478eb040696f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527671, "uuid": "661b0e3b-10b0-46d1-b2f7-c6cc225624d2", "comment": "Malware payload (Dridex)", "value": "38bab79415fdb2f6076a2d93127137c7ceabc7154b00aad134b38e0f368b1ace", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527671, "uuid": "7e0db902-b7a5-4fb3-a6c3-a37b7d083d20", "comment": "Malware payload (Dridex)", "value": "bda280205027e276481e3237bc10256cd02049e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527671, "uuid": "983a4d7b-0368-4e21-abfb-d4248d5740a5", "comment": "Malware payload (Dridex)", "value": "3e89602effc613901a60b6ece988a8a5e272e0cd0e4d8c3b1ca637c98656cb3d433a524f2113a8e4c149ba2f558cbe7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527671, "uuid": "37292d67-3a53-4302-9389-091a735546b8", "value": "E904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527671, "uuid": "1c95fadd-6366-4018-9dda-80c85874c7f1", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527671, "uuid": "9bae8240-e807-416f-a7f1-dad0695104f8", "value": "3072:6i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:6H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527671, "uuid": "63431da1-cdda-4684-8ffd-5f3601e2d57a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527671, "uuid": "f38fbc66-c355-4f96-9cd6-02084700adc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527671, "uuid": "44f93e5c-5f0f-4c41-aaa0-2c066257b140", "value": "bf4c2648_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd34f028-b97c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621523123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523123, "uuid": "e851d2dd-6755-41dd-9244-9fd7c52cbcce", "comment": "Malware payload (AgentTesla)", "value": "1ef891330c08a75fc8b56d106a5e7e4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523123, "uuid": "062c171d-c3d7-4cd6-ac9d-834d368dbfb5", "comment": "Malware payload (AgentTesla)", "value": "38d6a9cd400dc5baf23d97e91ca50a1dfd3d689b7a5704567ff1b6ba02fca126", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523123, "uuid": "6ee64f39-0ea1-4054-b966-543e8417f036", "comment": "Malware payload (AgentTesla)", "value": "048e94a4f416b33506fba7b71368a347367abf2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523123, "uuid": "8110f72f-d4ef-49d9-9e43-04123375608b", "comment": "Malware payload (AgentTesla)", "value": "45427239a580179dea37e509fc1f950d6b661ab776a74d960e2d84b0619650e2556a3c9d910967eb52b4a545dd4c0a96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523123, "uuid": "0eca812b-662f-4141-a4dc-6a61223b8fc7", "value": "B4D4E092B64496A4EC3D53342531D53013A37D2D9670EA2C3ECE7E7B3DBBA838166913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523123, "uuid": "7502f70f-8d5c-4ea3-8f10-9b5bb03ad41e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523123, "uuid": "c4184c23-413c-4aac-b57d-13938e3b11a8", "value": "12288://nKzJ7xu9UAOdhNN/KqxHH86XGRpAy7H:XKz5xu9UAKhNN/ZWNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523123, "uuid": "5f8d6c85-987d-4691-a891-7e9bf1f255b4", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523123, "uuid": "9223298b-05e0-45b2-887f-3075bc0092d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523123, "uuid": "30be4acd-5229-41d9-a303-8dadbf066ec5", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8874b416-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533745, "uuid": "4e21dd5b-255f-42cc-9456-a95e345c181f", "comment": "Malware payload (Dridex)", "value": "8a58bac36ac1503e910296b54f6022f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533745, "uuid": "744cbbdc-2f81-453e-857e-81005181413d", "comment": "Malware payload (Dridex)", "value": "38fcadbfea36e8c4927ff428503c5973b3ded8f844e92f0a61885d0054bf070a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533745, "uuid": "21f033e2-7c0d-418b-9f17-16ba298c452e", "comment": "Malware payload (Dridex)", "value": "4447435ce44926dec813d56b7100157afa130b9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533745, "uuid": "f7129927-b936-4896-926c-f04b7e8b097c", "comment": "Malware payload (Dridex)", "value": "41bbc0d5fdd58e8b05d84fda18d90472ed181c4ce470f87bef11a959ed51e2947c04de416353fc84f016481f5e27392e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533745, "uuid": "8a06548a-03e0-42ae-b8f2-209f7776a8d3", "value": "5E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533745, "uuid": "417dfe90-b476-40a4-aa2a-450adbf6b86d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533745, "uuid": "ccb5b99f-b6da-4405-9a3a-faca25cf9430", "value": "3072:Mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:MH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533745, "uuid": "39c8506a-4cba-42a5-8f43-fcd956377d9a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533745, "uuid": "f1e5b331-413d-4036-87a2-fe17b499d434", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533745, "uuid": "18ec7456-f2ee-434a-a129-6463066b7304", "value": "8a58bac3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb64b92-b957-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621506941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506941, "uuid": "47dff15d-ce1d-43cd-9347-d6fc5c6f85d7", "comment": "Malware payload (Dridex)", "value": "fb8c83363da6059e72afbb6d5ec40cde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506941, "uuid": "1467531a-7976-4476-b150-72835d53e017", "comment": "Malware payload (Dridex)", "value": "3911288d896c32ca25bc1099be63cf6ecda38d5175b04a08bbdbdde004f0bc4d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506941, "uuid": "3a6f61e2-38a5-4c8f-a7da-6a2adffe21bd", "comment": "Malware payload (Dridex)", "value": "8eaaef35675b96b98f9feb87915b234beb169c36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506941, "uuid": "ff94e473-159d-4c8f-a281-4d7508dc53a3", "comment": "Malware payload (Dridex)", "value": "7b673839ccc7521b64a13e80ccb372f05b7d5896076b673d782bd7c7b06001366e2ebc55d9b98c0d4e4c19aa7604ef08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506941, "uuid": "87a06967-f454-43f8-ad1d-ae2986070015", "value": "FDF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506941, "uuid": "b02348fd-8d2b-4e75-8b3a-1a5af1ac2de4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506941, "uuid": "c3dd5ed5-9115-4ff2-a4ab-a4ca01814518", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621506941, "uuid": "7f7575b0-280f-44b6-8df6-32cdb0ee07ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621506941, "uuid": "d8cf0f15-af3a-4843-9e8a-dfa0bbfb6d76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506941, "uuid": "9bcf625b-67a2-41c9-9590-c72c5ee7f2d6", "value": "fb8c8336_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee83a509-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536493, "uuid": "e3fb1df0-def5-4f60-8273-34c0482bddb3", "comment": "Malware payload (Dridex)", "value": "9579880dccc586e126ab3f3333101723", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536493, "uuid": "cf1351d7-22a8-4bf8-9bde-7d40f859f2d1", "comment": "Malware payload (Dridex)", "value": "391165d5dbdd9a7c742382d346d06c584d88c591dc04df316fd7af9b1fe8f436", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536493, "uuid": "0226ff44-f0cd-47c9-aa23-3327e0f8ba67", "comment": "Malware payload (Dridex)", "value": "a30c73a1d7d145fa335b67788b1c253ce0f2f2b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536493, "uuid": "ee5b8ca8-ec17-400f-b40d-5ff3dec8b56c", "comment": "Malware payload (Dridex)", "value": "10a414e79ee5b69e2c417b5837a2713085264edb562ac51613152ab4c9c8644d2f6fba4d8a0e5c8e1fd6d86b97be7bae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536493, "uuid": "4cd5b07f-1154-447b-bec3-0004cccf0e71", "value": "E3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536493, "uuid": "d38c7c11-f13f-4504-ae27-07a46131eb17", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536493, "uuid": "a93b7b29-bf95-467b-bedb-ab8bdf1c296b", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536493, "uuid": "2ac4380c-2590-447a-b2b0-1a93fcfdff2d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536493, "uuid": "fafcb19d-f366-476d-8c66-b12391765754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536493, "uuid": "f57f55c7-baaa-4b56-ad77-4b3d48bdfa79", "value": "9579880d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d375527f-b930-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490492, "uuid": "2c4e1555-04fe-413d-838a-a57cab7321da", "comment": "Malware payload (Dridex)", "value": "b53dfbeacd7cf41efcc685f8fa9cd318", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490492, "uuid": "693f6604-4bde-461f-9810-0ef1c0126eb1", "comment": "Malware payload (Dridex)", "value": "391d64f8571b43ebff886768262f23ef6d77c6a8a91c4487f46cca336ddfee06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490492, "uuid": "c27f2b28-e41c-474c-b6e0-382fcbc972e2", "comment": "Malware payload (Dridex)", "value": "afa38b8244ecafcdbe2eb5eb4b938011d6ba45aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490492, "uuid": "e389d260-bcbe-497e-a757-b5f4bca26209", "comment": "Malware payload (Dridex)", "value": "406ba6f1f1c2cf242c541e29db5bb38ab26595fe4d3d1e8671cf61a8990d9290e5da99928a0d1cb2172025282460099b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490492, "uuid": "ea43ca36-e264-42b2-8f60-8b332cf31ba3", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490492, "uuid": "9daadc15-0f8c-40bf-800c-b557e74698d0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490492, "uuid": "82ba40ae-228b-4cb4-82f4-2015fc775cdd", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490492, "uuid": "29820a3a-cabb-4a03-9617-e9066e9f11f7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490492, "uuid": "1a4f5672-2caa-456b-881c-d6c8a771094f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490492, "uuid": "0da020c2-9828-4652-bd0a-1293ea98047a", "value": "b53dfbea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d340fd-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542054, "uuid": "c5be9a75-6e13-4026-90d2-b3dc895d42e5", "comment": "Malware payload", "value": "0bc0081a3ce28f07dc6160477d3a1b73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542054, "uuid": "79baa5b5-f546-4e3b-a13f-17e4e1dd8830", "comment": "Malware payload", "value": "3947b3824f4ad07b0c3ac756350a61e3102584dc66bb798347a5a3d846e0053b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542054, "uuid": "d2e0464b-212a-4495-9a23-fbae5f0ed30e", "comment": "Malware payload", "value": "cf3209f07d1223f146d3f4ffb12a4050a6c45456", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542054, "uuid": "b91a5c97-5662-4ff0-a2e4-49df7b564696", "comment": "Malware payload", "value": "8b270d33a54ed6afbcb97e8602e0c0ec408282f05e0ad8aead2fe1e4323f209ad1db5c5196a0354177e45899b334ab21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542054, "uuid": "d7474aad-01c4-40c2-a40c-cb173b2bb88f", "value": "3604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542054, "uuid": "26eeadf4-31a0-4b79-ade5-8fbd167d7d68", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542054, "uuid": "962885a2-90cc-4635-acdf-847bf11f75f3", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542054, "uuid": "82447b2d-c11c-42d9-ba3b-69397eb42a12", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542054, "uuid": "00ddf83a-1776-439c-bad4-832d0342cc26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542054, "uuid": "b77fd3cd-5923-4ec2-a614-18e2f6c4b8c9", "value": "0bc0081a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ca2e1-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526593, "uuid": "ac1b73de-0dda-47b7-87dc-67d358419f2c", "comment": "Malware payload (Dridex)", "value": "0d37205d690ea911f33249b10205b3d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526593, "uuid": "7ccde22b-973d-4ca2-a243-9c24fb7b981e", "comment": "Malware payload (Dridex)", "value": "39a1b811c007544b6e9706695fb6e007afe6353dc9b4452a350bc0e0b14b0100", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526593, "uuid": "2f5a9b48-6b94-4f8b-ad3f-fe694df98b76", "comment": "Malware payload (Dridex)", "value": "b51c9bae857211bfa4ae81a31c3d4f26325027aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526593, "uuid": "ca879995-0abf-498f-acae-9bca2a0f0635", "comment": "Malware payload (Dridex)", "value": "b551c446e70e279361eb874985129d091906befb2d34ebb4d4bda081442d69f8b12acea3d58637572b961c607e35d11e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526593, "uuid": "c3c3ef23-56fa-4cb1-8e3a-22ef686c4e3b", "value": "0F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526593, "uuid": "05509390-459f-4ecd-bc8d-0c55b80fb44e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526593, "uuid": "4c634993-d237-45cf-b346-19aa92aae90c", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526593, "uuid": "cd652c3a-71cb-4de0-8f14-7927a93cf2d9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526593, "uuid": "6dd81066-cbbd-41bf-81b0-28503587a44c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526593, "uuid": "2bd3fd23-a53d-49a6-ba88-48d40c5f44ec", "value": "0d37205d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33d357a-b931-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490840, "uuid": "30ab4335-c328-413f-8cd6-dcd063a3fb08", "comment": "Malware payload (Dridex)", "value": "c4b8cc9d0bad1c0a28d7bceff35deea8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490840, "uuid": "9fb140a6-48da-4af2-aab1-ce1b5a46d9a0", "comment": "Malware payload (Dridex)", "value": "39b4f492ddfefbaff59bf2a9ac9fbcec79c0032a8818db83532b1debc7dda1db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490840, "uuid": "4a0e747c-77e0-4696-9c8b-38f70f8507ea", "comment": "Malware payload (Dridex)", "value": "8c9b362983c25cdd04da4229bc2aee36c354ef8c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490840, "uuid": "17138079-ed44-4bf3-848e-38ea9d25a1a1", "comment": "Malware payload (Dridex)", "value": "b300f6e5b2dd4cf87bcfcb33a0a59c4a2467aea6453bbae25e22c863c4c8c735ec979eb72608dc94b722918cd4fdace8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490840, "uuid": "117ee76d-2b9f-446a-863f-8c9d96229954", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490840, "uuid": "8dc28c09-72f4-40cb-9840-cb62ec9f0aad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490840, "uuid": "87f8f57d-b824-4ab4-bb7f-e52435bce27b", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490840, "uuid": "5297b59d-7811-4626-89e4-2a638dc8fc41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490840, "uuid": "97851dc1-b608-447f-9747-82833236a15d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490840, "uuid": "08bb3070-8dda-4e06-afc1-b7d419b3ed21", "value": "c4b8cc9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1cfb43-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535711, "uuid": "0fb4a6e5-542e-4ca8-b412-670fb83107dd", "comment": "Malware payload (Dridex)", "value": "3887f1ce48951d4345de30d039cea41f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535711, "uuid": "e2e004e1-84fc-414e-a530-3e8247a591d6", "comment": "Malware payload (Dridex)", "value": "39b5ada723009ec4f41b2c5ef7a5f64fd6ee388d253230daaef7f26f75e3d376", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535711, "uuid": "57f1750a-3c90-4d8e-b631-64fdebf6a78e", "comment": "Malware payload (Dridex)", "value": "ff4ff5196da2b822857c81f3ec1dfbed324fb0c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535711, "uuid": "668bffb8-a617-4156-ad89-348ecbfcdc51", "comment": "Malware payload (Dridex)", "value": "83c6b8ff3aa86e0d80371641395a62d495cc1083d054158975fd28be9dc6fc9736d5371588d6ab606931963077d68492", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535711, "uuid": "bcfedbc0-8f6d-4980-938b-b5edc8b7fc64", "value": "0C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535711, "uuid": "11a228c5-6503-4bea-9ef5-872022e39826", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535711, "uuid": "b3831da2-0f39-4ec5-aced-025987334f49", "value": "3072:Ei49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:EH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535711, "uuid": "27b6e8f9-3dcb-4089-8b96-2eac69ccc8ab", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535711, "uuid": "866834e1-8d27-4a6c-b27f-c2e44229eb07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535711, "uuid": "f6865cb9-4ded-485f-9fe0-6e09af00a766", "value": "3887f1ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae2b0f7-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543574, "uuid": "7910ac0b-8243-4613-b21e-abf428e9f1fc", "comment": "Malware payload", "value": "87a2e3ee7f625fbdd795e00393dcfe3b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543574, "uuid": "0db4c9fd-18ca-4df7-992b-11dc29623163", "comment": "Malware payload", "value": "39ccf401e0215ad49c95c62c695029229a05968984c21484f5ad17381aea3432", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543574, "uuid": "31794ab6-351c-4cb7-b922-9e344bbd92fe", "comment": "Malware payload", "value": "19ec6e561876dbe4bcf28845acc7b3da236547ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543574, "uuid": "af7602ad-6830-4938-98fd-8454f85b1476", "comment": "Malware payload", "value": "a0322cc412e1fcc9135bcf72530e208a06db556cb73f3728815f28ad4955f766eb53abb90ee1e84f500766068372eac7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543574, "uuid": "1b077b30-c0d9-4598-bd57-737945f52ae1", "value": "E404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543574, "uuid": "e7827877-3431-4ab0-b356-fe590cecfc7f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543574, "uuid": "18555c7f-f282-4196-8c91-f31dd67a5f88", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543574, "uuid": "d1e160e0-9997-453b-a03d-49f810fad142", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543574, "uuid": "c6275dd7-afdf-4bec-80ad-fb41f8f5c105", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543574, "uuid": "165b2ab1-673e-43ea-8ff5-439a9488048d", "value": "87a2e3ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668dca59-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538842, "uuid": "34097f9d-f5a8-4ab1-91a4-e1bf07c3f0da", "comment": "Malware payload", "value": "04a875d158d88a3dd15b637524d3587c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538842, "uuid": "8b7c5d38-b64e-4421-ab49-2fb871fa1aa8", "comment": "Malware payload", "value": "39e5f5c28572e3ea9f1d58bbd4766a13d203ff67860cb0a6a4a84bf42b84a120", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538842, "uuid": "7f731a04-9a91-448f-ae73-926a40c7a78c", "comment": "Malware payload", "value": "b31d46465d6f2ad34685146fa0dc847472be08e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538842, "uuid": "cfe21670-dbcd-4ee4-a262-85d609fc8a2b", "comment": "Malware payload", "value": "c3cb46725511e283986ba6df7eda24e6a45a755aa12e80fd393451323455fbcfbbee0a37bde9673a53b4c8c67f085809", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538842, "uuid": "9f753936-d8e2-4124-b07d-822228e958c5", "value": "8504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538842, "uuid": "23d006c5-a71f-4f06-9261-2d44f9a8c48a", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538842, "uuid": "6e2320ad-d636-4957-a0f5-60317b23b9ed", "value": "3072:Di49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:DH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538842, "uuid": "105dfd11-3ae5-441a-9d97-1640c70b459e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538842, "uuid": "15c62c9a-6886-4570-80ac-6ae0006d2d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538842, "uuid": "352b9b9a-2035-4c32-860e-49290148e837", "value": "04a875d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8c9501-b96d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621516356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516356, "uuid": "e49b8c51-cc4b-416c-a4b2-6701caca70b2", "comment": "Malware payload (Dridex)", "value": "1bcfd4ce7f5a51e71282edc0986e72fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516356, "uuid": "f109799b-9838-4e09-a0ed-b64fea564237", "comment": "Malware payload (Dridex)", "value": "3a3690dc2676013bd8f5f7b449a055c01f29d7da8dfe64c61597c133fad9b320", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516356, "uuid": "064539ff-e85e-40b4-8134-675d0732af1c", "comment": "Malware payload (Dridex)", "value": "d3e3815d36a08e8faf47cf4417fdd0b23fe97935", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516356, "uuid": "6c4ba010-0c64-4de8-a5e5-ca9bb72c243a", "comment": "Malware payload (Dridex)", "value": "72daa77bcb7a312eb1500f358f7dbad78500e9e83ad8ac8f83453998354e4c5189962b9daf74254c8292c728ec7281e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516356, "uuid": "8c75217a-e2b6-490a-89c0-d29a9aa511b9", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516356, "uuid": "4f307302-8934-4bbb-b578-aa4277933733", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516356, "uuid": "b66b5843-7860-4620-9643-0b0dc995a2f5", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516356, "uuid": "228e6d03-484a-47a8-a593-1346eee86c80", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516356, "uuid": "c9a3077c-fe9c-40ee-88d5-a1194c217ef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516356, "uuid": "79d3b62e-a235-4dae-927f-caf247518a6d", "value": "1bcfd4ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794e9c19-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539733, "uuid": "214708e6-20a2-41dc-8f82-8c22f5fc60bd", "comment": "Malware payload", "value": "967a11552e4611b82807c45c8bb95d15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539733, "uuid": "1959b2fe-0a7c-4336-bdf9-d596090e5d99", "comment": "Malware payload", "value": "3a4dc35efacd9a6f6cc1365d43bd5bcb89a8daa78422d2b7e5c557e740c79f69", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539733, "uuid": "9e524944-395b-4ae0-96ed-2a45b310e5d2", "comment": "Malware payload", "value": "204ec7c05ce05cd73d66bf939cea23cc72c12bd6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539733, "uuid": "a89dfa2f-ad4b-4dea-8e8b-5539d4efb6ba", "comment": "Malware payload", "value": "6187e8229d6fa23431891265a8e316ce31c9cfe56950d8f93dfee6e9d432436e97effe006a8084988e7e025a3586933c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539733, "uuid": "2c572aa1-d0df-4b5b-90ba-38ae52d75f2e", "value": "9A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539733, "uuid": "2ed0bfcf-37b0-45b9-9655-be49b475ae7c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539733, "uuid": "c9abf22f-6742-46b5-ba42-7b80476663f1", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539733, "uuid": "2979fdb9-f04f-4b87-afb7-5fbe465000fb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539733, "uuid": "7c774bc6-d03d-439b-a68a-3357f37213c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539733, "uuid": "da56f44a-fe73-457b-84dc-b9dd9b510097", "value": "967a1155_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f6f709-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532769, "uuid": "506b9ce6-2e5d-456d-a3ad-39e7e863ce6c", "comment": "Malware payload (Dridex)", "value": "f8e9017cd410048c95ba8a9918495430", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532769, "uuid": "f8f7ef13-1b45-459f-b661-4bc9797dc519", "comment": "Malware payload (Dridex)", "value": "3a5b6ddf29b59903ffe894ba75996955976f862a73cb507918768699859e56f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532769, "uuid": "1160dac5-0fae-4ca2-b5cd-55054dc04899", "comment": "Malware payload (Dridex)", "value": "8a7f2b2d0a9885b599ed000625d9449e13e8d59c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532769, "uuid": "a9c105cd-1d09-4d12-87ee-99e6f6805ad7", "comment": "Malware payload (Dridex)", "value": "84c2c120e128d83b22a21bd257bb5e79ac6a3f7a25a3f47e6ba943675f48114bbcb9a13293e2f9a74b8d663d78851f85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532769, "uuid": "81a4f3ff-6156-40fd-a227-3943c548405c", "value": "3404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532769, "uuid": "e82fd3f5-09d1-43ec-a3c6-060632cc0dce", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532769, "uuid": "73601e47-a127-4ade-ad3d-7df5c3d973a9", "value": "3072:AV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:AV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532769, "uuid": "0610c4cf-792e-42af-bab0-8112215a0eb3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532769, "uuid": "bd6901fe-c070-4ad4-a351-cf67495fadc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532769, "uuid": "04d5294f-a019-41d2-804e-dd608412cfd8", "value": "f8e9017c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678573e6-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537126, "uuid": "df6f34be-de27-4fe7-9e2b-56e688bda459", "comment": "Malware payload (Dridex)", "value": "26b203968606ace516e6b92f31d948a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537126, "uuid": "241d7aa2-251f-4176-98e3-58664cd919bf", "comment": "Malware payload (Dridex)", "value": "3a6c56a7ad56ea00342c5c9d49feed704a33ad498e6917b8772ff05f86cae694", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537126, "uuid": "ce96c2d7-adc0-4ac4-9012-06a2bb7e53b5", "comment": "Malware payload (Dridex)", "value": "6bdc908b390f5d022bdc373b94b99447a299184d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537126, "uuid": "a18096ca-7047-4dc5-bc8f-3d2d788c29d6", "comment": "Malware payload (Dridex)", "value": "387ccc33bbdf0e10e8d6cbc7bd39b7ee3c82cd3e448a4a0c5603338d1d4c1a5ce539ec00992f1885bebcaeea90d3785e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537126, "uuid": "f526b1dd-194c-4cf5-a23a-9e2dfe2ec3f4", "value": "7B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537126, "uuid": "53910ea6-dbcd-47cc-8398-5be9097495fc", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537126, "uuid": "546d8165-6821-4dcc-82f3-125e790ae858", "value": "3072:lV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:lV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537126, "uuid": "055b6d5a-1e48-452b-82f9-2866cdfd19cb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537126, "uuid": "3d712da8-17dc-42b8-9681-dfb6a8431421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537126, "uuid": "20fc41e2-49cb-44a2-b62e-5d02a169077d", "value": "26b20396_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43899a5f-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537924, "uuid": "b8cdb898-76a1-47bb-90b8-46522e7eac13", "comment": "Malware payload (Dridex)", "value": "d5286c6bd9e2fbe19df12ca1f07cea93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537924, "uuid": "3174d2d2-8c3b-4544-b907-b416fc473859", "comment": "Malware payload (Dridex)", "value": "3a86a2b24fa0ea691491d98b5d6197c4a2b88f2f44ce13c3e077185dfb3e20c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537924, "uuid": "ee15024e-d702-4830-8020-816b68354bc2", "comment": "Malware payload (Dridex)", "value": "d1b0fad34c3bcbe35c5fd85b612d045e701b052a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537924, "uuid": "51e73ce5-eb37-4c20-b9bb-868a7c4d285f", "comment": "Malware payload (Dridex)", "value": "c11d9bf9979cd300f41d0b74f6ad39daea406cd4bb37607b3927a097c854e8126990578f2ce9093d7b2660462d6edca8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537924, "uuid": "bd416717-a19c-491a-8ae9-92e3b518f8fe", "value": "2904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537924, "uuid": "6a388357-c1a7-4ec3-93e1-355dae8ea6bb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537924, "uuid": "f97016a8-8f6b-4676-a979-1a2fc6d10e01", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537924, "uuid": "d15d3afa-17c4-4c8b-a872-8a0b72d754f4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537924, "uuid": "cecb8751-550b-4e9b-9395-a0d8b2e81ae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537924, "uuid": "b4cd2a5f-0a4e-47dd-9b69-fa209d6299da", "value": "d5286c6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a90589-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528471, "uuid": "6dead8dd-b3ca-4b2d-9f6b-b5225d0e897b", "comment": "Malware payload (Dridex)", "value": "0fd23531dbc80573f6e03ae44793defe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528471, "uuid": "a8ec21df-20ea-40b4-af66-22351df14fc1", "comment": "Malware payload (Dridex)", "value": "3ae0c389fa4b2f1a22d124fd015f90d1007782a9a2c6442d4406886a9075db1f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528471, "uuid": "43d080d1-de33-499b-90f6-9f4f9e8afdbb", "comment": "Malware payload (Dridex)", "value": "c94d1aa85b76660c080d0b39517826b035ed3949", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528471, "uuid": "644b1bb4-25ee-4161-8615-8ec055d47549", "comment": "Malware payload (Dridex)", "value": "445d3fffc0fe1112bbfda7f33d5faaeed3bef350ec7f619d73e4962c9b6849324db9bb46451a7cbda3165706ded36d87", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528471, "uuid": "aa761500-bd39-4f6c-981e-2fb159920e86", "value": "F904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528471, "uuid": "94c29927-8204-49f7-9000-25fbb1452730", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528471, "uuid": "613dd20f-f6e0-432c-92eb-da8d065f48a9", "value": "3072:Wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:WH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528471, "uuid": "02ef0589-8142-44e6-b88e-408c7051fa78", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528471, "uuid": "ad04e1b8-58fb-4424-b067-d9698f4deefc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528471, "uuid": "1c113b0b-a75c-43b4-a920-ce7d17679d08", "value": "0fd23531_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea21b23-b9a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621538587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538587, "uuid": "063cb1ba-0bbf-4d3e-8427-d15cceb1c47c", "comment": "Malware payload (Dridex)", "value": "477ceb23d9c134735aa95082fce348de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538587, "uuid": "4098396d-9334-4f30-a2b3-1324c13889fe", "comment": "Malware payload (Dridex)", "value": "3b2f16bff4d92dd68204edfccead906fe56cce4d83d22e55fc549fdd1c1fb5e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538587, "uuid": "0404e51f-076d-4f17-8d48-6d2d3995ceae", "comment": "Malware payload (Dridex)", "value": "10b9c51a4cc5d0e3b88144194b60db98d292e9c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538587, "uuid": "1cb35b94-6b2b-4c6b-91a7-ade5a7b377fe", "comment": "Malware payload (Dridex)", "value": "3e6fecc5ad5445ac781ddb3311d9ec5fb1075e6b592ab134ffa7560441ed78b8ffa71d05c7766a44acc9fe1af51308aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538587, "uuid": "d0fb5f04-ad67-4f81-ac80-8ce76bc7c1ef", "value": "E204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538587, "uuid": "df7565fc-759a-43d7-9a50-06fba485d0b5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538587, "uuid": "b6411fed-b239-4041-b6b3-dcce041b4934", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538587, "uuid": "c5a5f8f0-53b3-4bd3-9baa-9b7627f37b07", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538587, "uuid": "394cd419-b047-4b3b-b7c9-1632f04bf147", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538587, "uuid": "4773869a-0911-43d8-9f94-ec75fa960a0f", "value": "477ceb23_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20010728-b92d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621488902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488902, "uuid": "6564e15a-8eed-4f29-b6bc-a3fa20a82144", "comment": "Malware payload (SnakeKeylogger)", "value": "0189a9399378fb111475afaa6e2d8399", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488902, "uuid": "775b6600-618d-42ae-8f48-157412c38228", "comment": "Malware payload (SnakeKeylogger)", "value": "3b49f4e5e7334ef18e7810c9e96fb52c7b41b0ac4560e966306003a698d1060c", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488902, "uuid": "613fe725-4585-4ad7-8452-515df10d78b6", "comment": "Malware payload (SnakeKeylogger)", "value": "ce11e26d31541a2d7ec5a156550c85648bfb477f", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488902, "uuid": "5b01e0f8-5f4b-4d3e-a785-41989f32a9cd", "comment": "Malware payload (SnakeKeylogger)", "value": "9065094cf4f6132a2adca4ac27e97e6dfd92e940e2f9924742e940e0c76e96ce1767a75abea9919c3730b1740c48459f", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488902, "uuid": "915e5015-5e94-4d57-8474-7c29546562e4", "value": "7DA423ECB4C812FDCE4408B746EBB0C57E585D62F8DE851910CD31BE4E7EB85A0925EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488902, "uuid": "62512f7c-2fca-4d47-a1eb-68ff0455f328", "value": "12288:b0lLzWKK8nG5QOAWiUTwoShXXdPcwfLldhV9:iHDnG5QO2Ub8ZdTldhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621488902, "uuid": "a758b33f-6f56-4b14-b6ba-fa74f015d0de", "value": 476678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621488902, "uuid": "f3dc60a5-747a-4d5b-aa06-312d87982219", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488902, "uuid": "d6b5b62f-0abf-4939-a040-cba398761e28", "value": "lista de orden.pdf______________________________________.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b1826f-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527887, "uuid": "bda94caf-264e-429b-b7a8-de2371fd7037", "comment": "Malware payload (Dridex)", "value": "3cd05d662a19cd676ad6c3dd6d284ea7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527887, "uuid": "bd321ddf-8cd4-4d08-8c59-5db3b9500b63", "comment": "Malware payload (Dridex)", "value": "3b58b880de69fa6113042b5fe243496b8206e13f50ae9ee27e23c5bb29b741a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527887, "uuid": "6c1c58e7-a155-43dd-839e-504604710a22", "comment": "Malware payload (Dridex)", "value": "965bd6232de4dbb4fc56b23c1293ae152e8e2645", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527887, "uuid": "ea12b2ac-cf35-4247-a4c5-c96713ef45bd", "comment": "Malware payload (Dridex)", "value": "b11909e34d35458be097f387cd75963ad78367d7f924d4bf1f462cacbee7ac39727d300d45d8f628ea69511759e793a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527887, "uuid": "178995f4-f06c-4a18-8b69-c55d632b06ec", "value": "0304BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527887, "uuid": "28f6f2fa-5c6a-47e5-a93d-ecc9ef581d16", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527887, "uuid": "b7b54319-017b-4808-bd3f-027604780a7e", "value": "3072:xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:xH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527887, "uuid": "b794a015-f0f8-4adc-9e1f-e60ee8e26fae", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527887, "uuid": "03526e04-09f6-4a53-85dd-121795e22a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527887, "uuid": "580cf895-89df-4b61-9447-8971543b2c25", "value": "3cd05d66_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cf1540-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528370, "uuid": "c23f0263-a5bb-4d36-845f-531aa5796462", "comment": "Malware payload (Dridex)", "value": "fc7c766497ffbac046ede368465f325c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528370, "uuid": "7af63a9e-8797-4910-8fb4-78a92cb00409", "comment": "Malware payload (Dridex)", "value": "3b8df8878ba66bff8e4604c49fb9b2af012a347a6604980db941f265804516d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528370, "uuid": "de168ca4-ae0c-42fb-8beb-ff3a6e6bff46", "comment": "Malware payload (Dridex)", "value": "7313f7217fb6c7a0c982ff5dcab3e4e01e5876c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528370, "uuid": "1b54c393-9635-419f-9a5b-11f1e2bbc348", "comment": "Malware payload (Dridex)", "value": "62f31e785736603f69d0f0cf34bd3e37eea4fa6b2c227a1d5ac285218f611cb2311f875fddf63d3d28e182cb32a93780", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528370, "uuid": "b2c59fe4-273c-413b-a5e4-869a1ca90b9c", "value": "4E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528370, "uuid": "96e9c095-386e-4767-95b4-21a807d976b6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528370, "uuid": "60a87147-13c5-41fa-aa5e-587cb4b2ca3d", "value": "3072:7i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:7H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528370, "uuid": "fb4bbb43-5e69-49de-80d8-495caef43366", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528370, "uuid": "0d5c7bc7-6efd-44f4-970a-a52929895f83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528370, "uuid": "aafbbfbf-daa3-4453-85e6-598b334a8616", "value": "fc7c7664_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d847fe3a-b9be-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621551488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551488, "uuid": "fc1015ff-8b1e-4cfe-ae1b-4a097fbd6544", "comment": "Malware payload", "value": "8f4d96afdb2812de76adfae7a9e04b64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551488, "uuid": "7c18dcd4-c8a8-4f29-abab-7d240dacf22c", "comment": "Malware payload", "value": "3b90d313ccf4e920d155efb049719f6dbe7f8dbdb65b97105fcea33be3055fd2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551488, "uuid": "a0f444d3-0beb-4770-aa2b-a062b4d7c5fe", "comment": "Malware payload", "value": "0d6b22b36723152a57dce92ecca35c831cfdd464", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551488, "uuid": "e6868d4f-bff2-4891-ac63-1f759aa641ae", "comment": "Malware payload", "value": "185ecfed32d3a9637db2944ac921b6079286b128bc65c9a94c2ec112a4b4419c6c65368afd4db08aa33c45a7c25bda64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551488, "uuid": "90a688df-fa1e-4be9-aa59-1c30c0ce2a9b", "value": "1EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551488, "uuid": "506ab5d6-7715-4e39-b8d9-ecb7ecd7d729", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551488, "uuid": "c6a2155f-ed31-4726-a58b-b1b6bed753d7", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621551488, "uuid": "03046034-8f41-4e75-8c22-400b421c160d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621551488, "uuid": "8fbd7500-e33c-49b3-89e4-1f0e30b79936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551488, "uuid": "615a4c16-58fc-4924-ac07-d740f36aba4d", "value": "8f4d96af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49af9d9-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621532531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532531, "uuid": "58f91be3-ad85-49f2-a591-12ccd712babb", "comment": "Malware payload (AgentTesla)", "value": "ac784447bc0518df96166d2d39158ce9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532531, "uuid": "78abc319-c12a-44a2-ae5d-4bb33d6d7057", "comment": "Malware payload (AgentTesla)", "value": "3bd531bf7f5b3d7b331a325ebc1f71d8b59c5db9b0c03287137beb0931012a09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532531, "uuid": "04de789f-b13f-429a-86c3-14dd1532aad0", "comment": "Malware payload (AgentTesla)", "value": "558a138e6cd7aa6ea92bd1a7d80cf53976ce1713", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532531, "uuid": "732e3dfc-1ed0-467c-8148-26f279500079", "comment": "Malware payload (AgentTesla)", "value": "f22e99ce962980aa94a3031e54ab6c3ee65851b00902a2806ffc86f44e15cb35e1d2f0098946f4bac872ab34b3f4a001", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532531, "uuid": "dba6a1b2-d12e-4c73-8ccb-a5ab0c8d4a54", "value": "C4415021B3AACFAA703279710122847C32C9CDE6BC9271484CC7C6F785A49DA87B1C67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532531, "uuid": "6a5e694f-fedf-49af-83ab-2d1c08b63cef", "value": "48:f+n9+mUBVECDUx4p2uAR1oMqoUn/VhClD+Rh:GnQm0qCDE1o20/jC8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532531, "uuid": "7e684eec-9c5b-4bd1-8346-9811d6c782be", "value": 2398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532531, "uuid": "a80071b0-15c7-4025-8c49-f326ce37a607", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532531, "uuid": "9d4f9297-601f-49bd-a105-393f936cb85c", "value": "Property.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe24de2c-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621538237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538237, "uuid": "8dfa0e4c-0e69-4b4c-983d-7fa075f35b58", "comment": "Malware payload (Dridex)", "value": "8c800c13a2daa9715666cdda42169d14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538237, "uuid": "7a3f646d-f4a4-47da-8f59-15154696ed09", "comment": "Malware payload (Dridex)", "value": "3c103219fbbebb5e0af7ef782e9b9d79fd62fd8a24aea0a4255f07340f842cbe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538237, "uuid": "12d4382e-3a9a-4f4b-92e1-fc019fa8c7a6", "comment": "Malware payload (Dridex)", "value": "d45b5b6de90b1a68df53e94f976adba8502a1905", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538237, "uuid": "35df4234-ad61-4317-843e-097318ec330d", "comment": "Malware payload (Dridex)", "value": "7ef29aabf570b3bc31e01ba81a2eab59b75ef2f44bd66e89093f3794ab198175be4ac3379387a080c499d23720885496", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538237, "uuid": "4a8e4b69-49be-4cb5-8adf-cbf7171d93dd", "value": "AD04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538237, "uuid": "77f22bb6-d32e-4650-91f9-aaadfbba4b56", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538237, "uuid": "dd0dd7d9-8786-4c9e-8f8d-41fe385b765f", "value": "3072:8i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:8H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538237, "uuid": "f2dea93f-d970-40d6-b141-ca9201beb3c0", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538237, "uuid": "7ca7896d-6d6d-494d-a93e-b1d3a7877e5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538237, "uuid": "8b0918cd-7604-4277-b889-032ed0583da3", "value": "8c800c13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13658763-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527536, "uuid": "7bd7cff5-8112-43a0-b789-dacdee1a557c", "comment": "Malware payload (Dridex)", "value": "d83848118f32c98f2a2108518e7f4ceb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527536, "uuid": "639c40d8-cd20-49f1-8cd9-78f6a41099fb", "comment": "Malware payload (Dridex)", "value": "3c3a9b8031df8672aab3db5eae1c2cf9666a87f787d59cbec7345c66cf05c97d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527536, "uuid": "dd9ccdaa-7558-4467-8a9f-33172fadd5ff", "comment": "Malware payload (Dridex)", "value": "837ab03ffd6339635dc874e19a2700305e3aefcd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527536, "uuid": "e7e39667-45a8-406b-b0b4-dbe3f72b076a", "comment": "Malware payload (Dridex)", "value": "1a1c1cfa0f146c2ccdc3562bd41d4661366e49f113c24a251f37840da34322c911b661f55d57d2c23dfb92f93ca85d8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527536, "uuid": "c0ef80e8-1531-4e87-8f52-c0d5a7d51e0e", "value": "AB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527536, "uuid": "1eb5b1b7-035c-49a5-b71f-94f38bdc1b40", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527536, "uuid": "78237cdb-d8a7-42d5-9fa1-6a22cf4617d9", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527536, "uuid": "c9b682de-ea5d-46ac-ba6f-31ca902087c3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527536, "uuid": "07561d9b-2892-4167-8273-fbc23171d869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527536, "uuid": "abcc9475-8468-4b72-8b6d-11362e558e8f", "value": "d8384811_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2debb4-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537484, "uuid": "203fe39d-a158-4cd8-a5a8-c1e933d308ce", "comment": "Malware payload (Dridex)", "value": "a8c0758a2f8eb8d0309c419c28e055bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537484, "uuid": "e5275748-2ae4-4831-bd0f-57ba35de0752", "comment": "Malware payload (Dridex)", "value": "3c467fc4f82ecc9cfc18dae9d3a5aced689eae412c62182c09ff60c2af3d4c3b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537484, "uuid": "6db7b93a-8f9f-407d-900d-0930bd51a94f", "comment": "Malware payload (Dridex)", "value": "45341276f30df93f0e51d87e5637db7a9564abf4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537484, "uuid": "1c69f019-c4db-4894-8b8b-1fd2e2bfdda9", "comment": "Malware payload (Dridex)", "value": "0f135890246640205539ece14c05ecd3e8c2e1c7c19d4db1f7d0d418fd317087672dffc22cb6405f3ffa19d1d22acdd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537484, "uuid": "7f8efabe-ccf8-4d54-89b2-a5bc788ef023", "value": "F104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537484, "uuid": "05c99c9d-5eb5-4c73-8e48-83ab8a6ccab3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537484, "uuid": "c8ba582b-abd8-4316-8dbe-22bfe732d577", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537484, "uuid": "d2224280-b24f-4154-9044-98d3a84ce287", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537484, "uuid": "e34fb4d4-0a25-4649-8c9a-314f7cd3ee96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537484, "uuid": "08ae4298-bd02-42ab-ba82-96b9a966d17d", "value": "a8c0758a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e614de-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532105, "uuid": "13357be3-eca5-4468-9078-7edab67a1e4f", "comment": "Malware payload (Dridex)", "value": "56aca299e0bb0e00b50307ada3bfd3a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532105, "uuid": "d8983618-8d9e-4d27-be69-64276a9a3627", "comment": "Malware payload (Dridex)", "value": "3c76b7ef416de766b507c02008b64ba4069c1603efdadd4e2f5be23c8776cb45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532105, "uuid": "fa1594ca-4f38-49a9-9d15-68e833139860", "comment": "Malware payload (Dridex)", "value": "d1ec1ad9ad0916fc34090a82c7067c1435f945b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532105, "uuid": "2597db65-819a-4c40-921b-9aff834837e2", "comment": "Malware payload (Dridex)", "value": "5b330bbb803733ab4ed0a6532fdfb92ce1f86fdfdcf7b9b29be1d78cea81e5cf564e3e2797d2fee433ee08961f71b3fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532105, "uuid": "72f37b98-427f-416f-81e8-3614fcf963c8", "value": "2304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532105, "uuid": "54dde9f5-78c2-4de3-aa6f-83fd02e26ad0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532105, "uuid": "9ea3b781-1f86-485a-8ea4-61acc695b289", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532105, "uuid": "fee94902-c37b-490c-8a8b-01fd68a0c956", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532105, "uuid": "f419dce6-13fb-4347-8b2c-aa297620ec44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532105, "uuid": "6e1d64cf-2d8d-40f1-8d70-d9192f0ec710", "value": "56aca299_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a162ce-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532583, "uuid": "65bb57d6-d9cd-4688-9ba4-06b2a3e64af4", "comment": "Malware payload (Dridex)", "value": "def48c1e1667ff2b58438e30e2b2d1be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532583, "uuid": "c9a4b511-5f45-49bc-819e-c16f5bb0fa75", "comment": "Malware payload (Dridex)", "value": "3c9b3d053a9742e190d0ad7ce7bd216c59ee44c6a8b63e7e48e7f7866e8cd5db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532583, "uuid": "15b9e494-b1d2-409e-abb1-e4902e8ce7d5", "comment": "Malware payload (Dridex)", "value": "aeed700b6eaabab335000934f5224fb1b24244cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532583, "uuid": "7873694c-faed-4916-ab10-21c77adba61e", "comment": "Malware payload (Dridex)", "value": "1d7e1b8341aeda0d8aed2106c1fb7da04af008e8579f4cb1d7e7ce31dd5066828adfd4c53ac7b31079cf536e4df95883", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532583, "uuid": "c6048657-df82-4686-8be7-09e97d68f216", "value": "8C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532583, "uuid": "145fa102-912f-4fe2-9aa4-c9c969ea07f5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532583, "uuid": "ddaaeca0-f0fb-4ca7-9bdc-12b9a502cbe9", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532583, "uuid": "051243af-1c6d-4d3c-9089-12687506544e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532583, "uuid": "ba68d993-5ddc-402a-a169-138365732f1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532583, "uuid": "735fb0b0-ff11-4800-968e-af00893cc2fc", "value": "def48c1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f37e52-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "a1b5f1aa-950c-4146-8200-af2f4b1ae8ca", "comment": "Malware payload (Dridex)", "value": "883515e5cacafae6ce887e1b13ffae2e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "602bbb35-0aa5-48e6-8f32-88757a95c6b5", "comment": "Malware payload (Dridex)", "value": "3cb36c406888c6b6a88d00e021619dde52f9eff54a87b234364411fe4b6fa5bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "932e1fcb-28a5-493c-8986-55ead7d337fa", "comment": "Malware payload (Dridex)", "value": "ea249dc77b08a275ffebdb66514e5ff5cb309843", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530223, "uuid": "28b11154-e0bb-4873-9932-662011a1d73d", "comment": "Malware payload (Dridex)", "value": "76f54f67a30418e9391d1f09b774d205410a638f6d3d1b0cf74bfcbc3738495cd6193857ce7ef47d190248bae5ce0303", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "4211bb92-1d0a-4891-b560-a851b304d94e", "value": "C804E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "c3c6ee53-2c56-482d-89e6-0d55c98df300", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "75e26cd3-df5d-4bf1-b23b-992f2be0a82e", "value": "3072:vV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:vV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530223, "uuid": "e51d9f8d-8946-4b87-b540-7928de312abd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530223, "uuid": "4b3091b0-47ad-4fa3-b24a-f51b36199c06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530223, "uuid": "405d1a98-3eec-4f85-87a8-47ac11992b90", "value": "883515e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f04a2bf-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537192, "uuid": "07bca828-e492-40c2-a7e9-b1db9c736241", "comment": "Malware payload (Dridex)", "value": "bc55f7e3fced792296e4a7e0961dd6d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537192, "uuid": "8f97859f-e9e0-4d91-9a73-eb0b48d9020c", "comment": "Malware payload (Dridex)", "value": "3ccf7bc93f1509624bc851c0815501287546e957370fdcd491f1b70bb3addbfc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537192, "uuid": "527a339b-3a0d-471c-b552-6fe6b272cb29", "comment": "Malware payload (Dridex)", "value": "36d94a9062141a1833aa5e03955540176bf96df5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537192, "uuid": "543e90af-a160-4cb6-8928-d1d65575a5ae", "comment": "Malware payload (Dridex)", "value": "da1bba1985a299def80bd44a2e329870bd82e3d16bd0168ae8088b8f91c4ce3a3ca3c732e45a5c2f832cf841f7deb5d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537192, "uuid": "3a453f5b-bfaf-4d88-b4bb-bd8f0abc7b7c", "value": "0204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537192, "uuid": "c65ed288-e77d-40b4-a660-6a65dad9f564", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537192, "uuid": "d7b49723-c16f-4f22-bfb2-e5ef530cf9df", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537192, "uuid": "2583c13c-af5a-4450-89c2-84d463afa84f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537192, "uuid": "b7d03d33-088c-47ce-8b0b-5a527a82ca61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537192, "uuid": "4bdf22c7-6320-4703-811a-896a0d01ba8a", "value": "bc55f7e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e99e62b-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532064, "uuid": "16bc2e89-b251-490c-b2fc-e401e00d1f22", "comment": "Malware payload (Dridex)", "value": "311b3a8ca0bec08f36e9f5a42af44a0c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532064, "uuid": "38d79fe8-8518-41c0-a3a1-0867a41ad549", "comment": "Malware payload (Dridex)", "value": "3d1857a49439bb3c708e4e0ce01cf4e4a9b5b86e36ec26bdcef6caaa2b3132a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532064, "uuid": "c15b858b-2777-49a7-8b9b-20ca445f060d", "comment": "Malware payload (Dridex)", "value": "e63ef18a1cdb5d6f1b4c55bf8ed5bdb513d96622", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532064, "uuid": "12cdf566-e8bd-4f53-a507-d453f813c12e", "comment": "Malware payload (Dridex)", "value": "194fa1ce3f871090ddf9d0a9077b5bcd8732325d540d4f1406675ff505eec68aadb6069e9c7fa901788c7726f70c20dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532064, "uuid": "fe619d78-fdf1-41a1-afe0-46d94ec1f840", "value": "C504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532064, "uuid": "84f07726-436d-4e18-b9cf-57020c74ec90", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532064, "uuid": "892e7584-ef09-4d5f-8972-f89954601110", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532064, "uuid": "09789327-19aa-4d10-9bc6-27a67886c89c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532064, "uuid": "a81eaccc-a6a1-4987-b625-7da167e5bfff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532064, "uuid": "926279e1-6349-4d96-9e29-0e25341fd866", "value": "311b3a8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c331a6-b980-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524615, "uuid": "eae2af3a-daa1-46ac-b40c-f9b455ebda80", "comment": "Malware payload (Dridex)", "value": "c9b6117dd1f6ce2ffba434c70e3aa2fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524615, "uuid": "3e198b1e-df3e-4963-bf24-7865bf57a495", "comment": "Malware payload (Dridex)", "value": "3d29db17104d94304aba669833542dbabe4f6983ff0327813514979a0fe94f92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524615, "uuid": "77e25f14-44b3-4c80-ba2b-60d4206a59c8", "comment": "Malware payload (Dridex)", "value": "b54a8cc8121d0290d9c0972d5f57acbdbbee695a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524615, "uuid": "0eac0c24-7653-4e21-9531-f7ca4eb3550e", "comment": "Malware payload (Dridex)", "value": "323e1870e05e594d43723c3779ccf31fd2719fbe5fc2887b42d2145849459232d43930bb71535ee8f2f54c5430f29dae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524615, "uuid": "9037a9a0-66d7-4a07-8ecb-1c4f0a07629a", "value": "E104B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524615, "uuid": "40b3b270-fc81-4ff1-9425-bef054470ff2", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524615, "uuid": "65a10fe4-8d94-4fbc-9248-3e7dd79fc682", "value": "3072:LWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:LWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524615, "uuid": "081dd35a-96c5-472a-aa5d-6ca3aeed17ad", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524615, "uuid": "a54b903a-db98-4361-aa79-a5ec91b0cf62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524615, "uuid": "11526a38-1fd0-48dc-b70a-6ece99d30bb8", "value": "c9b6117d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd187ea2-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537753, "uuid": "563c9004-8e3f-49af-b6d1-061552abefce", "comment": "Malware payload (Dridex)", "value": "ef88c0f5b0981c2c7f2d8ab1332f4d4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537753, "uuid": "a996ca1d-65a7-4c0d-b1b8-ffb58446bcf3", "comment": "Malware payload (Dridex)", "value": "3d557b57c44d357619b7b179c379b8a69e73fe6bd443f85d7a10eccb54cc1946", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537753, "uuid": "e7d36715-80fc-4383-aac7-7683c0eabfa9", "comment": "Malware payload (Dridex)", "value": "a1177a2c55d8c07c6eb464afe4d29280cf87fc7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537753, "uuid": "7076d6d3-017d-46f3-9181-14a7d6f0336b", "comment": "Malware payload (Dridex)", "value": "347f79a659b869c6c4a0ce57f8a53c6d75385843c2b7db725a9b94abffb1cb64b52b7634b5690ac33d24a77406d3eb6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537753, "uuid": "e5c1974d-d7c8-4eae-824e-ee3b4d5ad267", "value": "A104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537753, "uuid": "8008950e-f582-401e-a847-663c40884ebc", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537753, "uuid": "3cd47ba0-d1c2-4326-b9c6-1f21b7b463a7", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537753, "uuid": "a1b64fdb-7d24-425d-8225-13c004becec6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537753, "uuid": "c364c4ee-f723-4621-984e-f866561c7db2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537753, "uuid": "1ae3438e-30c2-4ac0-aa7d-f7b8e554b75a", "value": "ef88c0f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e492bc-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545549, "uuid": "761c7473-bacb-4f5d-82ef-dfac2ffd2b4b", "comment": "Malware payload", "value": "8ea2e31139853bc95aa1cc5229d5de63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545549, "uuid": "6a755709-81f7-4871-8111-51ff31284db1", "comment": "Malware payload", "value": "3d72cff3b3d274b91065a4a6f187a1d30605946895d45399bde12dc621a0e5ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545549, "uuid": "61c3a2d5-5f4b-45a3-9d9a-7594f7b71745", "comment": "Malware payload", "value": "e2b39a146d04bb401ba982c642828fb8ca6c2e83", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545549, "uuid": "6b583566-3f21-4235-912b-507738d07edf", "comment": "Malware payload", "value": "03ae84c2525298165b2c3a293eed6e067ed52bc77fb3faf1ecd53f2d75d304f55d2cf178276c2fb1328c676d2050bcf6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545549, "uuid": "29f33149-9e2b-43f9-ada0-667528a5045a", "value": "2904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545549, "uuid": "8e9da157-1cb8-4547-b8d9-7963061d70c8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545549, "uuid": "e5e22186-feed-4df8-9182-469c2fb19767", "value": "3072:lV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:lV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545549, "uuid": "99eb05b0-bb10-4203-801c-0858ef924616", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545549, "uuid": "fbe05e96-3157-4f2b-a290-1034aa494efc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545549, "uuid": "d502e278-e0c5-45a4-b8af-61666ce9d7f3", "value": "8ea2e311_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6cc204-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526590, "uuid": "a8799f1b-93b1-4025-bc18-1a22333b9499", "comment": "Malware payload (Dridex)", "value": "8b1d20384b4a440bb326a0af29bbe839", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526590, "uuid": "cae34cf2-6fcd-4211-9839-0dfcf1939c4e", "comment": "Malware payload (Dridex)", "value": "3d7fc1de1fbc8800fed9b3198ed80d3af2362bbfaed4034a0e413de20578014a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526590, "uuid": "2cbb0e80-f467-460c-8e98-c9f360e3eaec", "comment": "Malware payload (Dridex)", "value": "7c15a67bf3177f55952db00d316e9f4419a092f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526590, "uuid": "95290632-62e2-4a47-8b36-b6939ec9fa74", "comment": "Malware payload (Dridex)", "value": "1482442a112761f5fc0d6486a4a2af3ce93ff7bf48efd8061e20b9219574bcddc23d9465f9c175993a354f2d71df84f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526590, "uuid": "09e12333-b303-4536-a018-ec7d545d155a", "value": "D404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526590, "uuid": "f70895d0-105c-4eb1-8227-a33c15f55087", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526590, "uuid": "7a8898dd-496e-4d41-b021-2abf4837b22b", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526590, "uuid": "06f7777e-4bec-40ed-9392-231cd18821e8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526590, "uuid": "59c11139-6b86-4ef1-961a-3351371f55a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526590, "uuid": "56778225-c230-4047-a4bb-72754db95421", "value": "8b1d2038_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4062b2-b935-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621492364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492364, "uuid": "7cafdcdb-b8c5-4c14-8fad-d6ebfb4a7200", "comment": "Malware payload (RemcosRAT)", "value": "44630c43fd2070d7d532ffdf771ab037", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492364, "uuid": "5398c374-b96c-4793-ba52-52fae0618d01", "comment": "Malware payload (RemcosRAT)", "value": "3db65eee0c50850fde6bc45d309b37023212f1e2366aaff209f944040aa5f789", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492364, "uuid": "ccc1cfa4-a5c7-4b32-8c39-ff648cee8ec9", "comment": "Malware payload (RemcosRAT)", "value": "98b466a35fddd1186b77017ab05a70fb3d124bc2", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492364, "uuid": "ef9564cc-217c-468a-90fb-db29f0f767b4", "comment": "Malware payload (RemcosRAT)", "value": "b5b4e79f4a713261ae5beb314303a80fda140a5b6d710bb51e64e54a3ce6cfe8441c2cd078e3999da73c126ea13a2bfb", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492364, "uuid": "45aad7ec-64f2-4ae9-9070-f4b56316bbe7", "value": "BAD4234526DA1D98B4C74BF094444248CAAD16CC70B9CF1C270AA9EFB3ADCD89E546FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492364, "uuid": "0cf1486b-0780-47c4-9408-dbc0340d0b0d", "value": "12288:cW05L8q9VlsT8t90NtyMhC4Yxh3lFaTl3X7thWaRGLDyXbWBsDIs:cW05L8qXt90DyMhb4Sx3rthWacDyRDIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621492364, "uuid": "30db2b44-c723-4add-bd9a-5da30e03e3e8", "value": 641641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621492364, "uuid": "a8c5c25f-3dee-4f80-9ab1-7e1d70b179dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492364, "uuid": "c0d4dac1-7881-4da7-a6ea-77da123c832c", "value": "5.19.21XPO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d827cb-b9ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543879, "uuid": "0084053f-eb32-4a50-a323-7040a4be5004", "comment": "Malware payload", "value": "4507f03728df8fd911c940f193e1f733", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543879, "uuid": "d8603329-67ac-4c93-83df-b0459c4f3a57", "comment": "Malware payload", "value": "3dd88d2c1a5eb2a933002150c928f0c6ebf4a454fc421d4ec92feeaf91cb15f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543879, "uuid": "a1c5a222-72d5-4c61-9fb7-22e6f09a87a5", "comment": "Malware payload", "value": "e2e2f592e5a5d7675b1d4a596719df47ebac93ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543879, "uuid": "783fafb6-c4b9-4c8f-9ad2-2fb7efee88ef", "comment": "Malware payload", "value": "0a6a7d88a1a5185d6df71a8a7731a4d3be8a4e516af2b75c0df3e7eec0ff4502a3a525eebeee5bef90a3fd6d100c20d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543879, "uuid": "4a70b6e3-f5b7-4abf-8150-63836bea3153", "value": "6904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543879, "uuid": "8febe4bf-e1f1-4ad7-b4ad-32b94e8b2569", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543879, "uuid": "21668a76-0ac1-4da2-a7c2-d7810c016283", "value": "3072:2V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:2V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543879, "uuid": "1cf3fbeb-1373-4d2b-9a9c-d53c96fabb0a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543879, "uuid": "3b0463d2-86b1-426b-828b-567808c512f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543879, "uuid": "a843ecbc-c618-41cf-971d-84ad8294a127", "value": "4507f037_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516e2b2a-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524204, "uuid": "d965859c-e6de-449a-ac01-4905697a77ac", "comment": "Malware payload (Dridex)", "value": "3af8c5b66ae289ef9f487b3e3fc6ba18", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524204, "uuid": "1b50cc79-21e9-436d-9689-cf602774a529", "comment": "Malware payload (Dridex)", "value": "3dde59ed3bd6fc70dab8fd031f077d6973e311ecb208fbba5e499440baeb63cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524204, "uuid": "557f2945-f79e-468a-8a52-141e9549651b", "comment": "Malware payload (Dridex)", "value": "c1976f3e362ff1c183522a7976dab11810358987", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524204, "uuid": "ddaefc6a-ab34-4d13-9f91-0573e6d23879", "comment": "Malware payload (Dridex)", "value": "d0eeb82995f8cdacd55cb83c3c4b67711b7d3fc4375345548c7d4e15acb7f483b84cf438cb1fdb173b4d9222c3ad45b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524204, "uuid": "2e9f3959-6da5-4ab9-b097-7e3551fc8af8", "value": "F104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524204, "uuid": "105a34e0-3e16-4e62-8405-72e8af9d1461", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524204, "uuid": "88594020-fea1-4eab-af2e-4ad799c666b7", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524204, "uuid": "105e1c85-c692-48a5-8474-b9b0bb3c2092", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524204, "uuid": "5a542304-e5bb-48e9-9e0d-82e118627b9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524204, "uuid": "d8225999-08bb-449b-b9c2-bc3794b14594", "value": "3af8c5b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4acae67-b95c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621509365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509365, "uuid": "32588d28-e82c-4b9b-83a1-cbe2036879ae", "comment": "Malware payload (Dridex)", "value": "34d4b62935aacc3bda99edc81abb76ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509365, "uuid": "c99fa440-2cde-4d12-8d98-4e1fa2aebef9", "comment": "Malware payload (Dridex)", "value": "3e0983e988d8591a29c25223767da371fd384a92b8046476ecea794805436f0a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509365, "uuid": "80c0df0d-5f02-4290-acf1-45dc7cab9b34", "comment": "Malware payload (Dridex)", "value": "f37ef3d3f7b3918728060c34f9346e31b522a52c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509365, "uuid": "354225bc-5a40-428e-b214-05463aad3b38", "comment": "Malware payload (Dridex)", "value": "c74ab41c0bbcaf5b67ff4bc1267e438f22a41ce89b0c65819e52d7b883097c289dc40a79890d06b649c4e7fe36baf02d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509365, "uuid": "892840fb-e21d-4bf6-acea-b1edaf8ffd71", "value": "E0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509365, "uuid": "0c06e80c-239d-4dac-9805-8661c16d5a51", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509365, "uuid": "93cc5950-17ce-4b8c-9dbb-1ca626dcf001", "value": "3072:AiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:reAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621509365, "uuid": "87474b48-fcdf-44c1-994e-9b5cec6bd2bd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621509365, "uuid": "f60bc1b3-ca94-44f7-b857-fcaa31264656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509365, "uuid": "27bb8a5a-25aa-44e8-a6bb-fd3460c1475a", "value": "34d4b629_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d84143-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542309, "uuid": "244a42a5-2164-4d0f-acc0-072b026912a2", "comment": "Malware payload", "value": "74b011093d83711076890922fe6fa246", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542309, "uuid": "97d77740-e841-4cd9-ba65-4e5b0ac181c3", "comment": "Malware payload", "value": "3e2ab0370b443b57298081d11cd59e3c96cc6e3dba678b0cf424efcc9b97340f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542309, "uuid": "12fc279e-91d3-491e-a75e-dde845cb02b2", "comment": "Malware payload", "value": "87c7c1e0fb20d1ad6f15001f2e044529f6c3de79", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542309, "uuid": "9ad84110-ae42-416a-a970-5db790ec8f4c", "comment": "Malware payload", "value": "4e81698401aac7fb550e54450d54ee66ba4355f2b61adbd9e6ae5d6a671fa116cb5657dbf40e37580fa9b20d7f74863a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542309, "uuid": "5658176d-efec-4ab1-99b3-eb3635a7f3b9", "value": "AD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542309, "uuid": "f06646cf-87cb-4d55-a2eb-d194b268cb0d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542309, "uuid": "31084d8d-0ae8-4001-8791-08743dc705cd", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542309, "uuid": "4fc3a06f-29d2-47f5-82a3-9c8033653b79", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542309, "uuid": "9bc3ae61-45b9-442a-8e7a-e53cbc9c0557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542309, "uuid": "5e80672c-6a2d-4154-823f-10ce970b8778", "value": "74b01109_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b722e85-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552004, "uuid": "7d09cc59-730c-46e5-b8dc-12a68475d767", "comment": "Malware payload", "value": "2a6b20d84285fc2d32e70551b9bfb318", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552004, "uuid": "c839e081-811f-48fe-b850-3d9df555c0bc", "comment": "Malware payload", "value": "3ed5d7f25f58e45d40795e871b18b79ebf06716d510fe22ed1d7eaa11f729b5a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552004, "uuid": "770f95e2-b7e4-46ab-88a8-abb57f9c9b31", "comment": "Malware payload", "value": "9c68737600fca9195db5f6ad10fb70f047da9ed4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552004, "uuid": "b3237802-5cd1-4a55-8f94-9f631a8cf723", "comment": "Malware payload", "value": "cf8bd8873c7536a96535ab0852e36509f5ebc4860b22b32690f88a34b6613faf4f62cdf868171e7e3856bbee307a272f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552004, "uuid": "4e29ed26-4504-417e-867c-d805a6dce213", "value": "CA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552004, "uuid": "f9b13229-5df4-473d-93d3-a5961bf3a49b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552004, "uuid": "310cd810-5b01-4f38-a630-d0f15a3dfd91", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552004, "uuid": "aa6cff2a-e7ae-42bb-8541-c1dbe33fcbee", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552004, "uuid": "ee6620af-2b66-48a0-bd5a-2cffed8ce4e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552004, "uuid": "29911fde-f2cf-4f44-b85f-115f27def972", "value": "2a6b20d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e42192-b9b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545344, "uuid": "33cf4af5-117b-4ab4-8816-814ab37fdd52", "comment": "Malware payload", "value": "30e10fda496bfbfce0a437aaf5d86f26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545344, "uuid": "fdd5d918-49e5-4003-83b9-f64c0665a86c", "comment": "Malware payload", "value": "3f128d8e6171bf497df00bcf3a16d1c124f129827695c8f4e55dc3b97ff1ee3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545344, "uuid": "392f9f2e-23c4-4765-ae0f-7d633a7608e8", "comment": "Malware payload", "value": "12b6ddab328bf3ebafa730316b5ecd24196f6f40", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545344, "uuid": "3c7d0158-4a5f-4dfe-9a84-0eb73ad317ca", "comment": "Malware payload", "value": "f1eadb708fb81f5424c71b83ec7ab6542c2d8fea879329a712d799774310ed55b8d7281d4f6cc3896151adec2a9ba960", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545344, "uuid": "fc03d909-c35b-45a6-8cb1-ef54eff229ef", "value": "CF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545344, "uuid": "45cc8ac8-cdf9-4cdf-9f87-c4eb44034f62", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545344, "uuid": "c9010a81-2125-4dc6-bc5d-b1a96007719f", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545344, "uuid": "594a1e07-492c-4000-8020-5d65d2c4cdbe", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545344, "uuid": "4e07e52b-ba10-464b-b17a-8a27858754d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545344, "uuid": "e281cca5-d78e-4c0f-9d3e-2253113d6211", "value": "30e10fda_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3411017-b98f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531213, "uuid": "7648e030-3569-4b21-9004-504b6e387ca2", "comment": "Malware payload (Dridex)", "value": "91b4f9f536f45db2b4d8af154fee5035", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531213, "uuid": "a18090c0-1d4b-4f95-a770-6321d1b264b5", "comment": "Malware payload (Dridex)", "value": "3f4688694cba8ac3f6c067336658d35d417d766cbf42a9787f4a92988f233342", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531213, "uuid": "0209d395-3212-4d3c-93ed-b793acf3e290", "comment": "Malware payload (Dridex)", "value": "5b16bdfe9714dd679c13ca14e965cbde5a02d433", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531213, "uuid": "e1d91863-54ad-4c10-953b-fb33082c98c1", "comment": "Malware payload (Dridex)", "value": "9526680a8a5090e708cc4f19d33733d84068318beb6212bf0c3d42fdb45dbc21e0a3099e7a94a068108142bef40cf62e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531213, "uuid": "b950aa86-053a-453a-a0e8-37f9ff9d98f7", "value": "6004E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531213, "uuid": "d57dca35-d567-4f13-9adb-4bf2e97b8b94", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531213, "uuid": "72f7f0b0-f011-4b10-947d-69ab843e2446", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531213, "uuid": "093ad6b1-9e01-42c2-9899-722def87027a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531213, "uuid": "d4c2aee6-96ed-45df-a3cf-8f0c29d31bfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531213, "uuid": "7f2f21ec-5e99-46ad-99fa-bb722de7808c", "value": "91b4f9f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5493a4b8-b94a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621501446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501446, "uuid": "42387bf1-fb80-4a93-a416-c86bb5455899", "comment": "Malware payload (AgentTesla)", "value": "83b8d6f541e40941ab9fabd0446a7926", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501446, "uuid": "5f12e666-4449-46db-9574-051f1d655a3c", "comment": "Malware payload (AgentTesla)", "value": "3f5a7effc340c773a1ef95a0c709a9e92e3daccd1e584ba3e8c1270fdd54dc7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501446, "uuid": "67186d2c-cf51-41c5-a510-bc96e0b944f6", "comment": "Malware payload (AgentTesla)", "value": "206033cc28997e3908e29fa0eb8a6b823ac4f7af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501446, "uuid": "f9200c72-6d52-4ef8-a5d7-50bae3e4cf71", "comment": "Malware payload (AgentTesla)", "value": "1b29e3faaa08654227544d32f764e0758912d5fd80c719f8554615f05292c32b10e3699a5d6e7a7758873cb9db0c3067", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501446, "uuid": "ae36c9d6-3e96-4a0e-830f-f92189e62e99", "value": "BBD4E069A7688E54D1BF577D90260251C3F0D1258507F71A6EC950FEADB33A2CA232E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501446, "uuid": "47f911da-a5c0-48e6-91e1-4bea538bf899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501446, "uuid": "d3ff1341-97a7-4690-94fa-83748fbb47b6", "value": "12288:lHwCjrhy3QC4WztAKzTWdismrC4SLtdVX6lmXIGxuia5fReaTPPKkcw17sTF:ZwCjrhy3QC4azTuisuCxhdFUm40Pa5fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501446, "uuid": "04e45f68-cd20-4463-97db-952750b1f61b", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501446, "uuid": "f5246735-a8f4-4547-9d0b-cb922d9eb600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501446, "uuid": "fe267f4f-af93-4164-aa36-98215e88ad0e", "value": "83b8d6f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229e6311-b953-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621505227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505227, "uuid": "765ba17d-731a-4798-9297-f15b63a3f3ec", "comment": "Malware payload (Dridex)", "value": "e58f4124323e110a33f47de3231909a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505227, "uuid": "f893951e-d3a7-4d3d-be45-d900644fc6f4", "comment": "Malware payload (Dridex)", "value": "3f8697c18bb0d4a2a1d3c3e4991b5ed187a6a1f310b63a53f48d8aa8787c54ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505227, "uuid": "948b7efd-5d84-406c-8298-e37e270de941", "comment": "Malware payload (Dridex)", "value": "36852b99274074381dc1b93881a4250777083da4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505227, "uuid": "dc26417b-fb68-4eea-a49d-6955586ff8c9", "comment": "Malware payload (Dridex)", "value": "890cd06817d86d64b0654c5c26fdc93c5f2000c52521d0ef4d42690c7bb68fd68fef2c4e2ac00db53ea123fdb1c97648", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505227, "uuid": "2caf7915-dc9b-4449-a9ac-38759da0045a", "value": "CC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505227, "uuid": "e55d79fa-aae8-4cdf-9944-28f2c28ced22", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505227, "uuid": "70ee9d18-7ffe-4525-b7cb-32ea5b4cd2aa", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621505227, "uuid": "a8bf4267-0222-4c81-9cde-448a675a2253", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621505227, "uuid": "5cdef564-d361-40c1-a379-436008a3b03b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505227, "uuid": "6cd52369-cb79-4074-9600-95ceafbfe018", "value": "e58f4124_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16049616-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526252, "uuid": "dbc7668d-c1b4-40a4-8864-59b4a44e516d", "comment": "Malware payload (Dridex)", "value": "fc6d62820d8d35dd3bbfb9bdeab50d0a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526252, "uuid": "06fa8e08-9bc4-4fa2-84f7-820ab4a9714f", "comment": "Malware payload (Dridex)", "value": "3fa574842133626299ed685d4f5e7271226868889b6b3c691ea06a39a2ccb2c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526252, "uuid": "eb102e2e-7c09-44b1-a91d-92aef263e09c", "comment": "Malware payload (Dridex)", "value": "52d373f25486ecd93b53d6b75d5b0f61958e0f50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526252, "uuid": "d9add2a8-de3e-4e55-9617-3a79dc2c087a", "comment": "Malware payload (Dridex)", "value": "40d73e133e80026e7df7b56cf67a6d446d80c4c77ffd9c70a121be97b5d9ffbf1aa05db38934936537a4df7f261319bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526252, "uuid": "7eb60642-4d29-4fdb-aa4c-ccb5982ca457", "value": "E404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526252, "uuid": "db521a90-f949-4e70-9877-33ed3f0eca97", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526252, "uuid": "8a95f441-bb16-4014-a8cd-155d33918ad1", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526252, "uuid": "3d1eb662-7cda-4282-aaf9-e87be3a944fa", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526252, "uuid": "38b0a7b1-8de8-4225-b080-5dc93d33a3bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526252, "uuid": "614d276b-8d2e-4011-ab68-109025d20a57", "value": "fc6d6282_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce46998-b990-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531686, "uuid": "0551feb9-76a4-4907-9935-24fae04b6592", "comment": "Malware payload (Dridex)", "value": "41b6391f977cd94e32b1944491a4c554", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531686, "uuid": "aa61732e-3eca-4b9f-906e-0401cdd73440", "comment": "Malware payload (Dridex)", "value": "3fc511f00c3de8d19c20ed64b24b003249b01a9363c77e596324862210b08454", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531686, "uuid": "12df9213-c4da-40ad-b87d-135d29817adb", "comment": "Malware payload (Dridex)", "value": "3d8139ce48d69f2e448bca9e501cd4a9bfd379f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531686, "uuid": "1f0731ad-6901-49ad-be93-f6c0c3824626", "comment": "Malware payload (Dridex)", "value": "01f6b5895ee784ea27e64113738ba5968415858d628ed490b646f7f7a8a8d025ed651ea3b049cc13091f8e76c63ba56f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531686, "uuid": "944cdf96-1e45-4272-afd7-a1b0c9dd951c", "value": "4B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531686, "uuid": "84a1f36e-24f9-44a7-8734-8815177ffba0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531686, "uuid": "b20e1de8-d669-4115-8c17-86f5f821143a", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531686, "uuid": "8d8b0aff-de7b-45ab-9051-082dd7552c25", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531686, "uuid": "85615c89-1380-48e2-bc72-b52b9702554a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531686, "uuid": "19b47695-4895-4b5d-a4bd-188deb565290", "value": "41b6391f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13eca91-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535961, "uuid": "59ba4957-009b-400d-af4a-73568b0f1cd9", "comment": "Malware payload (Dridex)", "value": "288155d8cb61a4dfa9cf01aa9e9f4c58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535961, "uuid": "4d4b443c-7574-48c0-98c2-b82b8905b813", "comment": "Malware payload (Dridex)", "value": "3ffb54a0f673919325490aedfffff843e2fbde07199e454d0eab916bb234872b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535961, "uuid": "e64fdc2f-e0d5-4303-9fab-7006e38cc786", "comment": "Malware payload (Dridex)", "value": "3ccf3aa105c26800daaaaa199b1a32150a1b4470", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535961, "uuid": "15f3a728-9016-490d-8d84-57bb08d571d9", "comment": "Malware payload (Dridex)", "value": "2ce5cfb779b650e02903fcab3dcc1caeb8585ef60e073d2f3e3703117d51df5d4ffe3a7efb1411ded7bc6de5bbd1a679", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535961, "uuid": "b5369a88-51fb-43d4-9da2-60d9f76375da", "value": "3904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535961, "uuid": "aafd0abe-ec0f-469c-a32f-b3b1d7e8e84b", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535961, "uuid": "4f5ac906-b928-4f79-8787-cad2e1b3a26a", "value": "3072:Ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:JH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535961, "uuid": "60ab422c-d0d9-4b02-8bcd-339f20696557", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535961, "uuid": "a65e3e74-fa3e-4aa2-bfac-835ad3de94bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535961, "uuid": "33c97866-ac91-4c77-b558-02122735c372", "value": "288155d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e11a391-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543499, "uuid": "8fb0297e-d9b4-4552-82b7-fe5af0634406", "comment": "Malware payload", "value": "36c7f3679a3acb61a2a1384cf0a256d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543499, "uuid": "ff895e50-080e-42f2-9560-e5c51a88b592", "comment": "Malware payload", "value": "404bfb1d85cc31d9ed9ca3681e5431cc90a65736ec793468890ae58f982ab4de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543499, "uuid": "01453b30-5125-498b-b641-8e86b0b15652", "comment": "Malware payload", "value": "d385437b6d9cfd72001fec39cd693f6bf1717a41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543499, "uuid": "fc17a371-c230-46d6-aa18-cc68f7849a56", "comment": "Malware payload", "value": "277be22f2a94fa726c580d9aa9bbf6f0bafb0350844e0a14a41a0d8c4ac994d912b2e18e953a699f49bfe629237546ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543499, "uuid": "bff4f85f-fc63-49c3-ad6a-7c510f940b18", "value": "6E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543499, "uuid": "87ca58f8-37f2-40ab-a8ef-f77b2a030eb8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543499, "uuid": "9adc2e36-9bbc-4159-8137-e5d0d3721d7d", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543499, "uuid": "a0ab4c74-d5fd-47cb-a877-6f4ca6fee3d2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543499, "uuid": "a1e1574c-3175-4ce5-a501-af0a42669232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543499, "uuid": "81d99d37-b7c6-44cf-bcde-7aeaf3a1d91f", "value": "36c7f367_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6716d90-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533017, "uuid": "e1ac697e-3736-45ca-8a40-2d4d8bdccadb", "comment": "Malware payload (Dridex)", "value": "a17d1d0df4f05fe6c9fe076f52fdbed1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533017, "uuid": "2030a373-4caa-473e-8b83-fbad4c733b51", "comment": "Malware payload (Dridex)", "value": "406a3c9c2cd428bd4e3797cb67ce82f7eb77f9823964438d33e9b3ffba5e912e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533017, "uuid": "3fd405e7-7ce2-4cde-8446-93ba6c32d09c", "comment": "Malware payload (Dridex)", "value": "b74ed0521b718acdf27692bc3d6373705aa94ee7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533017, "uuid": "bcaaf858-cfc9-457e-a05a-cc00afb85596", "comment": "Malware payload (Dridex)", "value": "0046890831490a28368aec0e89bcb25730ce24b292f9392a42356260a7b15e7a6afa120a6cb9439d7acf0d01946475ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533017, "uuid": "cf291b06-efe8-46d6-8133-aeeb6f8513ff", "value": "E504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533017, "uuid": "bfc496e7-780b-4cda-8424-1943ae0beb7c", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533017, "uuid": "52f43986-3ca8-4090-bf50-b95ce44c451f", "value": "3072:gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:gH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533017, "uuid": "c1478aad-3817-428c-b9c1-224d6cd0b1e5", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533017, "uuid": "8d69b541-259a-4189-a28b-e6f8b8ad1c78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533017, "uuid": "93008733-b059-4743-819f-d35c7b3f6dea", "value": "a17d1d0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6c3a7f-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529487, "uuid": "7dfb52b6-0aa2-4e7c-a64a-3d769b225d26", "comment": "Malware payload (Dridex)", "value": "9974d58a73fa00761590613bf6ed25fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529487, "uuid": "bde442de-9eb8-42a3-8880-236a3b9bcfe7", "comment": "Malware payload (Dridex)", "value": "408003960f6256799e304741829129529197fd9bf4fb997ad6194220727aa239", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529487, "uuid": "d08af508-09eb-4502-bac7-31d27df3d643", "comment": "Malware payload (Dridex)", "value": "71e3faa7e0a16ca9b910037c93fa008e3281c5ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529487, "uuid": "e4029e82-8292-469c-9a55-f784c88bf1a1", "comment": "Malware payload (Dridex)", "value": "8d2b77d93c08a2ded837e210320c344abd0a045c7c7bf7e05fd36a1dea6c6a86e0e6ee3a593bf6fd23d9fdc31f051c24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529487, "uuid": "9dd35e27-73b9-48dc-a11e-586134d733dc", "value": "0604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529487, "uuid": "f7bb98f8-fa0c-46f7-88cb-1d4f6c6583fe", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529487, "uuid": "2bddfccf-fd70-4e6e-8f46-eb98b1050f7b", "value": "3072:Di49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:DH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529487, "uuid": "7aedf69c-f75d-45d9-896f-0debdcf94dea", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529487, "uuid": "00b6b9b5-4e4e-4de8-9397-b8a2ebef5129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529487, "uuid": "c67e12c6-dfdb-4917-9caf-ea0900c92b0f", "value": "9974d58a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c963455-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "cf8f9439-05ee-4634-91e9-96df7cffad61", "comment": "Malware payload (Dridex)", "value": "55c4cd9eb4abb9abc2d9018bd180db07", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "ed8242a5-481a-489c-bb79-3b9bdfcc71ed", "comment": "Malware payload (Dridex)", "value": "40874087f98a06a04919809974c69740c423cf914aab31dc7e77b872c0efcb53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "34d1acfc-9938-4898-be25-173d7c9eb3c5", "comment": "Malware payload (Dridex)", "value": "805cfa02636ef1d5baa99f89d3051dabaae33827", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "83066e2f-fefe-41f6-97bc-2373b4896d71", "comment": "Malware payload (Dridex)", "value": "82b2fe4d3286fb8900e67368af9274381dea3dbf0b27217d6c0dd3e6b5ae8a6ea0f75b37b557bfc639581c366c102463", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "bc03cdfd-599f-4954-99f2-c1bc8d0e1da2", "value": "A904E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "fecbb16e-9c70-4369-9b14-0d7ff9804b8f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "f9e4f46d-d241-4f44-a5fc-f83bbd107fa9", "value": "3072:VV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:VV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530719, "uuid": "7b36cb40-c141-4b25-a7b0-b8c880741de4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530719, "uuid": "7259900c-3150-428b-8564-35559da64cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "d9a46998-e05a-432d-87f7-7f9bb21b0224", "value": "55c4cd9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6a798b-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538902, "uuid": "2991db14-8bd5-432f-a72e-99416283f453", "comment": "Malware payload", "value": "59e831f7b152b1dbd0bc9ef7f565f590", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538902, "uuid": "afd8d951-82f5-4713-b8c2-42a32b442e86", "comment": "Malware payload", "value": "413bf1a6ebc3bd228dd74708066bf2ab7ba06260c23160ffa364ebd3f0689cdd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538902, "uuid": "02add26d-eeff-4b17-a0ec-b68e36b29523", "comment": "Malware payload", "value": "97abf47bcb9b38c11ef3be5366cacf6fa2c69205", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538902, "uuid": "f6147640-f0aa-4b7d-adf1-1136f1929063", "comment": "Malware payload", "value": "ebe4c6c4e661eb476967c9f265444c2bda73b7506a94327b6a13c9333e33c6b7672dd97d8925427ce0b85b05498e6796", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538902, "uuid": "7c2f78b0-399d-4fb1-bd2f-66be5db50516", "value": "3904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538902, "uuid": "48077fdd-84aa-479f-93b4-c4236d8e8a44", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538902, "uuid": "80a50772-99a4-465d-a010-88392ece8cb2", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538902, "uuid": "f6a1f70f-277e-46c0-ab80-f24c9e0bdc8e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538902, "uuid": "98c64d33-bff4-4198-8949-ca7b06a44a3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538902, "uuid": "7ccc74f1-0c69-44e9-b182-7bd56f7ac8b5", "value": "59e831f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a70076-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537067, "uuid": "b9699a57-baad-4535-a679-44a1692a97e1", "comment": "Malware payload (Dridex)", "value": "0b1d5cbd2ce11ecdc6017744bd6f256a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537067, "uuid": "dd68785d-4ef2-44ec-817f-1e5a386b8ab3", "comment": "Malware payload (Dridex)", "value": "4168885292f8673d272529b067e837abe0ed7f33321282cac774988555f343b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537067, "uuid": "27c00659-1be5-4755-b540-57d14bee66a6", "comment": "Malware payload (Dridex)", "value": "96409d7f1f4be13fe854904ffb992885e1f7aaef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537067, "uuid": "8c62d0c5-fc2c-467b-a2c1-88dbd14cab1b", "comment": "Malware payload (Dridex)", "value": "5b88d04c142a2d8748f8857d01bd95126f6ebf7371a07e6826304008de7de11aeceebe036222e0236489e383d4de8267", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537067, "uuid": "5b6e7274-44f6-43a0-bf83-d401a738f710", "value": "9D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537067, "uuid": "009422f4-dd3b-4584-b31e-0329ecb802e9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537067, "uuid": "7a2b0e24-eae9-4f4a-b0ea-e4b9acb50730", "value": "3072:9V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:9V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537067, "uuid": "4768f29d-c834-4594-af62-b19800b1ef6f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537067, "uuid": "e8049dc2-5d52-4134-8771-77d170ae7dc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537067, "uuid": "a21b3c83-c967-49de-912a-ecde2a06d38d", "value": "0b1d5cbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5f5864-b96a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621515095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515095, "uuid": "a38f1e12-7ab7-4600-bf06-bff8024f25ef", "comment": "Malware payload (AgentTesla)", "value": "b1f71fa691b4d4d3e59e3e2dc2cba9b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515095, "uuid": "1ffb31d9-e956-40f1-8205-d68e8423758c", "comment": "Malware payload (AgentTesla)", "value": "418b8285d8a2e7129052ca76c5f30243713e543ee94b603cc71858566d15e50b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515095, "uuid": "ec3e8774-e47d-4ec1-b5f5-5973005c5215", "comment": "Malware payload (AgentTesla)", "value": "bf3bf454402888ee234c7a12d921b402d50ca3ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515095, "uuid": "a23d4f95-4478-4714-9299-c64b8fa9b76f", "comment": "Malware payload (AgentTesla)", "value": "2b6ebef085a60aca67733bdcb704d4ff9f5731d6f0f527a8da2c4ba84657e0bd86787610edde713436c9a03b911038a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515095, "uuid": "e8b3a771-e15a-4826-af4d-24a01d70bebd", "value": "6BB412101394AB7CEC3DA77D9424952003F6E411E712EF2A7E9A409B10D7B8FC7BAA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515095, "uuid": "ac2de37b-fcf0-4270-9885-03be7d95e34b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515095, "uuid": "24eba858-fe09-4b5a-a49a-c004769d4751", "value": "12288:5SXKzjJ3hJJVkBjV6oOI/4Y3JPyZ7Q8S9UrwsyK:4az9hHVkl4oOc4YUW8Serzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621515095, "uuid": "46482d9f-f533-4673-ac4d-76d9c6a7da45", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621515095, "uuid": "5f663468-d51a-4f77-a93d-497ecf91a522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515095, "uuid": "466e25c8-e1b3-4e51-bb53-c64e9e708472", "value": "70LT1PeYjLyvKWV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48b739a-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543671, "uuid": "2d24a253-129c-4cfa-843f-94c179cdf64d", "comment": "Malware payload", "value": "b9505b0715f93e98257aff6d899404da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543671, "uuid": "cf38268b-ffd3-4431-997e-164843eeaaec", "comment": "Malware payload", "value": "41a35bfb57420daa5cef7d5b2e5e77f1a9de0496c068d327a89d96e9243f17b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543671, "uuid": "77850a84-611d-4e8b-a719-672a223e6f9f", "comment": "Malware payload", "value": "f151282585304ee0156f21eb95ff57357ef288a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543671, "uuid": "fb060934-7bda-4a1e-8b59-9402dfd2c29d", "comment": "Malware payload", "value": "6b33269e8c985c2d8b0fcea0c894c4d0b7f2a051650663c19919fc47606c2a015e7fe735fde4960f97183e8156432d7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543671, "uuid": "4c71035d-6fd9-48c9-a72b-7fe01704e173", "value": "1B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543671, "uuid": "29d1af0d-2bf4-4331-8182-40aa0956cfcc", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543671, "uuid": "f7bedcba-6c1d-47d7-8c67-b0b934e481f0", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543671, "uuid": "6c88f9e7-e9e9-487c-ab0e-b8b26c05a804", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543671, "uuid": "f0aae9cb-d26e-4ff2-b4da-9bd119c6dd65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543671, "uuid": "15704068-1fde-441d-b3cf-4a0108bdfb3e", "value": "b9505b07_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa3cd26-b98f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531306, "uuid": "3c7ce6f0-7ba2-4c0f-8e25-6b81cf546610", "comment": "Malware payload (Dridex)", "value": "0071df1c6726ce82267a5b6ed010a838", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531306, "uuid": "c95fac5d-2cfb-47d9-9d2f-40e7278a166e", "comment": "Malware payload (Dridex)", "value": "41aae59c9ac9b4451413c01681221a43be40e56993aef39558e3df8d148de482", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531306, "uuid": "0772e60f-5a60-4182-bd36-4111460d3a63", "comment": "Malware payload (Dridex)", "value": "c20f268223f105ef71d27dae6bc9b2fb9214158d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531306, "uuid": "d36503f4-a176-4d81-9060-5e743a3e10b8", "comment": "Malware payload (Dridex)", "value": "08c9ec3d26b4bec659b5ff9d0037c655f00561ad08f7c3657dc3a044e799ce137352926e34cacded55054e16bfc90246", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531306, "uuid": "0767f123-86bf-4811-9eb5-62ea9396016b", "value": "B0F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531306, "uuid": "c138b1d5-9941-4a80-a6c1-e1daee2c941b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531306, "uuid": "2bc832d0-f1e1-402d-9cd0-f3e84be9be6b", "value": "3072:UA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:U3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531306, "uuid": "68d56d35-625b-4961-8ad2-70942e833852", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531306, "uuid": "ca57f42e-538a-4ac3-a5c1-45fe89b58f48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531306, "uuid": "4b4bf6b9-19be-448d-a49e-ff3b21a15dfb", "value": "0071df1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9045257a-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541060, "uuid": "4cee5316-c4f1-48ee-9be3-085db832583d", "comment": "Malware payload", "value": "85dd7aacbc2232dc30a80d8ba05235d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541060, "uuid": "063d4921-5ae7-4a1c-9366-fa2908a67f9f", "comment": "Malware payload", "value": "41b0843f3949e7d6f6ef0a48fafd4d76c6590335829b184db96acd375776bad7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541060, "uuid": "44133cc0-a5c2-43c4-a790-961610cdde83", "comment": "Malware payload", "value": "188625f321e26b719b67648f8e5a666153344e2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541060, "uuid": "3ba63d34-1d10-4051-b561-a1dbc43914a9", "comment": "Malware payload", "value": "e4b8348f3983701d908f2a15f96bbce67f709e65ee8c96f084420c91d910e98ff2f5b705c3f6bcf8cf596d89a94d3760", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541060, "uuid": "722ed034-7044-4b3f-96db-ed1c17923299", "value": "66F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541060, "uuid": "d9059d9b-bcf2-4076-9b8b-34ae848782b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541060, "uuid": "b0093239-a6d9-4fa0-a039-66cea4f1b939", "value": "3072:IIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541060, "uuid": "e943c864-dc41-4efb-a473-3569cc08d611", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541060, "uuid": "ac8c7be7-65a5-4c57-8ae5-2e90c72f1b41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541060, "uuid": "0e25fbc9-9e69-4a08-b609-156199b04814", "value": "85dd7aac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da8bf56-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544464, "uuid": "68680dae-3b16-4bbe-8dae-3f75b6ba3d59", "comment": "Malware payload", "value": "a85e617111ad5d3b5380fd6c0fb2d4e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544464, "uuid": "f63d6d50-31ab-47fa-91a2-2fe8a97f1c03", "comment": "Malware payload", "value": "41ba43763b7077fbdb848575e3685570479c5bf88d04ba030fed6a33001e70f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544464, "uuid": "09b9b4b2-d061-4e56-9a42-d48a965e7b84", "comment": "Malware payload", "value": "14c31c27a7a73c372b20c10161851a7e7e270d75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544464, "uuid": "55d7783a-f828-4341-8ca2-e487f92b9371", "comment": "Malware payload", "value": "18a06b43c96be1371b3c2031ee0853142ee2670f95121fce47631739dbeb1c8898aacea3a38012c2ce7fe40776351dcb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544464, "uuid": "150a42eb-5d70-4517-bbe1-683b52d0b69f", "value": "6E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544464, "uuid": "6627e516-d9fb-4122-82dd-fe4905aaf021", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544464, "uuid": "feacb7bf-3873-4e43-a259-12c85e20f6ce", "value": "3072:6i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:6H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544464, "uuid": "2b9568e0-e205-46ea-a5d5-3cb9079798ad", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544464, "uuid": "382a5390-50a0-4539-9113-2d24b82b536f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544464, "uuid": "c0eaa73a-1b3d-493c-91bd-951b04d128c3", "value": "a85e6171_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1691f1da-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531836, "uuid": "648aaae0-0e20-451f-841f-e6aa407bee48", "comment": "Malware payload (Dridex)", "value": "986abeaed65340068ed2da46af81f099", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531836, "uuid": "69042288-2642-4144-bd67-aa509166847a", "comment": "Malware payload (Dridex)", "value": "41bf3f2a4563ee8bc93972d099a2542b449f3e83b7848765918d76c7c2404e27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531836, "uuid": "afb6e006-53b5-48c3-9f42-4bc85f288b2c", "comment": "Malware payload (Dridex)", "value": "d2c7e09acd2e0ebf6656001260f6143af00eb69c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531836, "uuid": "c590d94b-4f2e-4fd0-9fb8-1c7d30528cb3", "comment": "Malware payload (Dridex)", "value": "3955246a1cde07d3e2ce34d41a74560d9b14c0d10a7f674e8a85f4954b86dea777deddadf0e6ec24d02410e4fd90b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531836, "uuid": "8ca83455-6a01-4617-b63c-5bd9029a67d0", "value": "4A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531836, "uuid": "0f99bd68-b2b4-4bbb-a5dc-ea5c723fa3c1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531836, "uuid": "69591ad5-c371-4b80-9ffb-f5580f9ad672", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531836, "uuid": "cee34d43-a8c2-448c-be2b-6c05fc03e755", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531836, "uuid": "a9787e6c-3b06-4ef0-85a5-154b8c17bd3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531836, "uuid": "58fb47de-7bcc-4c39-9358-fb280c0244f5", "value": "986abeae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df3b5e4-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532009, "uuid": "2904c8b7-8341-4a63-9a6c-d58f3a774808", "comment": "Malware payload (Dridex)", "value": "6c438ed859437886a13de67215959db4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532009, "uuid": "9bff0a8d-87ce-4281-bd2c-b197d4077e12", "comment": "Malware payload (Dridex)", "value": "41c7284283dc8755669dad3fea2a758983e84275df43a3b5eeff919e4d2a48c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532009, "uuid": "ea7eea61-20f9-4d3e-b5d3-e5d06231a39b", "comment": "Malware payload (Dridex)", "value": "1413d03e308be043ee7a3649edb518c3b3f7b444", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532009, "uuid": "e3ca6e31-24fb-4f1c-8488-7482457ab521", "comment": "Malware payload (Dridex)", "value": "e481e80591165737a1cf7f5ecbd2e773dde21225287aed2ea9991ab7c82dd1fd4c794b3155df89d191d7da205612091e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532009, "uuid": "197117a7-85f3-436e-8154-b78a2e793d39", "value": "6704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532009, "uuid": "9c35940a-8ca6-4730-9dea-9dfe0f04d8c0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532009, "uuid": "8cfaa5c6-ecf2-4791-85f4-bb81a3476f54", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532009, "uuid": "63014802-2e0a-4f23-8665-8f3b549780b9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532009, "uuid": "a9eb6dba-f5fd-4bfe-8e0d-d2db5a27f3b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532009, "uuid": "c532a15c-ec53-4793-a56d-3d34f1442eeb", "value": "6c438ed8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab35003-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483793, "uuid": "c7b5ff39-008e-4ab1-b819-67e2f6467dc1", "comment": "Malware payload (Dridex)", "value": "68c73f46520bfd7224c44aa83bf07052", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483793, "uuid": "4adbf7e8-f282-48bb-ba21-bcddc0085b82", "comment": "Malware payload (Dridex)", "value": "41cd98391401aeca63c8b9a69cff97058109131951d4bfd20d9714255fc934c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483793, "uuid": "7b6ef5f0-f786-42a1-b4b7-b532b4deb5f8", "comment": "Malware payload (Dridex)", "value": "890bd6ac3861f507805e47a47e834a81af1295e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483793, "uuid": "a79240ee-3675-49ae-a2a1-aa9f95c4bb14", "comment": "Malware payload (Dridex)", "value": "f0dac889c3cbab784c3364e87b465d3cb4a49e82d5aa04c2341374df41d3e001acf9bb3edb32e41b100042e10c5ab43c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483793, "uuid": "ec86cdc6-ec54-4fda-9675-5bee3b3a4f4b", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483793, "uuid": "26418283-02f2-4a3e-b3f6-455f0dc9c5b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483793, "uuid": "b75db497-8d09-43fe-9ffe-5fd7dcd338c6", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483793, "uuid": "367a3364-0f17-4a23-9bc1-d0ff55743f9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483793, "uuid": "64c7cdb2-2ac3-4f6b-a812-b713613fe47d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483793, "uuid": "7026667f-dbfb-4254-8bfd-719826b738d9", "value": "68c73f46_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8773c13-b939-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621494392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494392, "uuid": "d8c66b3f-b424-4968-87c2-decb7cc41905", "comment": "Malware payload (Dridex)", "value": "7c23fb358851ead8653578346fccdff7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494392, "uuid": "32be2ecb-08f1-4093-8008-cdc618ec5828", "comment": "Malware payload (Dridex)", "value": "41db764dbfae72a0557a748f24447e53aacf3730704900cbf26b8c5759428b5f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494392, "uuid": "a99b9c9b-f25d-4827-a584-938c2c5076bb", "comment": "Malware payload (Dridex)", "value": "7bd0dddad406f9eb765fca24c5be6dbbb91b6894", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494392, "uuid": "c83eceb7-ae20-4c58-9bdf-904fd0f3e587", "comment": "Malware payload (Dridex)", "value": "06d6ecaab75afbbed5a2c259caa74ed88094ffc3b3a956fcb9d81fece6e3926f4c5e95ef99bed632db568228d9ab5302", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494392, "uuid": "ee0a4e05-ce10-46a4-932c-493384aff3ff", "value": "EEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494392, "uuid": "9d186875-7b18-43b2-b602-2e1e8d3e95da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494392, "uuid": "e99887b8-5e9b-4781-9bad-292776b6b0d7", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621494392, "uuid": "c55a3d6c-19b1-4a19-83ba-d0b5814c3e4c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621494392, "uuid": "57e30d35-0b1c-470a-a475-c45e4f750902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494392, "uuid": "77cd4ecf-1126-4e94-968e-327263ce9ef4", "value": "7c23fb35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d7680d-b973-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621518926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518926, "uuid": "5ac5de07-2a4a-4dca-ac22-1986faf25cb4", "comment": "Malware payload (Loki)", "value": "c6adb9ba1f5b5d83a4b0bba1d8b5b2b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518926, "uuid": "b60d037d-e892-49f6-ad69-699959ec5d4c", "comment": "Malware payload (Loki)", "value": "41e04b901facfd5a18b5576562d66a94d8e86c6a913a62ae6ab440027ff5b17a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518926, "uuid": "dd2bb676-44ca-471c-8ee9-74bc852ec00b", "comment": "Malware payload (Loki)", "value": "43df172cd671b7b911db0b98162f266ad58c7467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518926, "uuid": "0ba29444-66d0-48f0-8008-6bef3c89e69a", "comment": "Malware payload (Loki)", "value": "9a0d0092dfd9ec174d3ff87b381b5a5b82ad375d0f99e62cb736a0bd616c29aca2094c50e1c68107ece0907618e48953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518926, "uuid": "b392257c-8480-4a66-8fc8-fe655727055c", "value": "66F418AE725072DFC867C972CAA81C64EB9074BB830BD247A02355ED9E4D997CF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518926, "uuid": "505cae71-1ecf-42df-8cb6-b415cbd26737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518926, "uuid": "273e9eda-41e5-48b6-89a9-b62753a5363e", "value": "12288:cNHSClexORKztPhkk/shPBLmc31fpTXRbbX2+KirGbQyKli9vN7bI4jxxpDK9kX9:uHwOMzRheh55BpTZRGbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621518926, "uuid": "d883726d-64f7-4f24-8111-2bdf56789809", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621518926, "uuid": "7da14c8f-f45e-47ac-9c62-21254d49db8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518926, "uuid": "b75b73f2-4c61-4d3e-b183-848548814d15", "value": "LIST ITEM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98389cca-b9aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542791, "uuid": "b4527f40-7902-487c-a726-201630280f2b", "comment": "Malware payload", "value": "4f3ba1f9948c87ce84bd54145ecd69ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542791, "uuid": "4a393a77-96d9-40b4-9f04-8272e6a4953f", "comment": "Malware payload", "value": "41e922c0265a67a00167c2f4bd96cec9fe75a5053b0bed29b2983e39ebef32ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542791, "uuid": "03414ed0-9ced-46e1-98f1-2a438853a4b9", "comment": "Malware payload", "value": "68c0a378afcc030b1c6000f44c9522ffd93aee6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542791, "uuid": "f3c5f9ea-e11b-4b40-b04c-5d2b1c23a968", "comment": "Malware payload", "value": "807fd5d6df77750b68a71561e62c63a4a96c541c4aa7af41455250f0465bc421f42120e2fc0fdd362075fb6102085e02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542791, "uuid": "b20cd695-50af-4e31-899b-0335752c602c", "value": "9804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542791, "uuid": "f6656bb1-a33e-41e9-b453-87d82551577b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542791, "uuid": "03635a39-81d6-4f6b-b63c-efc08dc16500", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542791, "uuid": "7918a9d1-88b8-4981-8593-7f291c1cc66b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542791, "uuid": "b6532569-605b-4b0d-ac78-6255b9db45cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542791, "uuid": "587dac56-4980-463d-80de-26def17fab88", "value": "4f3ba1f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11281f29-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "c3595cad-a9d2-416d-8a9a-ef3ee13f56fe", "comment": "Malware payload (Dridex)", "value": "38b329d3efda37fb3442fe51c8496785", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "9cd1095c-a003-4032-951f-474e1a4cbbb6", "comment": "Malware payload (Dridex)", "value": "41f2cf0ceeb7ac11cc6c7b5a24dd80dc0ea10379d790c4d15bb7c1f7243ab948", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "6c770135-a26c-49aa-bee2-07b71e7c1897", "comment": "Malware payload (Dridex)", "value": "7617ba8500c8ba214f36bf43e8cc02f26fbd4b2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536122, "uuid": "87594023-e694-4afe-8571-8685cdf7f789", "comment": "Malware payload (Dridex)", "value": "2bdd4e43c8b3d00b689301c0792210dc0a268570f489a0f34cfced607ee83eebca97161cee5c2a7517038dde82c7e952", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "8a2e3efa-e27b-4ba8-ad2f-48d50af50538", "value": "4604B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "ccc30de3-3571-453a-b2b3-5d4757bd838e", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "5165b0b5-020d-41a1-8e37-10c41389e82b", "value": "3072:dWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:dWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536122, "uuid": "1c95c772-8704-445b-965e-f6a4678ea9cf", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536122, "uuid": "174fc9ba-049d-46e7-9237-99f219971f2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536122, "uuid": "ed9bfab3-779d-4eb9-8612-58301ef7cb52", "value": "38b329d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed47f01-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621486967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486967, "uuid": "cc52ef44-af63-4993-869a-f470789e7146", "comment": "Malware payload (Dridex)", "value": "136a14f8bfd09bb0892212af5171e1ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486967, "uuid": "fb168c4b-643b-4b60-9a26-48ae10400366", "comment": "Malware payload (Dridex)", "value": "41f52efcbd3a568e2cd38bc39968697e0278b9673f5d4139c8f6a263883a474e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486967, "uuid": "94b2515b-f34f-483a-9e36-25e0d7ab5283", "comment": "Malware payload (Dridex)", "value": "8d508933d7bcbf66134a67c3fffd2b06e7b87d0f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486967, "uuid": "c70696dc-7ee4-4a8d-b7bd-5125ca538497", "comment": "Malware payload (Dridex)", "value": "8e478d4676c857e594cab75ce3bd7f29049e90dc740883198d2fdb3ba9ae2f2eb83c037fbeef66522ee9f07abb24de00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486967, "uuid": "2c390c91-fe40-4786-a395-619361a63987", "value": "BB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486967, "uuid": "8a45bd4c-6502-4616-a238-ac45feba17d8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486967, "uuid": "028ed46e-7d70-4c30-a64a-961bdfffff21", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621486967, "uuid": "7784bb46-df18-4f02-80cc-2a92692fa4d3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621486967, "uuid": "e037242a-98d3-4281-8bb9-dca815a0115e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486967, "uuid": "31bcc162-82ce-45e4-b176-0b6ba0b7c306", "value": "136a14f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ef667b-b941-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621497668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497668, "uuid": "df4161ce-8148-4fde-ab38-833308d62224", "comment": "Malware payload (Dridex)", "value": "2f343f3b92252dbd380fb4095264c111", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497668, "uuid": "b1a5eb52-986f-433a-a1d3-f3ec2a184bd8", "comment": "Malware payload (Dridex)", "value": "422b37f354459f2e89bb68f9e48496c1393262daf0af1248f4d0cf6d4eba923b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497668, "uuid": "0e6990e5-5faf-4417-af3d-b00edf609462", "comment": "Malware payload (Dridex)", "value": "806b85683b951421ecc20d85626c05673dc0fdcf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621497668, "uuid": "56a0daa0-4d3b-4001-8c8f-b0cb826eaa94", "comment": "Malware payload (Dridex)", "value": "ab45dd8619ff2d55dd134d12b88722bdc2f8e3d74be762a49879fe016a8e8c3bacdcab6392d376791d3f607778b81bce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497668, "uuid": "3c296da3-6db6-4654-b079-3e4c779926b5", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497668, "uuid": "68dad8ae-687a-4120-9a13-072b9368604b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497668, "uuid": "ae16f6f9-649e-4c0f-9f50-397fabad3bde", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621497668, "uuid": "3ddb03ff-7ae2-429d-95e6-3ae77a0ef7ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621497668, "uuid": "df5cedd7-6ad7-4f70-a27e-3556ed60f73d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621497668, "uuid": "47a736cb-c920-407b-a6bb-cedbd5427cd4", "value": "2f343f3b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa1ca1f-b9c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554418, "uuid": "186d2c0b-66ee-4aaa-8d43-fd5d863dbf40", "comment": "Malware payload", "value": "71d9a5b782e603ee5896f830e37e9c8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554418, "uuid": "77698998-80ed-48e5-8c81-4031c23f6d85", "comment": "Malware payload", "value": "4245fcdb7647407c223d9e1f1bcfbb283802e87d0e0d7a4217b6aeda08ad3cec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554418, "uuid": "09dc255d-d736-479c-abfa-5a0a9c7cfa6b", "comment": "Malware payload", "value": "e4a6dcb2348b7886579a33846420b5ca97d29980", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554418, "uuid": "92494ef4-1e0d-406b-948b-fe54a257e59e", "comment": "Malware payload", "value": "af431a098ab90b6dc11fb5b1341a8e23562e05225242e6605104dca1e8ed560ddb81efe721300d31a358ea113756071e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554418, "uuid": "6ad8f878-6964-4b79-9b9a-cc5c41a36c91", "value": "5204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554418, "uuid": "e9d75c2d-df34-4bb0-a1c9-178f43b81d1b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554418, "uuid": "dcbc4078-4fa4-416c-abfd-7471527e2af7", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554418, "uuid": "5a854a61-17ce-43ec-b70b-24b8f9365513", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554418, "uuid": "de399362-a2e1-49ab-aac6-76d193021ee9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554418, "uuid": "b34470c5-e6b1-4813-a23c-8617361a742a", "value": "71d9a5b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef86d452-b9aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542937, "uuid": "9dd6586b-8fab-4d7e-9eba-ef81d78e39a8", "comment": "Malware payload", "value": "3051cbcce5b83be88364d75ce00e0e58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542937, "uuid": "27c27a0b-59fb-4048-9feb-e02469b11240", "comment": "Malware payload", "value": "429b36d403c26b6482d98f6f1b0d95cf745bb5f5638e25aa0ee143618b761524", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542937, "uuid": "f9d228a0-f3a2-41c7-af49-114907b47f6a", "comment": "Malware payload", "value": "5f36f3527b855dd06dbe873b4c3676d753c007a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542937, "uuid": "d57c9075-f8b5-4cba-a7f0-c5c89216f0eb", "comment": "Malware payload", "value": "373016dff138a5e31b01932d16e03948bf263091905cbd414175d8b82ad46a766035041c9fafdda5ff500b514692188f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542937, "uuid": "dfd4bc11-55a3-4c92-9480-9d7c82c41a07", "value": "3F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542937, "uuid": "26b33e35-a769-43de-af80-510eee87b649", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542937, "uuid": "4d454668-1835-483e-b607-84412c6315c0", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542937, "uuid": "5d66b26f-64bc-45f2-bdd8-30b4f01af256", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542937, "uuid": "90ec47a0-aca5-443e-982c-1c7b9a928da0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542937, "uuid": "77215310-6c29-4343-8b77-138a2aaf34fe", "value": "3051cbcc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24d1000-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "c3d88c55-22e2-4122-9f1a-2e59086c6a54", "comment": "Malware payload", "value": "beb53f4fd64884d282056042a7d44ded", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "333cc35a-f8d6-4fb3-acb1-04de312d233b", "comment": "Malware payload", "value": "429c4d6cc362615278458db798378b095fc5d29f045eb7c9164a94e1b8e8ed15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "c7a29ec9-9680-48c3-888b-28f6db0ba134", "comment": "Malware payload", "value": "fc7f0fd5eeff6bff9f0761e87ee93bf8cf729437", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "45fc34a6-aceb-4587-9ac5-7498cb067d33", "comment": "Malware payload", "value": "6fb7a52950779f15feaa1c0819e7d92da54c7e1704a48578e2743c5e0dd9bf0e6b69ab079120610cca96231e12ad55d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "a80006a9-2294-4d6b-9194-a1b9247a2e9c", "value": "9804B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "518cf519-faba-4555-af95-d6b32e5bcd85", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "6a761b41-0f5c-4935-926b-42d42344a5a7", "value": "3072:iWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:iWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539399, "uuid": "261212d9-d502-4110-bd02-bca60ea9d6c7", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539399, "uuid": "fcfc6439-4c63-4677-9993-83b343423612", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "7fe36a05-757c-4dd0-a1df-6f3d6784f942", "value": "beb53f4f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65913cc0-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536693, "uuid": "6a9c9926-d762-4337-81e2-80d2f28205a0", "comment": "Malware payload (Dridex)", "value": "822a7715ab6b06c50dc38053fc37bd6c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536693, "uuid": "47bd37a1-9573-4953-ac27-c16ff7afdb65", "comment": "Malware payload (Dridex)", "value": "42b637f7039810bd3c9d0b007ecfc6e08f4debb83252d284edaf5f83db457e85", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536693, "uuid": "a2aaa1f7-7f00-476f-881d-e2320559023d", "comment": "Malware payload (Dridex)", "value": "fc5b5fd540ca39b037539ef86f04f70ef7014202", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536693, "uuid": "cabaacbd-fe0a-43fb-8678-54ec41e6a623", "comment": "Malware payload (Dridex)", "value": "08fde6cec6589025be0141754456d82044ed5d9d3c1eaa8d9ef7ec78d7f964ddabdb45f3167f929102b5806cccb7a346", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536693, "uuid": "38cdc4a4-f2ad-4def-8b6d-8575079c1e0a", "value": "7D04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536693, "uuid": "bae80419-7816-4a8c-bae9-1a9055cca494", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536693, "uuid": "503711bb-6826-49d3-8612-13c0e149780f", "value": "3072:Xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:XH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536693, "uuid": "c816a3b7-2e0a-4be8-8031-1b402067685a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536693, "uuid": "f7e70eea-820d-4848-bb0d-a4ddd2398b60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536693, "uuid": "5ae68b97-5bf1-4bfa-971c-8a6b6a1ed129", "value": "822a7715_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de04c85-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545619, "uuid": "e9f5ee96-b9c5-4ab4-a234-9494ece7138d", "comment": "Malware payload", "value": "0028c38171f6d3f67f52a3255b5880a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545619, "uuid": "03f8fdaf-a8fb-446f-a342-765ceae289e4", "comment": "Malware payload", "value": "42c6ee83a1934cc745f93ebfa81dfbf425492f7d1ec7144bf9d506acce742ef6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545619, "uuid": "b89fd4b0-3529-4c60-8de8-ce98a1b5f8ad", "comment": "Malware payload", "value": "94805bb16a10dce74439565e3af02f8bdba5a757", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545619, "uuid": "979c0628-8589-4b24-a0e5-0a157f8e36ed", "comment": "Malware payload", "value": "bf97daf0c54d09b75ab9c2cfa0577f603b2de2471eb6a7d0ad923a4d498a0bd8a93c44fc90631fd319beee5d6f9f5dd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545619, "uuid": "3faa0c03-3f23-458d-96f6-77dcd45b1d12", "value": "FF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545619, "uuid": "b596d63d-312d-47bc-8945-d98289d23ef4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545619, "uuid": "23dd5c1f-391c-4f8c-9a43-b615f628e3be", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545619, "uuid": "a27afb90-8dcb-4c54-a49c-3efa50741d79", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545619, "uuid": "1d058889-b24f-46d3-8ff0-aa65a44063b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545619, "uuid": "05eb198f-6107-49e7-8a33-a5a05c98f049", "value": "0028c381_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414292e2-b978-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621521170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521170, "uuid": "fd103079-cd88-42fb-97c4-f3be24ca5257", "comment": "Malware payload (AgentTesla)", "value": "85653ed8a4f4c0a38b0225dbdbcf0d23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521170, "uuid": "4cd91f2f-6b29-462d-89c2-9cd980c59ec1", "comment": "Malware payload (AgentTesla)", "value": "42d7193872ca7aed0e166e36b58d27c502bc0e715d22c00d9c04699192e229db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521170, "uuid": "a885b951-1398-475a-b178-47af8ecdf36d", "comment": "Malware payload (AgentTesla)", "value": "11a9a75062ba23c7ad70a85de09d762caa899843", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521170, "uuid": "bc6737c9-8f90-443d-bc38-3dbc8ca0a186", "comment": "Malware payload (AgentTesla)", "value": "578962433dc80b231ef0be0eb1e1eb64f36bb02bf6731f3c471cd011a53be8d71564a5d0b7a745423255509a04de5c5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521170, "uuid": "ff36f992-54bf-400e-a292-d091dc9b155b", "value": "2635E5EFBD5C749ECCF28831F9E41EA4A9157C7642078303707F3A99AA2D55E8F540A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521170, "uuid": "f6d79143-11fd-49a5-a4f4-734cf25ffd45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521170, "uuid": "a6244f41-ac7a-4a64-8b86-d78c99e3729f", "value": "12288:q9rmnt6fGllF7Tiz5CAUOgCzPAke6LKN7FhGabClpipL/e5GWI3HnED+gtZ7QLAX:q9rYt6fGDRiv8kei47FUabU+gD+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621521170, "uuid": "5fcaed6a-5494-49b9-8fc5-52600102caaf", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621521170, "uuid": "011aa0d0-4983-4b3f-88a5-3c64fac2325c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521170, "uuid": "c67fad93-d2c4-4ceb-a7ab-68b91f2e2749", "value": "85653ed8a4f4c0a38b0225dbdbcf0d23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c77d76-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527838, "uuid": "28e223a5-173b-46a3-86b1-f429a049b763", "comment": "Malware payload (Dridex)", "value": "c35b947a5d12199cf61d1fc3575e36b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527838, "uuid": "4fce82ee-dd01-4ab8-82a0-2c2283a1ba1a", "comment": "Malware payload (Dridex)", "value": "42db9d6345f0373daac63cea88855f3d3584b28e7788a7a0b8d2717b016bfa11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527838, "uuid": "a896857b-311d-428b-8bcb-fa13d9637403", "comment": "Malware payload (Dridex)", "value": "d48ac86c40d75757d2c34d4d48c4f5ff4183f6b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527838, "uuid": "9ebab1ba-77ea-497c-aa5d-d1eedc8beaaf", "comment": "Malware payload (Dridex)", "value": "686a5468a693d4c4226248f86340d10b591063d17a12c3217909ad5ff772df55c476c23b31ebba71df01405bb47f7f00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527838, "uuid": "94fa3ee1-1d17-4c19-b854-37b32e67fb36", "value": "2904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527838, "uuid": "8bccde83-160a-401a-8085-3514f2ef6c10", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527838, "uuid": "65d01c3c-d00d-44d0-8c41-5b5c86ddeac6", "value": "3072:Ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:JH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527838, "uuid": "0b450199-11d2-4037-b33b-4b3e0a4412c7", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527838, "uuid": "39ad5ad5-bbb1-4cbb-9362-fc2748fc8318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527838, "uuid": "fbaf72f0-d37b-4c7a-8d03-de0d31374350", "value": "c35b947a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd1c054-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "95ed8d74-108b-4b59-8c56-6deb6e0cd231", "comment": "Malware payload", "value": "b8f16212562811ed073aa4b98b6f2a2a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "08dc119f-3799-4713-a63a-80dd8015f27c", "comment": "Malware payload", "value": "42fa707803cc6a656688bee3f68512982c4febe4fbda1147f62689944f506110", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "fcf0ad1e-0aa9-44e5-9941-9ba509492f41", "comment": "Malware payload", "value": "715095f1acde5f8764c89748005688e196aab8bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542186, "uuid": "6aba126d-9289-47ac-b00d-ec5e347ecfc5", "comment": "Malware payload", "value": "583e3f411cb34bc52b29b60dd04a63c7f4a1180eb23b0950de81b8eafb4c4d191d449c4beaf0482dc9413d5625610d79", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "eedeba41-9450-491e-9346-98de639432c3", "value": "DB04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "d58562f0-de16-4355-aa3e-ceff5a9f68ce", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "ac80ec26-e84c-4fb4-8842-6f6530e53490", "value": "3072:dWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:dWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542186, "uuid": "ed287d31-0f50-49a1-8da2-1735a68bd836", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542186, "uuid": "96630686-217f-413a-860f-e9d42c4d8aa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542186, "uuid": "177b7ec7-9b62-4f96-9fbc-522a8bfec674", "value": "b8f16212_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0539faa9-b983-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525794, "uuid": "2cfd2b8c-2eaf-45c5-adf6-4ea446e151e5", "comment": "Malware payload (Dridex)", "value": "198f034632d6ca87bc0c48984cf95953", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525794, "uuid": "f0304e72-3404-464e-ba0b-526dadbb6f52", "comment": "Malware payload (Dridex)", "value": "43181831f9f3a55cdcaa2d33e4f5342339c10cb3b9947a5a14ddfd9601653afa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525794, "uuid": "1a38a8fc-8f52-4960-a8e6-4a849a206431", "comment": "Malware payload (Dridex)", "value": "35466139058616a618ddaa5c9437914ed2d30d6f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525794, "uuid": "10e367bd-6ee4-4694-aba9-541620b18097", "comment": "Malware payload (Dridex)", "value": "1f8037fa4faf8088876bd65aa295c508e4c02a456333214ac5f41de9546bdf885d738241883e4ec52a502c44863c6759", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525794, "uuid": "c9947c18-65cf-40f3-be2c-093656fecb77", "value": "0404B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525794, "uuid": "75bfa090-919a-459e-87c7-fe171f71116c", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525794, "uuid": "a63a5840-b759-4a43-ad0d-9d35b3128acb", "value": "3072:/WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:/WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525794, "uuid": "9291fc1d-22f1-4245-a1c3-716b4f392cc8", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525794, "uuid": "3fde7326-8e5a-4baa-9984-4cc18705a413", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525794, "uuid": "22a55c61-b183-4959-bd78-426e04b34f71", "value": "198f0346_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8121f0df-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535451, "uuid": "f935cacd-dd16-4ba0-b870-836416b9fe00", "comment": "Malware payload (Dridex)", "value": "7e65c7fe1cfda50270e0b07fd1f2c6b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535451, "uuid": "ad6568c5-125f-44e9-946a-098f6f8267db", "comment": "Malware payload (Dridex)", "value": "4318a3e82deac5cd4d1bb7074fc24718920ff75442c27db11aa41301ecc5fc98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535451, "uuid": "62753c48-9da2-4330-873e-3ba6ad0fff8f", "comment": "Malware payload (Dridex)", "value": "a52278ac2e928299fda5d563577bc98a4ce42bb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535451, "uuid": "6d642ef2-c9cc-4105-9b4a-36c0fe111dc6", "comment": "Malware payload (Dridex)", "value": "d2f310d807189910dec9772aad591e2817e9189c641139e91e2c87cc05737c305bd6985428194049b0c74faf59eab67c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535451, "uuid": "1d4185d8-2ecb-4f52-b2c7-7eec1ddffb39", "value": "8604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535451, "uuid": "8e5f0e8d-77ba-4f79-ab68-b008a0422e93", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535451, "uuid": "21b3c67c-75e9-45d5-b4f6-9b1bb2462334", "value": "3072:Qi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:QH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535451, "uuid": "7dd2bc5e-6c10-4722-9b39-f244fa15734d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535451, "uuid": "bd62cacd-80b4-4e53-af0f-b065d3bed9ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535451, "uuid": "4104e9bb-e872-4a83-88dc-4b7e2aea3535", "value": "7e65c7fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd42564a-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539954, "uuid": "98d0f25b-6eaa-4f89-8267-ce3c11abb169", "comment": "Malware payload", "value": "bb7731f6e4398c019ae2393de16809f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539954, "uuid": "a3383ac7-d966-4aec-b36f-83d4fb938a8b", "comment": "Malware payload", "value": "4341afcab5b0d0435c321b5ebcfbcb9e6269c33540a2e2e6599974e303616d30", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539954, "uuid": "309daecb-c832-4251-94c7-9146a86f5fa8", "comment": "Malware payload", "value": "4eef771c52672ced3c1565517b153a79c46f64df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539954, "uuid": "c1de5da8-093b-4003-856a-5112f25afe97", "comment": "Malware payload", "value": "4baba529abc3b37a72e971d8f6301d7f9b7c153e6c10915a10bf7a0faf4fc85bb74d0488c80180dbbfd35bea1583ef5a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539954, "uuid": "0f4c7f9c-f81a-46df-b6f9-9d0090b70f1a", "value": "CA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539954, "uuid": "e73b82f8-3656-4960-bce1-9dd6431b8c33", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539954, "uuid": "2e57aacc-ae61-4aee-84fc-651f05e00346", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539954, "uuid": "ac724852-eda4-484e-a4b7-6d238f27cd91", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539954, "uuid": "d0fcec62-e358-4ab7-85cd-f79466aff05b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539954, "uuid": "e99edab9-9b07-4078-aae3-dfb6128a39fb", "value": "bb7731f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30709c53-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532738, "uuid": "f716c588-ee13-48b0-9764-86509f809674", "comment": "Malware payload (Dridex)", "value": "e40c91c70bb5ad85cdf263762d344ae4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532738, "uuid": "13fb9e95-8f44-4f33-994b-4333a5f8e437", "comment": "Malware payload (Dridex)", "value": "437eca644fa516927dde437977e60824c0ce6f01a002d86319776da9ba0f0dac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532738, "uuid": "e830fcf5-7eca-4ec1-ab28-5588aa075155", "comment": "Malware payload (Dridex)", "value": "7eaba9e774364c1c24f109b06d7fd9f6aacd30b8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532738, "uuid": "0018ec23-8e99-42b7-a0e8-4d0cd59ef1b7", "comment": "Malware payload (Dridex)", "value": "7b0a60891fe18eec6e68e68c098a2d2b84ddb6c1549817e10ada57a0b2f2c066033ebfa6ed97336dea1a171f0fc20b50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532738, "uuid": "ee1bf704-4b1f-4c51-b89f-4a046d08b257", "value": "DD04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532738, "uuid": "4cf59f7e-6022-4867-8b4f-4d21af220b16", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532738, "uuid": "e79ea916-8e90-412d-978e-69c2fa979ada", "value": "3072:pi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:pH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532738, "uuid": "493358b1-1123-4053-8f12-58033f369a6e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532738, "uuid": "9df76d96-6311-4e6a-a937-d59a382bd91d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532738, "uuid": "1eac6775-3aa9-4d5b-b022-3ed68a84b25c", "value": "e40c91c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47987c37-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621520322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520322, "uuid": "fd3ec3be-50c5-4cac-9c6f-4c55e66bd69f", "comment": "Malware payload (AgentTesla)", "value": "f421782c826203212a35308f4b155bad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520322, "uuid": "4d4ba49d-b852-4eba-a686-73d3aa530419", "comment": "Malware payload (AgentTesla)", "value": "4397a3ec9407ed8771df40a9688f8931e6919b88e27fdd574f0474560e068de0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520322, "uuid": "2a37f9f2-c246-4af3-8957-a80dbfd78669", "comment": "Malware payload (AgentTesla)", "value": "11ac733217f790d81b922db0e99fffe65c3cb9d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520322, "uuid": "79706738-fa9c-4780-8b6d-018df891081f", "comment": "Malware payload (AgentTesla)", "value": "eaf5adfb57c17c30c66bf0078a9c4c717a5049979ecc6f320f2b38979d13243ec95c5cfb93707b0d3d70905d28948563", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520322, "uuid": "a1787125-7c45-4828-ba53-261eb79e8193", "value": "26B41218A29CAF5AE57E5B7C10F5201003F5F900A6A3EB4EAFAC10BCBE67B554D52743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520322, "uuid": "64a3984b-5317-4298-a2f1-d53c5bcf2722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520322, "uuid": "373edb62-0384-4ec5-b5f0-e4937cb248ca", "value": "12288:iQKzVxRRMUZl0RbfuhN51l/+LsA6/tdK6FEcx/ZlUT01x:iZzXRma4fuBrfq6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520322, "uuid": "f702b17a-874f-42b9-800a-e7c6e25c77a9", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520322, "uuid": "3f08522c-a2c9-4613-b2f7-6ee5fafc291a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520322, "uuid": "20e4046b-56e2-49c6-89a6-c4e68e36af19", "value": "f421782c826203212a35308f4b155bad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21951c72-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544310, "uuid": "e3c3204b-9a4b-4b96-890c-731cc34cb879", "comment": "Malware payload", "value": "1e8d1c4ca5ac5a28e6c87a9908ace85e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544310, "uuid": "c5f1c8d7-9b1e-4c6e-babc-21ffeb4e1daf", "comment": "Malware payload", "value": "43c4b6c97f8354b59de1aec51976fbfad6f12326bc966dce599287c68fc4cfb3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544310, "uuid": "1276902b-592f-4249-802b-b822695dcbe5", "comment": "Malware payload", "value": "ee140aaeba002ba31292827e22759bfe5d03712c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544310, "uuid": "0906b040-43c7-4c80-90bd-261fa7152f80", "comment": "Malware payload", "value": "149284d25f2e3e111acbe9c10132d9a7687f14120f21beebc9442a195daa40b128ceb1722a4ea0e8d9f983672bf88116", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544310, "uuid": "8349dc9e-f46e-43b5-9d0b-a4690946f7da", "value": "6C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544310, "uuid": "79009f39-357b-40a5-afd7-04369c43ab02", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544310, "uuid": "0b1c8a0a-c94b-47b7-a9ef-22b17a882106", "value": "3072:1i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:1H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544310, "uuid": "309e8d0e-db06-40b2-a657-b1b69db81d64", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544310, "uuid": "039d2bca-2748-43bb-95bc-951269867e62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544310, "uuid": "e13a9ebd-a6f7-4335-8588-6a511ec12a49", "value": "1e8d1c4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2dd96f-b95b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621508787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508787, "uuid": "c951f9a7-590e-4ac1-9d81-02d730efb72c", "comment": "Malware payload (Dridex)", "value": "0a604bb8ba425610acad8593e3b431c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508787, "uuid": "768df03b-1bb9-4a5b-8549-b55d95feb3d1", "comment": "Malware payload (Dridex)", "value": "43dbcf6b94dda86323753eff93bbee866ed677a1c62d6c5e138097d3faad09c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508787, "uuid": "c715ca97-356f-44be-8b56-bde115b73c8e", "comment": "Malware payload (Dridex)", "value": "a96020c7d27efcd37465b2f8b087c8900a76e7e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508787, "uuid": "6c3ce891-46cf-4bdb-9775-ec8180de1681", "comment": "Malware payload (Dridex)", "value": "f92e823b9c474a8bbd0f49f1748f8d0efaf7f43d9e7bce2f5fa959aaf944fb9af0be5cbb0a8690800723bfb304c36959", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508787, "uuid": "25c51dfe-f318-4809-b6bc-401f15ab9cd1", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508787, "uuid": "cbd8e12a-a9fc-4d24-891f-43a0a4e1b87d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508787, "uuid": "ef76be05-c8f6-4261-97e7-1407d462c83d", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621508787, "uuid": "e318acff-af9e-4f82-a7d2-51e292631b73", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621508787, "uuid": "273783e0-1bc1-4415-9d65-2a8b8a54f06f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508787, "uuid": "131b38f1-d6f1-4c47-bbdc-d5bfc1f83905", "value": "0a604bb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7ae968-b9c1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552732, "uuid": "84529937-71c2-4a03-a9a7-54a8e04eb389", "comment": "Malware payload", "value": "1f348b390a33ff1bc014fc823b53bcde", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552732, "uuid": "23fa21ba-4d21-4e4f-9ace-c789b15f6354", "comment": "Malware payload", "value": "43ec8637112406a2968a1f18c9639c6d86d796b4362f9e4512b3cac33d79ef82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552732, "uuid": "f3ed2596-b8ef-4a47-afa8-6d3293e8c5de", "comment": "Malware payload", "value": "50e4007cd4833156fb67a711ea2f2e1160ebf0c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552732, "uuid": "6502b67d-89fc-46d4-8ec7-c2b679a66205", "comment": "Malware payload", "value": "4e1c31ae82d27d558b53275848fa3d8452db90cef5449f1267afe002415330c6a9bc78ee47d3b708fbd4489815dbb2d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552732, "uuid": "82433afc-229f-4a15-a244-960a52c6fa38", "value": "0504B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552732, "uuid": "c77eb14d-8d0b-44ea-a13c-11f1faacbd3b", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552732, "uuid": "cc100e2a-329c-4fb6-9bde-cbc80c5dad38", "value": "3072:tWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:tWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552732, "uuid": "84b92861-0790-4dcf-a10e-364d852cef6d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552732, "uuid": "ed8b37a5-2778-4e40-869c-da5d6dc58f6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552732, "uuid": "0deaa9e4-83db-4e85-aa2a-99ba998a0ca6", "value": "1f348b39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af13436-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621532810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532810, "uuid": "5be727d1-1aef-4fb1-8a11-14c1a454a58f", "comment": "Malware payload (Formbook)", "value": "b500c7c5801672dccc2dfae4b0e16c0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532810, "uuid": "c260622a-d0c8-44ad-9233-36d32978d6bb", "comment": "Malware payload (Formbook)", "value": "4427dbd6209079235487c24f4843a10d582fe6264fae0d107091e81133a8960c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532810, "uuid": "ffa38744-960f-4299-a038-312636e91025", "comment": "Malware payload (Formbook)", "value": "4ce3b3d7688e14d4ca9451b77d223982b90cc80d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532810, "uuid": "337d03a3-f133-4e6d-8435-6717d985a175", "comment": "Malware payload (Formbook)", "value": "a6d8ac83c173adbfd6bdc03f88e91d0d954b9ff3f51fd31f4f461ad2a07b8d829edf8b9db94492f3a2907623dd5df75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532810, "uuid": "9280ba8d-91b1-47aa-b13a-d0b44f5fbacb", "value": "4535233126C8E7A9E83F7779B824B05903F85112EB21F71D7C9E516E0952B4B83F9623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532810, "uuid": "27db6aed-b0a7-417b-bf86-50690fef9649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532810, "uuid": "ee9abaf3-e739-457d-bfca-ede4a9a20195", "value": "24576:FVzFy9p8WhXf/fFofLxEjr80832rbG1gfOg9d/F/9ra2V:rzcPFfnuT2jdc2HwGd/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532810, "uuid": "b6760950-715a-41ac-8c54-a1a6b7113852", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532810, "uuid": "5f9f5a7c-6a17-49ba-9509-f0b474c71832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532810, "uuid": "7027508f-5fd9-4b41-8dd4-58e3beb38055", "value": "orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf48a4b2-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539447, "uuid": "546d9c61-331b-426d-bdf8-c8e6bb76c553", "comment": "Malware payload", "value": "23038488e35c3277fe98456901ae59a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539447, "uuid": "200dbe3e-767c-4165-a281-a7b50f3a4d29", "comment": "Malware payload", "value": "442e814a7d6cd6189f7a6c45fa9fe9c75187bc1103d945016731239901d5cd4a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539447, "uuid": "7763f699-d4b1-47d0-938b-bc9fe89d3516", "comment": "Malware payload", "value": "307979d4336b36412e8c34176ebf927b151099cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539447, "uuid": "28c64d5b-c22a-4c83-8ef7-a1979234220d", "comment": "Malware payload", "value": "fb29ba79409ebb57a735945a14b3f82c3ab92054774bff4c3578eee2d5c637d02351843956f432709348944ac8bcfa90", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539447, "uuid": "eb35cb30-9307-4189-9ade-981284466f2a", "value": "D704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD28ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539447, "uuid": "c95c4cb3-7dc5-4578-93f7-ba610866aa9d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539447, "uuid": "e494f571-74d7-43d2-b1ff-561b974b33af", "value": "3072:Yi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:YH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539447, "uuid": "47145460-5abe-4bf7-ada3-82a42d4ee458", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539447, "uuid": "87d3f80f-45f0-49dc-851f-07c4b4fe237e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539447, "uuid": "9cb67ba4-649d-40f5-befe-f15034d4b142", "value": "23038488_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7268f451-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468854, "uuid": "177de880-a7b5-470b-8b78-b0e83af2e9ae", "comment": "Malware payload (Dridex)", "value": "7d4295369a3c1beef944cfccef6e4f06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468854, "uuid": "5de930f1-e630-471c-903f-7c1dd9b29a75", "comment": "Malware payload (Dridex)", "value": "4472c6d9ba5a58a356a5481900c1b0501a35cddad1c3151da58bb1dd4293a497", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468854, "uuid": "3e8444e2-0160-4ca9-9517-a2bfb81f2e70", "comment": "Malware payload (Dridex)", "value": "c1629ec191e1ee3fa1129204a1a2738884776695", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468854, "uuid": "4114f4f5-0340-476d-b236-9ee3c04741a1", "comment": "Malware payload (Dridex)", "value": "06d2cff2d115f3be1cff7a300115ab98fea03cb0096b51caaa3b37110c277de8fb73873ae529b49175b27666173cc5da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468854, "uuid": "b663946c-6afb-47e4-8008-af4af86123cb", "value": "5FF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468854, "uuid": "a3c7857f-12ae-4e78-b8e5-f4457fca86f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468854, "uuid": "73acecfa-ad65-4747-acd0-2e6b99cca2c1", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468854, "uuid": "bd89cbbc-f867-46b8-b2ae-9d2c80d3dde9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468854, "uuid": "df653770-9144-418b-b2bd-e941e78d5bf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468854, "uuid": "35014a80-8fe9-4fbd-8370-1e16f713172e", "value": "7d429536_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74983680-b98f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531135, "uuid": "8e7fe468-cd4a-42c0-ba01-da007dc56a7e", "comment": "Malware payload (Dridex)", "value": "4e4a2d4c13814a2ef55f8d3f30c760de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531135, "uuid": "5ce6a71f-0be6-4a0b-be0b-484d11822a46", "comment": "Malware payload (Dridex)", "value": "448d61b648fc9e334458565a9e605d5e322b2ca5a4d253337ae1bd6cb6b08697", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531135, "uuid": "3b6b2d65-e546-4f97-9a21-47d3ed2a8869", "comment": "Malware payload (Dridex)", "value": "368917a251a3a97950f25403000832bd83671c5f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531135, "uuid": "2d57db67-7741-465f-87dc-918f497bf4b9", "comment": "Malware payload (Dridex)", "value": "1642c182d2e99896495631d85ffb5d6225702e4415d60e806a9f34db33f1f0ddcd54b7801655e05bf77c5f02f97bc5cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531135, "uuid": "3ba55c1d-5f75-4ad8-8a96-333f2b387b77", "value": "5804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531135, "uuid": "2b8491bb-30bb-410a-bc19-9cbbe032ea56", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531135, "uuid": "31ceeeb2-8205-425b-be3f-eb5aac0913fa", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531135, "uuid": "c3af47e6-274d-4575-9b11-f2d695fd3f70", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531135, "uuid": "ede694ae-6b06-4cb2-810b-f57dcbad7c55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531135, "uuid": "72fe3d76-0e48-435d-ac0f-a03d80a49031", "value": "4e4a2d4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7e7e85-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527581, "uuid": "8b880895-5c91-4c61-aa36-624e5b2b1bcb", "comment": "Malware payload (Dridex)", "value": "20fa48fbf11ea82d6a465afee1387931", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527581, "uuid": "8252c484-515c-4ad5-98ab-fefb78508f80", "comment": "Malware payload (Dridex)", "value": "44bcaedf78d5952da2798041e694ffdc38a6b47aedfb31853db4f59b40adc68c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527581, "uuid": "563d7159-991d-4633-8dfb-b9280823e82c", "comment": "Malware payload (Dridex)", "value": "a25d6eb3f196a4c391cc934992e1dd1aebcf2067", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527581, "uuid": "2959476e-d83f-4ddd-8a0d-f45606fdba17", "comment": "Malware payload (Dridex)", "value": "8e5699883ab6d337909bc2c48e7fa9654a5118cc3a8069abe70daf00cdb43a724ebfdfa592c8e3f49c26486c41962fe1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527581, "uuid": "bcdf9d80-3853-475c-a632-d498501676a6", "value": "9D04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527581, "uuid": "efaca80c-8d08-4b43-8d1b-ff910f96707f", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527581, "uuid": "eb7fab05-34f1-47c9-99f0-3e9540d662e3", "value": "3072:0WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:0WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527581, "uuid": "2f19331d-bf77-44e7-99e8-10680ddab405", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527581, "uuid": "8f382ef5-3b99-4c9c-9c5c-71bb4cabbd7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527581, "uuid": "d624e587-0002-440c-b36f-caa169987fc6", "value": "20fa48fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fe8983-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528431, "uuid": "139572f9-4328-41e5-a769-a9a619166e48", "comment": "Malware payload (Dridex)", "value": "a39b16059dd166c9e64ac0ce96905d90", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528431, "uuid": "0176b55e-1b9a-4e97-a95f-1579ad676fe0", "comment": "Malware payload (Dridex)", "value": "44c9c81620ca490f4beba3739a9c98a594f96473e8af173333afb5e4c2567aa2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528431, "uuid": "76a565c9-a8fc-4a5e-b172-416e7d464c6b", "comment": "Malware payload (Dridex)", "value": "97688edda75b4ef279db9632415dcfcdcce1ce1c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528431, "uuid": "0007ab39-c89c-438c-b972-6a40167d7736", "comment": "Malware payload (Dridex)", "value": "a79ce08a83cb28b747fec0a3ef8c42bf9ff3d667e6da9ce9e555fac3bca432879037c6addb29b0f323061fe0c6f491e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528431, "uuid": "1e3329b2-5b6b-4aff-8fbf-26b25405ab88", "value": "4004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528431, "uuid": "a6265381-7300-47b1-af86-114790d3855c", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528431, "uuid": "e90514b8-3f0c-43e5-823d-2a255a3d93ab", "value": "3072:gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:gH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528431, "uuid": "04a726e9-e3dc-409d-b66b-7fd11b134322", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528431, "uuid": "751e52aa-83fb-4b53-944e-893a4d126439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528431, "uuid": "dfca5646-ddb0-41d9-9ef1-085085aa2864", "value": "a39b1605_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918a73f9-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537626, "uuid": "ccfd3b29-b6f9-4dc7-9cdf-5050e55f5182", "comment": "Malware payload (Dridex)", "value": "beea4568dda0a565989a0f4a78012c5b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537626, "uuid": "85808b20-7063-40b7-8a72-a886bd28506e", "comment": "Malware payload (Dridex)", "value": "4536cb38adcaaeaf63384f0e842973f2e2f29202be19d4dcffa4d96473de8b9e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537626, "uuid": "d63c4567-a86e-4134-8995-adeb3f6bf203", "comment": "Malware payload (Dridex)", "value": "a09218f4688661588160aa376fafa6b983032059", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537626, "uuid": "23f75df9-9666-48f7-a45c-d8e913d440b9", "comment": "Malware payload (Dridex)", "value": "22fd3106f0ca51f3da7bc8e01c52d7d2cdab4b717a25397d7fbdad1d7b1b887b1f3a25b6696c4b90cd85d78cd409c62e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537626, "uuid": "992a1649-452f-4f87-9ec4-d556e7f83406", "value": "7C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537626, "uuid": "6bb66d48-11c8-4ee1-8638-62e969dd1e4f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537626, "uuid": "ce25df6b-ffdb-4b14-8b4e-ae5770b19bb0", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537626, "uuid": "d2c12769-865e-4b64-b0ef-b5598a88dcf2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537626, "uuid": "6009b5d5-bc85-4074-aabb-ee27b2cedfcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537626, "uuid": "9efe3993-3571-48e4-91bb-8d9c63804354", "value": "beea4568_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23061f0d-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546030, "uuid": "fa56f1b6-35e3-4cbe-b4da-d7d0d732cdf6", "comment": "Malware payload", "value": "500aa3721c1762af1ec672a59bb1c72d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546030, "uuid": "b4c46a57-8aca-43c2-8d0e-1f70e58f8357", "comment": "Malware payload", "value": "455b537b8082a80d57f2a323aed49a6680e48276fde6471606575c72e6caee0c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546030, "uuid": "963413ef-e1e0-4fe6-b4ea-e72a2df8ff62", "comment": "Malware payload", "value": "033015cd7ede18204147a4067ad24aac86d8bfbc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546030, "uuid": "b1adea3b-ad71-426e-8cfe-57a2926f822d", "comment": "Malware payload", "value": "3868139cde6f57b204862ae2729076a3a6fd551dc9a8cf6eefdc33e18c44613a7e2dc3caf42471cfdaede42b41bb039b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546030, "uuid": "65b572b8-4b2f-4d20-a30c-22d14a2d30c4", "value": "3004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546030, "uuid": "46234d98-bafb-4e58-a74b-c35bd7a57194", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546030, "uuid": "768c3b55-81c5-4c3f-9fe8-ae1b86170d2c", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546030, "uuid": "d9197c75-2305-4e2a-a2ac-0c4fcaab857d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546030, "uuid": "8aa1e715-4d8d-497d-bd8c-94914b356eee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546030, "uuid": "5e76cb57-c9a4-492c-910d-18f1420340f6", "value": "500aa372_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e1a8f3-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "cb737fec-043c-4e2f-ad15-d4695596ecb1", "comment": "Malware payload", "value": "7221741d5ef6395ac7e4265d0533565d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "1294a098-d46d-4aff-8672-653e57c5f8f7", "comment": "Malware payload", "value": "4570f75fee957ce80f0a6a445a3fbe42daf7ef558174cdb449f9a2b42c8c9a0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "837fedb5-e19b-4206-880c-0306ca9532a0", "comment": "Malware payload", "value": "104044608e90ed122f9e39bf0f42e9026a5c6683", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "5dfa90eb-7f91-4363-8778-2c67554a68c4", "comment": "Malware payload", "value": "5419c021f490b68310e2e108e1bd151be6431f9fd4a5fdefe7687b8e6677a1096d013df9690a90a65da34f4d8215d1f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "cab48a90-2bab-41bd-8ffd-01d0001a0ba1", "value": "6704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "f9db629a-312a-4e63-b69d-3e327f8acf14", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "5e5e4752-ea91-41b8-9ce4-c654c204d0a1", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544685, "uuid": "db90df16-afc2-406d-999d-6d53358eac7f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544685, "uuid": "e67198cc-cf75-406c-8a7c-7e25fb188ddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "cf48b0c2-b935-4dd7-890e-46e4db2292c0", "value": "7221741d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed93662a-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539928, "uuid": "1156fc46-41fc-4622-8c8c-525da384df56", "comment": "Malware payload", "value": "7ab10c2ac182493bc7a8eb65b7aadf71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539928, "uuid": "b01ad7b0-5629-4b27-9542-0405b8aed71a", "comment": "Malware payload", "value": "45919c0eb88d19d4d36cabdd889ccbb967ccf5efc8916fda5ba46b19e4110c5e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539928, "uuid": "409cb2f9-30e6-4712-b1e5-f8e06b94939f", "comment": "Malware payload", "value": "3727329bce1942535ecc7f35a3da0023d11e9ce2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539928, "uuid": "f88f6a38-94d3-4565-a35c-b4fdd8fa51e1", "comment": "Malware payload", "value": "52384913ea36de6137542d30dc639973057a68ec36341a8a634cb2e71b844364c5e7df2d14a27568b02bf531a775336d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539928, "uuid": "be0ac656-9c8b-4335-b8e1-59b68a76d200", "value": "E104B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539928, "uuid": "514dc7d3-a49c-4103-9547-31a53543087f", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539928, "uuid": "e2b7b7fd-a132-491c-a215-02a8b89b2063", "value": "3072:UWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:UWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539928, "uuid": "8fabcddf-7882-4d44-8f04-d19bdd46fdca", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539928, "uuid": "07707d03-162c-4510-bcc2-04380df4ac14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539928, "uuid": "02aa0da6-ea0b-49e5-95f3-e61b8a650a6b", "value": "7ab10c2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea40a617-b9bf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621551948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551948, "uuid": "4adc4548-9976-4290-a31b-cf39ddf91b03", "comment": "Malware payload", "value": "a3a77c921a7d718591c3730293450465", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551948, "uuid": "41a97bc0-e591-4b2b-987f-c99bd7d20fc3", "comment": "Malware payload", "value": "45dc0c1eb8a4e3e1e07c0801a569e4c01f88f2ffb8461e7ed419688db65a66d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551948, "uuid": "d7362389-bf36-4694-a0e7-3d09102d5d65", "comment": "Malware payload", "value": "7c56cceb7ed942e5aa46bb45333b5cbc7bd529b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551948, "uuid": "c8282788-91a6-4868-a787-edd6cf7aec14", "comment": "Malware payload", "value": "5d5eac074fbf3c16d37ea1384f7cbc4d7f363fc2779b34154e147e1b9d53d488d644252f7753f9ce4e300415113d9e84", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551948, "uuid": "544731a9-1f37-4944-9494-030f43ff47be", "value": "F304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551948, "uuid": "e1ef7c46-a781-4c48-8cbd-a57c69b7cff7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551948, "uuid": "d449ce76-5f14-4d00-bcf1-1c0ca27aa206", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621551948, "uuid": "8f7732c6-3cfc-47e9-98d1-c8576f265f13", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621551948, "uuid": "b4400da5-9bc7-4eb3-96ae-55208d5a1bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551948, "uuid": "356b61f9-46cd-4540-abb2-9dede8468cfd", "value": "a3a77c92_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf83bf5-b968-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621514370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514370, "uuid": "768a2ffe-99f9-4853-bc1d-098b99672fbf", "comment": "Malware payload (Formbook)", "value": "6c4c617235a55f368eb2b8f30bde5348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514370, "uuid": "2134b09c-7094-43ae-a1b2-04a7ad2d83e5", "comment": "Malware payload (Formbook)", "value": "4634683041f3a17fd3e66e086f2730d0f130bcbb0cd55594a697f140a43f87be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514370, "uuid": "b9de95d7-ef9f-4d37-8add-479452dc120b", "comment": "Malware payload (Formbook)", "value": "6c32ba5cbe881b48b7b2d7d4292d4b1986fc0c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621514370, "uuid": "856c7e41-a560-4820-97af-38dc7120d5b7", "comment": "Malware payload (Formbook)", "value": "06dd806ba50c057cbb87d78950895a85ee7fc90b6ce75b71f135ab6f0ec08da088aa42e00b4e85fcc96b853dd45dc7b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514370, "uuid": "7aee1470-c70e-4025-b0a2-3683e89a126e", "value": "702548E599430437D23E1938385692997826AF102A6B7DB67AB83D084FF46D13C3B1DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514370, "uuid": "f4408c39-83c2-4666-b2a4-ea72590e32ab", "value": "f1f303542c50f6c0da1211eb61b35269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514370, "uuid": "fc6e71d4-f524-490a-8914-32f44dfb9c43", "value": "24576:9TgC9qG4RR6IoNcOySxfzyk+1fIlW+S6:iC3Wug6g+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621514370, "uuid": "5afeeef8-3ac7-44c0-9936-0358a7b2769c", "value": 972792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621514370, "uuid": "73edd4d5-110c-4a6b-8a6e-5bd088806834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621514370, "uuid": "ab2ce546-c0d6-44e0-8a33-33c08f4a9f46", "value": "Glgcjrikwubeurawzvfntcaqnlnuvkpnql_Signed_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d0d069-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546203, "uuid": "9ab21cdb-d678-4aef-b290-a007bb0574cf", "comment": "Malware payload", "value": "8c1c7aa5e4e30633e973b7688947cf75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546203, "uuid": "cf01d1e2-1786-49e1-87c0-5035689a47c1", "comment": "Malware payload", "value": "465ed2f8420908ad8fa8547f4f648e78c9f72560f425e51ef04201137afc61b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546203, "uuid": "88c8a9c1-de81-4edc-a131-91218d06b7ff", "comment": "Malware payload", "value": "c32d1c0581b7227a53f43209506bd988e03bdc38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546203, "uuid": "7798f7a3-45b0-4141-b7db-8eed6fbd3421", "comment": "Malware payload", "value": "1db5f65a41ee84b160265e3745988fa02663ada74c6c961930d75861fc5c529583a862b2c01c11737c7c7d060cd1f3ee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546203, "uuid": "3a4007fc-ac6f-46e8-af5d-23cadca1a9a3", "value": "81F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546203, "uuid": "fdd215c5-da0b-4993-849b-e14051b7fdd6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546203, "uuid": "6a3decac-f8ff-4db8-9f31-2549735ce5b3", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546203, "uuid": "ca037969-8413-4361-8de3-944e024bb537", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546203, "uuid": "029575e7-27c6-4bd7-bbc6-befcbd051a37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546203, "uuid": "cf282578-603b-436f-8c4f-a67414ee1796", "value": "8c1c7aa5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f9333b-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479696, "uuid": "8d225655-7d71-49c5-87b1-50baf03c3bd8", "comment": "Malware payload (Dridex)", "value": "cc816396ffc3a0702364f3853987864e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479696, "uuid": "092ec114-e037-4c0d-8813-b3b5cae024bd", "comment": "Malware payload (Dridex)", "value": "46a3cb8ebb768b37f79c65231084d1546bdc3608f46eff1508f90a6f52b82f43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479696, "uuid": "e59b5069-d4e0-4459-a049-7abe88c9b578", "comment": "Malware payload (Dridex)", "value": "8a1ce1dbaf51daa55e494823335479b2f469d2c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479696, "uuid": "b1a42395-c158-42a1-953a-619cdd7ed5c0", "comment": "Malware payload (Dridex)", "value": "ba8d90d1900d58c2c0329408c481c1a8f1f32433a5f1dbf70ca9c6c22ed29e4202d5af1f237f70294d29f08fff9c55c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479696, "uuid": "dad16883-bcaf-45da-af1b-60b8205b38d3", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479696, "uuid": "22af0d85-c6f1-4a65-9dac-7140a7c02a10", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479696, "uuid": "0c36c705-b9ae-42b6-aff9-e1a10db44d39", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479696, "uuid": "764a9433-a729-4619-8133-f37486e8309d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479696, "uuid": "98d49f1e-ab15-4bf9-bed9-620f22b9e272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479696, "uuid": "e4b7549f-0cfd-4f19-9720-10e687dea079", "value": "cc816396_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5342ab-b964-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621512840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512840, "uuid": "b350ba19-cf63-424b-ae0e-91336e2f5b1b", "comment": "Malware payload (Dridex)", "value": "4ff27361426f5628434416bebdb86064", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512840, "uuid": "e33b6ac1-cf2d-4e98-98cc-1a07f07dd5a9", "comment": "Malware payload (Dridex)", "value": "46be3844094a7d1371b0695b4bb95b82df43c07585033f9c066a07daad2bf989", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512840, "uuid": "96ab793a-d33b-4667-ab93-d27bf7bc75d4", "comment": "Malware payload (Dridex)", "value": "df691750ca02482e2254f7c707ef0252f4e943f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512840, "uuid": "ab1b4862-bcee-4805-80eb-51dc29799a21", "comment": "Malware payload (Dridex)", "value": "cca15962b6affa83d243585ea7a87a4e65ee7f16b6f213b7931ae6499d61f6e6617e156d02a7855fc91776bf3666cb9d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512840, "uuid": "b1639dd5-b5ac-4a38-99b9-f879cc4b27df", "value": "F7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512840, "uuid": "2b610f4c-7c9a-426a-b908-940782f0fdaa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512840, "uuid": "9ff5a14e-dd97-472a-a7d7-5e00c6b087e5", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621512840, "uuid": "514fbbd9-6519-4d63-ae99-c016fba97ec3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621512840, "uuid": "9857fe85-f88f-411b-84c6-8d69be1b9688", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512840, "uuid": "36a23141-482c-4eb6-9176-a862ed1a4441", "value": "4ff27361_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef19818-b934-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621492202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492202, "uuid": "30aae275-f871-45ac-bb58-a7a9ad8db50a", "comment": "Malware payload (AgentTesla)", "value": "63cca7b824b315fe272b8b4768ccb44e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492202, "uuid": "1deb5309-7a43-4157-88b4-b4f29f0e0587", "comment": "Malware payload (AgentTesla)", "value": "46ce9bbd88955426cb51db89e2767e46b5a1718b1d90407c5845b648ee8dc7c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492202, "uuid": "cb58b8c2-9471-48b4-bc61-c4bcefda3abf", "comment": "Malware payload (AgentTesla)", "value": "d3b145b0c415488815b430f71ea82ba8f4289f05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492202, "uuid": "4fd5f824-0b2b-40d7-915d-3648e4d37986", "comment": "Malware payload (AgentTesla)", "value": "37952eb050c01ae2b1519c27fb5b370c685739b36aed206a7a9e7b89c0ba6bc6b43081ad19395322e42fcb0708308dfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492202, "uuid": "d92ac5f1-020f-4267-9666-99055b804e4b", "value": "631525EFAD6C7501CDF18EB0F4E452A50A6A7D315813934738BF7F8A767229C8B80562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492202, "uuid": "833f8216-acbc-4a9e-83b7-bd7dd991ac35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492202, "uuid": "46ffdfd8-20a0-471a-8493-3189ed2ce933", "value": "12288:dMzcUzEXB72kFekF0qzVlSC6nOW8whvMuzzgxEvc/pkPlnsS:OzF4XB72Cx0qpiOivZPgavcBcF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621492202, "uuid": "1d7a772f-fb7a-4dc2-840a-de3efcb87213", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621492202, "uuid": "0fb92ae9-ebe9-4974-908d-a26b518f17ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492202, "uuid": "75fb5001-f540-47b3-94e3-82a240c660e5", "value": "Hlengiwe Moepe 20-05-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a84571f-b9aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542741, "uuid": "e8fb6c11-dd82-4f9a-aee3-a5e24b40cbd4", "comment": "Malware payload", "value": "b297cf644d0517bccb7f9fd305bea4cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542741, "uuid": "a334efa3-6a8d-4852-8121-673841b78c36", "comment": "Malware payload", "value": "46d05e92ac89f6c81748c5b82d9a750c479f86b532c4718eec18e8e7c92876ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542741, "uuid": "1c5bee3a-d413-46f2-a332-44ace80478d8", "comment": "Malware payload", "value": "7a53084df8d33d922cb292f87248c7dd05e1396d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542741, "uuid": "d492159b-5e7c-4101-9025-92733fcc1c79", "comment": "Malware payload", "value": "cc4a85e7b5e0b0e718e1cb16624447571c110475a5c8cb83860b49d4088bc2ccabf55b28b5ab5797efc2674ec8d35b73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542741, "uuid": "0bc8af06-0788-46f4-a14a-078029b277e9", "value": "5604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542741, "uuid": "e4a0b12a-b41a-45dc-aebe-4c6be59d5bcd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542741, "uuid": "78e35a15-c036-403f-88f1-ae078378948c", "value": "3072:vV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:vV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542741, "uuid": "cbb2a381-e51a-43b1-a6a8-231305aee47a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542741, "uuid": "21928bfb-744f-4428-b14c-2b7ce1d2dc3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542741, "uuid": "bb852a97-93ba-4dea-a731-87dd53991216", "value": "b297cf64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb4f115-b935-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621492601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492601, "uuid": "ca09eccd-c550-4f06-9bf1-728977c2bea5", "comment": "Malware payload (Formbook)", "value": "a878fffaace2129a572eb10f2d141d82", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492601, "uuid": "d92fb06c-5638-40bf-9176-b69aaf3ec7f7", "comment": "Malware payload (Formbook)", "value": "46ea558f4c1d97c8e53d5f486e3c4a51c69c26ca59d3a8cffa9dcdc7551252d5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492601, "uuid": "125a00c7-a897-473b-a2ff-b3402bd39914", "comment": "Malware payload (Formbook)", "value": "b7b58a81492c7595334da342afd914d50c488dcd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621492601, "uuid": "3bfa939b-9827-4f84-8a50-3ab1e77298ac", "comment": "Malware payload (Formbook)", "value": "132dd241e4978453d0cada3eca26501f5843b3665fcbd0d195b8375cb5fbe14f17fa3c017ca8b4848168f1c95d27dfe8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492601, "uuid": "4e7e6157-e9f7-4e46-b55c-5a34a883497f", "value": "4C25383439EA502AB173EFA98BE479DADA6FB7733B07645D1050038A4723A81DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492601, "uuid": "3cc4cf60-108d-4849-85d3-b192416a84ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492601, "uuid": "3dd3db43-f411-443a-b2d6-340f47a20add", "value": "12288:qogBIEDn0JKRiYPD1Z+tbtfHeq8sLVc2jaxpwbSqyGusTojYMrP6AJnDFisZmQk8:38TPBMKTrSmdH0jKVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621492601, "uuid": "a25fe804-1671-4ada-b417-19eb95a98477", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621492601, "uuid": "f10aaa78-886c-40c2-9d95-0d87e15e5fdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621492601, "uuid": "49448586-22a2-4e57-bd32-402d25c351df", "value": "soa0009876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a03b55-b981-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525014, "uuid": "5d09826d-ddea-4dfd-bb5c-2e0dd6dc8bfc", "comment": "Malware payload (Dridex)", "value": "2ea6653b7f2adf4f58820b74ca89e9c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525014, "uuid": "a0fad109-66ca-41de-b8b2-8b5ed87afca4", "comment": "Malware payload (Dridex)", "value": "46f822d018b4ddf4f0d62415e52396902b0eb10be37d15a2d431075765fcb7e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525014, "uuid": "2da5db50-bd89-4dea-9b24-bd2b72347bc4", "comment": "Malware payload (Dridex)", "value": "ec9b64c07411659ff5e077bb8c76ba0c70591099", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525014, "uuid": "fdfc9569-60a6-47d4-9b20-1cdbb1910f0a", "comment": "Malware payload (Dridex)", "value": "39ef2f621b118618be1d0dc63338a06efcca1b78dea4e5fc174b55e06117c7c33ed380f0bdab2a4a26b94a09620fd9d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525014, "uuid": "c1763839-c579-4518-833f-b1244dac0649", "value": "5504B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525014, "uuid": "510a6430-3474-40b5-94a8-e0b9f27288a8", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525014, "uuid": "b8d3d6df-5ec9-472a-9835-c1dfb78717ed", "value": "3072:xWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:xWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525014, "uuid": "ffd31fd7-cd5c-473b-bbd1-18ddb8c1e6e0", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525014, "uuid": "41502030-01f8-4ebe-8669-4312570d0dc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525014, "uuid": "e92d3e39-c3b3-4fb8-a18b-4d911fad283b", "value": "2ea6653b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878533e0-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541474, "uuid": "0d2d13d8-a054-42f3-a4ee-33f82416033d", "comment": "Malware payload", "value": "da694fc38a8e0578d54a154070a4b2e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541474, "uuid": "d5d883d6-64fb-46cb-b661-943ff32aa1d4", "comment": "Malware payload", "value": "473d6f5e88821ecceed4c8c1e8d6bfd46a0b2c452034e5edf6fab5ffe16dd799", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541474, "uuid": "a57d7aef-5e83-4e0b-958b-5007e0f950e3", "comment": "Malware payload", "value": "0219ea29e54a35629dc59710fe7f6de70435fafd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541474, "uuid": "42170813-f0ea-40e1-a6af-709e472e8dc5", "comment": "Malware payload", "value": "559789424b064be3d90fd6875348dd93ad89cb30f03d281a7a58271b4152a1642139c841ae5c1a719e535b2f93753586", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541474, "uuid": "e27f9178-34b6-4d84-b15e-9d65f81626fe", "value": "5904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541474, "uuid": "4bcf4537-c6d9-401a-bbfb-f9504b9494ba", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541474, "uuid": "6f56b4f9-c48d-4992-9b11-acdb3e305df9", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541474, "uuid": "f971d300-c08e-4194-ba02-1835c2a534d2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541474, "uuid": "d9d2fd72-55ea-4b71-b8f8-51b5472962f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541474, "uuid": "577909ca-21aa-434c-a21e-0503b5f78196", "value": "da694fc3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f1b809-b97c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523118, "uuid": "6cdc6435-98de-4a2b-9cc6-2c8f3107e6e6", "comment": "Malware payload (Dridex)", "value": "9d0dde78b9444c69d854378731b48db5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523118, "uuid": "d64ee790-1981-4a63-9e69-c2ec58794ac0", "comment": "Malware payload (Dridex)", "value": "4768640e9de964f26c93b13c86d4b2a8d9b793f68cfd98b688c83ef2e2c7f47b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523118, "uuid": "50103114-d73f-4fae-8487-2d00395fa0d9", "comment": "Malware payload (Dridex)", "value": "bfe509899a7f3cc084e20d2e4f63211f3f1c6337", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523118, "uuid": "7ee05cd4-1210-4536-9e44-58b2d4541836", "comment": "Malware payload (Dridex)", "value": "2786c46ff6c2a13795591c6c9d96bafcbde5befc42ca301c84a961b84a08b801f2aa82d493d59f4176a4c55006c32d6c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523118, "uuid": "87d71e39-a8a5-4e69-b2de-9931b03941ac", "value": "F404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523118, "uuid": "0760fd63-0f7f-4237-a51a-619152ade7d2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523118, "uuid": "de4c6df3-d6a5-4ad5-9905-a5e692ff4866", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523118, "uuid": "e3235710-958b-4c89-a5ca-da62f4314a8d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523118, "uuid": "b654d98f-406d-4cb4-9039-ddc4f75fd9a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523118, "uuid": "9bd223cd-b4b9-4c3d-ac0a-77628e481d20", "value": "9d0dde78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2318cbcb-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541735, "uuid": "f024f0b8-a15c-42db-ad90-78b13e13bdcb", "comment": "Malware payload", "value": "a816d6ac51d278bf66566ab6ab630e9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541735, "uuid": "4add0530-bd8f-441e-be2a-9cad2ea90da8", "comment": "Malware payload", "value": "477c38611c97cac3549f1d040869c3c7d5b91db3706c3cf43e68353796f2383b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541735, "uuid": "52e7ff4f-28d6-4d10-906f-20044f3664eb", "comment": "Malware payload", "value": "53c0382575f36bc31bcb2e3862760218c8e5fb69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541735, "uuid": "87a95327-ddb9-492d-8913-6705cdd7f8cc", "comment": "Malware payload", "value": "a5b1ce50d56b95516bd0cf6962af97a2e6d3f6ac9e7f0bd5db2ddfc8371676e7a449f2f2bc07d7724e3c0d51c536607a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541735, "uuid": "e541daa1-1fa6-4d1c-9073-71aea25b2fa8", "value": "0D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541735, "uuid": "bbf750c7-95f9-4a5a-8b59-bc1231a0c47d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541735, "uuid": "ce9bacd8-b14c-4fff-80a3-e1702b425a42", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541735, "uuid": "9a4c5ece-d45e-482d-9ed3-20a3db1bed77", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541735, "uuid": "5d362cc7-1546-475d-8ca7-77e45e87b9e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541735, "uuid": "cc2fa1b5-fc07-4fa6-9870-67c6feb5c21a", "value": "a816d6ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5df59f-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539521, "uuid": "ac9ddf7d-edf2-43d0-8ad9-cd99253748b0", "comment": "Malware payload", "value": "b8360cffd21224e0b39a8c587ea15fcc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539521, "uuid": "82b9e1cd-3dfb-4675-9ad2-4e5f3d1d6803", "comment": "Malware payload", "value": "47808f5cb03726b51c3e46ffd7da803a4cbf64143e552a1b7d2c0e88f6870378", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539521, "uuid": "383d8321-635d-4410-8c25-dd214c0fedcd", "comment": "Malware payload", "value": "532587db26b8166c2437d6b2e6803b3df2270944", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539521, "uuid": "f4ee211a-0717-4032-838d-bbbfe8ff56d8", "comment": "Malware payload", "value": "6f5c8af961198cf156ed542113da8c24dde214745eb8419d7c771b291179b7ae09601c8c3e9247fd710153716137ec87", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539521, "uuid": "d9631f8d-dce4-4a0c-8c72-b414dbc7294b", "value": "6304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539521, "uuid": "223b8b7c-9a70-49c7-9b68-fa56ce45696a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539521, "uuid": "49771f5a-16ac-4e9e-9900-11a490f3838a", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539521, "uuid": "6c0a20bf-80b6-453b-93dd-b7dcbbd9decb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539521, "uuid": "ad96144a-2e10-4858-bb98-d4a2a710db30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539521, "uuid": "2621f46f-2610-43ec-95c7-c175e9859b05", "value": "b8360cff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63043942-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534112, "uuid": "95a33a2e-b857-4da5-a63c-2bdfcb9faded", "comment": "Malware payload (Dridex)", "value": "259b086fca94d4230123abb9bc006f12", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534112, "uuid": "12fed272-914c-4ada-949f-0e893432fd7f", "comment": "Malware payload (Dridex)", "value": "47a522b323394655316a6815edbbec1ec38dd7b53dc756e856bcaf3f07a52b18", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534112, "uuid": "4bc4523b-bbe6-4dce-8657-7843aa3d3a4a", "comment": "Malware payload (Dridex)", "value": "992a25b47914cfb54d5f80e55e586188a7123b43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534112, "uuid": "2553c716-1205-4343-a787-3c2276d84c63", "comment": "Malware payload (Dridex)", "value": "66b29d3431aa806e25326e090b278996fb587f6913af4153ec99395f69f36bdd269424803d9a5e49fe25833955138ad2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534112, "uuid": "7755816b-24e0-439d-928a-789a4d7c0482", "value": "2204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534112, "uuid": "a37552ed-41cb-4993-945c-d035febaec5d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534112, "uuid": "808d7942-0ac5-4998-85e9-1ecda3a39a05", "value": "3072:Gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:GH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534112, "uuid": "c8c379cd-f5c0-4022-8d76-b7cf40381dbd", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534112, "uuid": "420a747b-6d84-4b8f-b16a-706c4b949cd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534112, "uuid": "10e7263b-0b87-4589-9030-3d6553461e08", "value": "259b086f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca242f7-b96d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621516760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516760, "uuid": "d8095da3-73f9-4f07-bc5f-111b64b63895", "comment": "Malware payload (Dridex)", "value": "355fe07dcf7353dc58cbeec4f9391e57", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516760, "uuid": "5336d182-2867-4c1c-a2af-52d991a12673", "comment": "Malware payload (Dridex)", "value": "47d34e9eb648cc54306e174c3dacd3908ce6e279ade65393a48f8ba83971603f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516760, "uuid": "ef2cc2f5-345d-4441-9339-5ff2e80ab71f", "comment": "Malware payload (Dridex)", "value": "fb779cc55eacf506e74e57bef4f1716f10486c57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516760, "uuid": "8ab52f17-9538-4c7d-a348-6c5b4c36584f", "comment": "Malware payload (Dridex)", "value": "bfa4d2cd31681ee11278c0fec171b1e51dede753f6b706d9ebccf351a9725333dabe3efe7a856f959456e9dc8a4ab263", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516760, "uuid": "90137f79-a5c8-4d20-a8a5-8af645d9f627", "value": "73F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516760, "uuid": "bfb11136-7d5c-4f17-be7d-f52775811110", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516760, "uuid": "5391e9bd-45a1-4b7b-81ef-32be09752f7e", "value": "3072:CIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516760, "uuid": "49a2fa43-4a52-4303-8c2e-dee2abaca5d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516760, "uuid": "b86ab8da-0d09-4a9e-a90c-16419e99a3fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516760, "uuid": "1ce43550-aa80-4573-9167-32c9d6a95bb8", "value": "355fe07d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86b99d0-b9b9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621549395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549395, "uuid": "947c1b9f-6621-44dd-8361-c582e1f5fd71", "comment": "Malware payload", "value": "9bf00fd11c7af5f4e00dcb594162d039", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549395, "uuid": "88f6eb3d-3ee3-423d-94f6-29d403f95c91", "comment": "Malware payload", "value": "47e005b99645e3cb17506c4afd16ff29bf326ddeb7aa46427f5c2f77cd06e75f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549395, "uuid": "389ff042-b5b0-4616-90f8-6a1d7d357b80", "comment": "Malware payload", "value": "e98d3b1d2a05fea872f45adabe1f765aea4f80b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621549395, "uuid": "5cc1dffe-d0e0-41cb-b155-24633c5e74c6", "comment": "Malware payload", "value": "1ea8cafc3af3414962dfe2044a1fcaa708a72d294b97a7d2bdd37ed484492744e33fb6a24866f72553e175d58d9d8b35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549395, "uuid": "2c0494b5-5612-4dec-b989-346fc4e19f94", "value": "A7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549395, "uuid": "90c72b0c-151a-4371-af98-85a33dfba157", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549395, "uuid": "adb5a406-34ba-4133-82c2-8e051d798186", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621549395, "uuid": "8a4f3a75-c88a-42ba-bbed-3ed3634fe67e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621549395, "uuid": "1c251212-b634-4528-ab87-5d82ae7c0e54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621549395, "uuid": "649d4050-90e2-4304-a52a-c9696bfac82c", "value": "9bf00fd1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13903dbf-b9b7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548152, "uuid": "01aa7ad7-d0ea-4c26-b778-c598b5a74abf", "comment": "Malware payload", "value": "adc82590432e5b2d4020f5b3c3b2d61b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548152, "uuid": "5774a302-adf8-4ea1-a8db-21f726b62e2b", "comment": "Malware payload", "value": "4807a59b0dd74a14fa4710461fda7bb03c1b52bf168af3d14265e43cf952d803", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548152, "uuid": "76ad980b-38c6-43df-bf88-18f5a2fae3bc", "comment": "Malware payload", "value": "cb83fde89ee87b6997a0dc2ef9340b0d0e1d9125", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548152, "uuid": "4e99059b-78b3-47ae-947d-83c63f517bcd", "comment": "Malware payload", "value": "846f3421c2d44cc47daac7afbe06ffdfca4c4278c7e62e8d73176e36124e2fd12beabb2a4077f61a7904bd46bfb6d717", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548152, "uuid": "3104e8e3-60a5-4b31-88ac-19135c8286f0", "value": "9D04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548152, "uuid": "2ec5b2ef-3157-4ba1-aedc-4ff0ffcf2d73", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548152, "uuid": "e6005857-9b51-4ac2-b595-52b8c8ac46b9", "value": "3072:wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:wH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548152, "uuid": "3d68ab84-37ab-432e-8988-2bf3c669fc43", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548152, "uuid": "f097aec9-a55b-498b-9609-55091a7b5cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548152, "uuid": "cc0b0729-7b7e-45b1-bd99-78f6f1d104c4", "value": "adc82590_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40c70db-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542381, "uuid": "3964a7c2-8366-433a-8921-b69b3ab26f43", "comment": "Malware payload", "value": "8d1ffdce8aec0a51d7773414f67fdce1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542381, "uuid": "67a330bf-407b-4e52-a3f4-fd24cbea2ae2", "comment": "Malware payload", "value": "4808b700b0fbd7f5e9d2d7a9c5de7ecfa8821535863dbe9995fb6def9cd5a2cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542381, "uuid": "bebeb08a-39f7-437d-96eb-767696077867", "comment": "Malware payload", "value": "cd45f1ee689679f81fd28ca40531419fb5eb7b09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542381, "uuid": "88187ed2-657c-4b3f-b430-fe29bcb0ff88", "comment": "Malware payload", "value": "208d4bfea3801e6a0fbed51900087d37ac149e6c0203768aef675109f82227134612b2c48fe971468868a6de61978243", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542381, "uuid": "4f92ccca-81fc-4df5-a83d-4960ddaa1a9d", "value": "5804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542381, "uuid": "0bf92de2-6f0d-44be-9f8c-8cd69286dedf", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542381, "uuid": "8ec6135b-45f4-4db5-9cce-09d866fffc93", "value": "3072:rV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:rV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542381, "uuid": "13f6cf95-8a87-4046-8ca3-2f66a79863e5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542381, "uuid": "3b914812-3e48-47ae-966c-9273486022d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542381, "uuid": "5f352595-f916-4257-b26e-b72f51c52772", "value": "8d1ffdce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84901abe-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523860, "uuid": "43fa46f0-52e4-458d-a997-aba3811b57e7", "comment": "Malware payload (Dridex)", "value": "f605c1b932f73f7d114c7e5a3c8a28d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523860, "uuid": "a4e9e992-4abc-4855-b1c7-b0886bbcba43", "comment": "Malware payload (Dridex)", "value": "483bed83d1077aed2e0d1a013791ccde946ffb98ac8491ecd60d25687b3248c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523860, "uuid": "f1a58eea-1071-4116-bb65-52e6e1e9f8cb", "comment": "Malware payload (Dridex)", "value": "6c30598f4f9eb674ed4a90deff67596e510f9499", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523860, "uuid": "c7cfd99e-f868-4536-8533-7d3eb277e14e", "comment": "Malware payload (Dridex)", "value": "ede3245ae4911ef7e26321eb83c0bafd11451c0b572cb52a63ef2b9bc4d48f5214a6e5ad554cf542dd060ab7a124bd38", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523860, "uuid": "953e9a57-f00c-4438-8789-7218ef7dafa0", "value": "B704B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523860, "uuid": "a12e0894-6d31-4879-a9d7-7b10d1cbc311", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523860, "uuid": "6a15dd78-033e-4423-b2f7-61a3b24a9582", "value": "3072:6WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:6WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523860, "uuid": "11eec82e-ccac-43a0-b8a8-a3d842b4c060", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523860, "uuid": "fbe6e822-451b-4763-b386-85487e29d27c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523860, "uuid": "c325fb0c-99f6-4395-940f-4b7a7c2c8b1e", "value": "f605c1b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23849589-b95c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621509094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509094, "uuid": "69f615f6-75fe-4f9f-9eb0-8a88f995e9d7", "comment": "Malware payload (Dridex)", "value": "89d356fdb84a62a9a573d7c816ddc774", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509094, "uuid": "9a52cc68-319a-4a2b-821e-728c3792aaea", "comment": "Malware payload (Dridex)", "value": "486a30e31d0f672ae246f0bf52a99efeac6c491ebbecf61583d77b254c37f2d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509094, "uuid": "6eb44cfe-dfe0-4737-84c2-0b4ee7c90903", "comment": "Malware payload (Dridex)", "value": "9218d7b670425090c296b59b844f9d87bf53f872", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509094, "uuid": "5ebc2c07-5ca8-4724-bcf0-83c8b604c8f6", "comment": "Malware payload (Dridex)", "value": "70f88f2d4b76c31f206dc9472237ee3e63b54ef1b7fbeb69bc136cf2af65ec95135d359b70f83b9aab0855e383fd24a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509094, "uuid": "9408e29f-611b-478a-abf9-d43070f06a44", "value": "8E04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509094, "uuid": "bbf05ff5-f9d5-433e-a48a-59977fac5948", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509094, "uuid": "f3ade05b-84c9-410a-a827-be9dc6e522a3", "value": "3072:lWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:lWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621509094, "uuid": "74848fcd-1d08-4ba6-891e-b4f424f652fb", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621509094, "uuid": "70c0734b-ff39-4ee6-91a6-7e984a04cbb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509094, "uuid": "988b5d22-66eb-4354-a3ec-8bab203fcfb5", "value": "89d356fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d80201b-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540062, "uuid": "4540b549-5c66-400c-a45e-61e4b1670c7b", "comment": "Malware payload", "value": "dc9ba809ed579d62b23f35f225c62ee7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540062, "uuid": "61caebf1-40ea-4af6-9df0-f458bf23f3fc", "comment": "Malware payload", "value": "48736a4a4edf8c1e21f3c6dcec4c1762921192f925eb65a8f7a31b9e9d49e164", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540062, "uuid": "996ba63f-898e-483e-af81-709bb076800b", "comment": "Malware payload", "value": "e612b4f13400dae8e626ae5d135f56de0c2df2ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540062, "uuid": "0644825c-e695-435f-8f64-d203c58514c3", "comment": "Malware payload", "value": "23d87a8b6b1fabef6ac8ab9b142f62d227e6878e95a634d8b634ed3d1140b19eec26160d6dc9e290f5ce858726290795", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540062, "uuid": "c9731dc6-d238-48f7-9011-b8e901992e20", "value": "C204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540062, "uuid": "0611e7ed-e965-4712-b257-81e89c2c9536", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540062, "uuid": "b025d17a-0ebc-42c3-ae22-fd8feaee2c24", "value": "3072:OWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:OWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540062, "uuid": "790b000c-a88f-4433-95e3-ac662aff121f", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540062, "uuid": "40727ec0-5d1c-458e-b18e-d2fea6f37674", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540062, "uuid": "09cb071b-e301-40d4-83ab-c10c5958e52c", "value": "dc9ba809_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b409e908-b982-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525658, "uuid": "d746c745-2f6c-4d56-88d7-6bb9971c9cff", "comment": "Malware payload (Dridex)", "value": "04e1411dbeefd83790749eba4d168f3b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525658, "uuid": "ba558d19-0283-4d98-b1cd-9c9b9ce1b188", "comment": "Malware payload (Dridex)", "value": "48796b2bcbe0bd7d9238c3236233c634834f7a72945679e684ea7ca133f715b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525658, "uuid": "2289e88d-089b-41c1-9e24-46efa9c5205e", "comment": "Malware payload (Dridex)", "value": "f1d72019bba0c191d9e9da1b0efecb3296429dfe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525658, "uuid": "f8233ddc-57e1-4204-9e0a-873f5aec60b5", "comment": "Malware payload (Dridex)", "value": "dc617c05005bb3ddd9509128aae1137e9f2121aad924ff9a3a81f92d35f415e7706ef76ee672286a31b889a914bf379d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525658, "uuid": "c70c838a-cc16-47fd-89d8-a359ff6f5ab1", "value": "5D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525658, "uuid": "c7792aba-6032-46ef-8987-26f555471be6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525658, "uuid": "95ff6b73-34a6-4404-981b-0c2b730c2376", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525658, "uuid": "3047cb2d-9516-4657-a64a-84439a6316ee", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525658, "uuid": "3fa47aa0-a7d8-4c8d-b191-d32e7ea4964c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525658, "uuid": "41db5f38-f0f8-47de-a76d-5a0c7f2ab3a9", "value": "04e1411d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fad8dc-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538809, "uuid": "d3698485-05d0-4836-9846-f15cfbff15bf", "comment": "Malware payload", "value": "15b059caed15335e63d95cf1f9610781", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538809, "uuid": "22dfebd5-cb70-49ed-94e4-488229d266c0", "comment": "Malware payload", "value": "4881609b1773cf32c769f1d13792a9e81fa74060466b5c73b22fa8528284f669", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538809, "uuid": "b1337fe4-ac2c-49e0-9cb9-278675be6651", "comment": "Malware payload", "value": "e3140cab550e1a881789025c8b65862718d028b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538809, "uuid": "09020e92-9a3b-42ff-a6b1-544667e88470", "comment": "Malware payload", "value": "6ef994a834eac57aa238599e90a63752c8bc6c5c23cdf3b8e56fd00d47eec2fa1f7f3118c885cc8922352b73aa2a34eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538809, "uuid": "da02120f-377e-474c-a29a-6ec1f6778d44", "value": "DB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538809, "uuid": "75566b35-32bb-4e65-9efd-d2a57c431d37", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538809, "uuid": "836ef844-449f-492b-b9b4-4b33837b8a28", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538809, "uuid": "f10bca81-de22-4955-bea1-493002a915c6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538809, "uuid": "77f969c5-8cd1-4486-ac0d-72ba345e7130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538809, "uuid": "de0389c1-4536-42d0-a112-5a4cb78528f2", "value": "15b059ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8590c1-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537265, "uuid": "0891e026-12db-406f-87c8-31cedf3bca71", "comment": "Malware payload (Dridex)", "value": "f2a18258870ebb24e55a132eed1410e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537265, "uuid": "0e0dd607-8393-4945-b8d5-85c8c5ba4d36", "comment": "Malware payload (Dridex)", "value": "48854e1217884aa381edfcc9adb90d005d35f33b68a0189705775ebec50f7704", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537265, "uuid": "946bc049-ce91-4c7e-b0e7-4ddc6c55d8fa", "comment": "Malware payload (Dridex)", "value": "eebb19f8b10dbbcb1636c200aef3a7844a108ec9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537265, "uuid": "f89fbb21-1c2c-438d-a936-135b89ce287c", "comment": "Malware payload (Dridex)", "value": "e69f88538b401cc291835aa12badf55fb4a3de94f74f7095e10f3c01f68a92d74ffcd2c4a64cdcbfa957093e4ad654ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537265, "uuid": "7b80fcdd-2684-4829-acd3-8ecb2866db8b", "value": "BD04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537265, "uuid": "53459eaa-0a12-4987-9651-38e4c9ea0ff4", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537265, "uuid": "39cf22b2-6f90-4169-b465-a5dec305516a", "value": "3072:Oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:OH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537265, "uuid": "65872dd6-9dc3-4c1d-bb4b-c467b52c719c", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537265, "uuid": "d817cf53-6cd9-488f-9657-58d50e19fbf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537265, "uuid": "f51a9a40-e1cd-4914-9a96-9d5ea7259545", "value": "f2a18258_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3880dde1-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526309, "uuid": "3c255577-90b3-4650-b89c-a86e38076734", "comment": "Malware payload (Dridex)", "value": "13e6e91938d156f6fcbefadb02fe8cb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526309, "uuid": "68a787fb-3659-42e8-9a96-e41d4786144a", "comment": "Malware payload (Dridex)", "value": "4888ffff3d2af0aab03b8b26b94b36c05410e3842126aa4cf180fbaf24057741", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526309, "uuid": "57e8a311-d96f-4244-9663-b82b25831866", "comment": "Malware payload (Dridex)", "value": "1c6a7a1dbd6fe15341c07aa4fe3523bdf6bd80e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526309, "uuid": "f8c5aae1-8dd3-4ced-ac77-932d2ee1e1a3", "comment": "Malware payload (Dridex)", "value": "792ea9784c33045590b6c66dd1fbfc9c90d71d2729742cde7c2b79acd65091c075e7a904a42312efc511f191b17bf113", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526309, "uuid": "651e26bf-c187-4000-9153-cd998ae3adb3", "value": "1904B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526309, "uuid": "a390ab3f-d4de-4715-97f8-e82071fd27ed", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526309, "uuid": "ef06af49-a1b4-47da-8dd4-d3ccd7710ec3", "value": "3072:AWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:AWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526309, "uuid": "02df1703-db90-485f-87c2-9b7e6df6bab0", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526309, "uuid": "af5fbd66-2b24-40fc-8f28-9c3793a98894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526309, "uuid": "fd859356-95cb-4f4e-8d30-818a1e7d3df6", "value": "13e6e919_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77bde78-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541125, "uuid": "0fa9b3d4-d43d-40aa-898e-9a05f644a8d5", "comment": "Malware payload", "value": "bf6a6205eb6d331b2a651c6e5840f22e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541125, "uuid": "af513029-0a8f-489e-b5ee-513b88d91d58", "comment": "Malware payload", "value": "48cadb27bc4a549d46cd650a261e0650885d76a00a28568dc7a69653857ea594", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541125, "uuid": "f02edfdc-0383-45b1-8266-7a14474d7ab7", "comment": "Malware payload", "value": "0a8ed4334e732c11f1c51a59cd7ac03b2485c55c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541125, "uuid": "53b2ac98-bcee-4acc-abb0-6d604978bfed", "comment": "Malware payload", "value": "4edf3ee4d3e3a1e8ba53b330bd7f0cbc6d947da503002afe18ce10a7e719c9e46189daf72701a3a243711c3533c3f477", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541125, "uuid": "8788be3f-025b-4c30-a0b9-796ba9572591", "value": "EEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541125, "uuid": "27528c11-cfce-49ea-8d61-ca41509eda79", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541125, "uuid": "dbe2f537-5876-4974-bb29-577910e1aa47", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541125, "uuid": "8a908678-cb5e-48a8-8522-9bbe7667395f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541125, "uuid": "22080e76-db59-4f0a-92a9-58a26b145266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541125, "uuid": "95f4a010-c0ab-443a-80e6-a7d74e1badef", "value": "bf6a6205_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ffeff4-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544500, "uuid": "31479cfd-1517-4ee5-9a7f-549bfd4ac1be", "comment": "Malware payload", "value": "56091a0e3728abda977559e4b436370d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544500, "uuid": "bb9a128e-4ba0-4e98-80df-53b5be9e8a40", "comment": "Malware payload", "value": "49765ee4234abe6fe11d48ddc444f25ce64e69b124bdee2cc4aaf8a9ade3416e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544500, "uuid": "7ce0f747-ed2a-4e36-ad82-6b60c936976e", "comment": "Malware payload", "value": "c123c96b587775977bb51cc0a4be1b7176a78cde", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544500, "uuid": "99f38cb8-1b34-4949-a1b2-de4b8d13cbc9", "comment": "Malware payload", "value": "ea27c7aea3002baea93ac3f1c1bb28ead741c15bc061b5ecbbea704d368d4c67c532220f57570a5c65df0121bdfbf463", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544500, "uuid": "89cec2ac-d7ae-4f05-8aac-2f4ec4830d33", "value": "7804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544500, "uuid": "811af11b-fb52-428e-b5db-81441a6284f0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544500, "uuid": "2535c62a-6e43-4de4-92a2-a0378387639c", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544500, "uuid": "34905383-bff2-4a4f-996b-b6bf25e166c9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544500, "uuid": "28c97071-8847-4a75-9618-b69b8c1f1cfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544500, "uuid": "a1322fbe-57a4-4b51-9a18-5d927a0f1fb4", "value": "56091a0e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cea0cb-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621532846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "63adf815-104a-494b-9a80-8310a8450bfd", "comment": "Malware payload", "value": "b375027f1322e3af5b9f078308b606ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "6767aedf-1dc3-437e-9bdc-2a10c8bed23f", "comment": "Malware payload", "value": "4977e77562adf5ae225fd15ebdac9e33ae016636cb6fa55cac43096c237eefaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "3d7b3e1f-b444-4f8b-a2ae-29de39693423", "comment": "Malware payload", "value": "f3fc6f156d6d2d7d5ef719089a292f7e9e645423", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "26049e15-644f-4303-a5e6-815d4990fce1", "comment": "Malware payload", "value": "74a0baf030bfca1bc3a38276dbeaeb814229b3aac5e5d2427a29e676099a1ed12fa1c709c6ca8b54fed2423e94a86b6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532846, "uuid": "19541d93-d01d-4d6a-875a-e5da4de5a9ce", "value": "B10412DB48E97E59EFA8F5B60133D4BDF07F75EB2A283127826ED131A0A11D19C05A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532846, "uuid": "0a67fb5d-9e6c-48f7-87bb-6f5ed7032a94", "value": "3072:m6D2ab/Fp+R6VwjEB5MQHc+LkqNnmiimuoeqk6hmxVCdqEiY7KiIAiaLuwX493Q:3ie/Fps6VSEDMQH5wqNnUmReq5mxUIEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532846, "uuid": "13c078b8-ae48-42be-a449-f55997801eb5", "value": 173714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532846, "uuid": "0673444d-6f9c-4355-a2ed-2f8c4db0c36d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532846, "uuid": "73c9669a-5402-478b-8e2d-a5116390e675", "value": "b375027f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b02bbaa-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536273, "uuid": "d4089e38-34f7-46a1-9b93-6490fd9e27ad", "comment": "Malware payload (Dridex)", "value": "24a9a63ea18ff96b2446ebf91e633773", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536273, "uuid": "3415571f-8c34-40e7-bbd2-8d863005d2c8", "comment": "Malware payload (Dridex)", "value": "499e6585c655badee57cb83aca9893045e29acd09bd6f59c09019226fcd1c54e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536273, "uuid": "e9225fbe-2a25-44bb-9beb-55b1ef7b6587", "comment": "Malware payload (Dridex)", "value": "1da5abbfe9a7da56c0bf52b9b8969225d179619d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536273, "uuid": "471004f1-94b4-47ba-a5f2-4e45d504a0da", "comment": "Malware payload (Dridex)", "value": "a2308777005b1757a15c9f1e0890b0aaf641f5c892bf080d3266746c8758f843295165c28ee19586555e620fd92c0752", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536273, "uuid": "f79d0cae-6808-4402-99e3-8ee2f07c7ec8", "value": "ABF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536273, "uuid": "bb568aeb-5e52-4574-b71d-2dd5924ddd92", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536273, "uuid": "d52328d3-84e3-4f4c-8bf1-265e2c4bd968", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536273, "uuid": "53053290-5a5e-4029-8da5-c990b2e34ce5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536273, "uuid": "fe3be6ae-7ad0-4221-9cb1-cf8e924edec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536273, "uuid": "3bab381f-96c4-40ce-8e9b-bdb9ffb278e1", "value": "24a9a63e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbadb25-b986-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527097, "uuid": "aaed8e04-93b5-4a29-b7bb-1e8f5755c619", "comment": "Malware payload (Dridex)", "value": "f727842be5dcae474a46ed56db9ccc90", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527097, "uuid": "0ea4ccb1-55aa-430c-be75-3c8a8ba4b373", "comment": "Malware payload (Dridex)", "value": "49a936ca83e045fc62c7aaa3a50a2056a7ade7eee3c4881f640292a29cea8554", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527097, "uuid": "16203df5-2950-465a-a77a-c0c66a3c7d2b", "comment": "Malware payload (Dridex)", "value": "af719a3a5fccaff9307343c22093744a05278eb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527097, "uuid": "45f05444-baa3-4085-8da4-3435c7bf9eef", "comment": "Malware payload (Dridex)", "value": "387e431a298a2c0b7126b04bc960a55ea3e05a6d5415a1afc9e468191826179ac5804cb1607a01f126f6a38554ac6d79", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527097, "uuid": "63929777-6303-4f4b-b6b2-c50e320d2046", "value": "E104BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527097, "uuid": "5d7f3cb0-daa8-42af-863f-612abbd55403", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527097, "uuid": "08c85800-865f-4d06-9bcd-709397cf424a", "value": "3072:Ni49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:NH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527097, "uuid": "38356514-272b-4725-929a-452ca04f1735", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527097, "uuid": "92682480-bf84-42df-94e2-6445a4e03451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527097, "uuid": "beb7704c-1f1b-4180-956e-9993748ca168", "value": "f727842b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606e3383-b92c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621488581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488581, "uuid": "59ccc98e-f046-4b13-9f16-1a8d911e704a", "comment": "Malware payload (SnakeKeylogger)", "value": "269b1d63301c9e825e864280aa37f825", "object_relation": "md5", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488581, "uuid": "ecb772b9-29a2-4f07-b0b3-38f0fc192331", "comment": "Malware payload (SnakeKeylogger)", "value": "49b0abe332a386c4524d4a5a41e4ca43768e0416d7f3edfc47503314ad1ffc8c", "object_relation": "sha256", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488581, "uuid": "f9c3114f-4423-4c88-a13d-b906002b488b", "comment": "Malware payload (SnakeKeylogger)", "value": "79dab1fe5b739b9fcbf7512fb2824c0528902359", "object_relation": "sha1", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621488581, "uuid": "36b63272-853e-4d9a-9cff-33d0510a249b", "comment": "Malware payload (SnakeKeylogger)", "value": "ca817824c90a6407a60a15054c8928c940f0a64cc5186445b8571c8150ae4a2a30a7d45f4691e10548bcd2918a7110e5", "object_relation": "sha3-384", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488581, "uuid": "546942b3-cfb6-47d4-a0ad-0d8271b4d688", "value": "39C4DF3333D89B61E0BDA7765022541043F2F546E736EA9C7EAC449C6562FC887B2B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488581, "uuid": "d33f172f-afa8-43a5-a324-88cf7c91d592", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488581, "uuid": "db7b5b26-d962-4e52-bac0-36f21cd6a5e2", "value": "12288:izg0vdEKotXzDOMfj4R9+CmWJgQIwN/L+ijRoXhVwSQT6AuzS+UgeRXMJj6ID0Ni:iwe3A6zfubaYrR2hBbyn+ma/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621488581, "uuid": "45720da5-3283-48eb-b065-391514d6581f", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621488581, "uuid": "99987b3b-731f-4997-ad36-04fcfec1e107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621488581, "uuid": "b4dff0b7-067b-4421-bf0e-fa114682e3df", "value": "IMG_001.IMG .scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fff56e-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537981, "uuid": "4ee87bee-d389-49d2-b7ee-3231062a2ccd", "comment": "Malware payload (Dridex)", "value": "9beb1d49f3024ea43bbe137b23f3ab22", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537981, "uuid": "1c044bd7-238f-4bd7-b024-a16053320de5", "comment": "Malware payload (Dridex)", "value": "49b8f3de5c31148d697ffe458845d772078a989c0c9851b19e03bd10e9a69542", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537981, "uuid": "83868b98-7316-4bf1-acbc-7ced2b584315", "comment": "Malware payload (Dridex)", "value": "ac629cdf828fee2838f1b4d4831a40495911ea81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537981, "uuid": "8534d248-cc44-4422-8e4c-18e219c47b09", "comment": "Malware payload (Dridex)", "value": "fbd986602885d81476b976be1bbd607478dd3a6b5dc8a5811bb5d5542640a348c11a84ae67050347840c8d9d442527a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537981, "uuid": "8c58ba6e-41a4-4950-8dd8-16ed6c8f977c", "value": "CA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537981, "uuid": "b793455d-56f0-41be-ad07-26d15e7ed44a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537981, "uuid": "048278a9-69a4-4590-94c3-e16961e44014", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537981, "uuid": "64b6b08a-d1ba-41ef-941e-26bc3cf2aa02", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537981, "uuid": "4053f443-6954-419b-aae3-a99374f7720c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537981, "uuid": "16d43176-7bd6-4461-8586-81a6985f07e9", "value": "9beb1d49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0e4576-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545057, "uuid": "f5f8c7dc-083d-4e76-b56b-6ad73fe4df4c", "comment": "Malware payload", "value": "fed0567c7530ce6eece9fe4caaad1c43", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545057, "uuid": "e9be61b5-6444-436d-aa70-870de8eef634", "comment": "Malware payload", "value": "49d1befc6552179becc56c35cfe47efd96bd302a88c4c9fc46c6e0a0e75ef1f8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545057, "uuid": "6e397e00-4593-49e2-828a-0b90341fff77", "comment": "Malware payload", "value": "f1410c2e184b02700cc7afc2b5ead39935508e8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545057, "uuid": "953d0094-3eeb-41cc-a4a2-87cb298473ab", "comment": "Malware payload", "value": "6baf0dc3d8fcc285dd128d5ac01b56897fff87699186bd14589d970369d2d99c0429bc9f20744bc31185b0465f094a04", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545057, "uuid": "5fa60c72-78d8-4836-8bc2-69a43cd8dd94", "value": "ADF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545057, "uuid": "ecaf092c-e610-4e52-bd28-38c4a7bbe6ec", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545057, "uuid": "253e5d93-7ffc-4bf0-b048-3f6bb8515e33", "value": "3072:CiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:BeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545057, "uuid": "7c6df166-5c75-4c72-af32-dcdd140c5597", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545057, "uuid": "62d7fe8c-6805-4d03-97d9-b1640b8bf47c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545057, "uuid": "78432d18-1ff0-4659-a0d9-f2409150d338", "value": "fed0567c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf66c84-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621533860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533860, "uuid": "dd223bef-90ad-445e-bdaf-f4f7e54b92fa", "comment": "Malware payload (Loki)", "value": "c565505c43e93390f43e035daeaf88c5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533860, "uuid": "db017ab2-d8a1-4fb7-9539-a2cddd48799a", "comment": "Malware payload (Loki)", "value": "4a225a61938fe201ecd7d3bffb7296a830848c4dbed35c2f537f98161dc88ea2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533860, "uuid": "0af9e442-17fd-48c2-b6c7-cdfb49b6e4fc", "comment": "Malware payload (Loki)", "value": "0d337df9c3c3896232dbc5876eff33abbe948c2a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533860, "uuid": "b6717506-eb09-486c-b256-352063e6d5b7", "comment": "Malware payload (Loki)", "value": "612d2168c7c3d8654aaeecef80fe392536c7a1093d565e7417529bcb7ff4b973ca5e4f0e33a8f2fc9e96ec1cb15388bd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533860, "uuid": "889cc396-3d34-4d34-b996-48a5d0392e40", "value": "C524ADC5F98094A6DC2AA3322A36CD3156637D3DA574281D3BDE3E7B3FBB0529426443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533860, "uuid": "72046548-0105-433b-b8ba-712a84cba41d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533860, "uuid": "ffea6ec3-b27c-4926-af5e-5cde3ff6a343", "value": "3072:xQIURTXJ9MNcM3pWmeSPzr+CwX9iiHoHUPx/Kdb7B9Eg9XC3xTnh4:xsLIpomeAziVtiL8/sPKxTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533860, "uuid": "34344a2b-607e-44a1-b01b-3d315250a4ed", "value": 221664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533860, "uuid": "7de86116-61a1-4719-9ee5-1600b68af279", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533860, "uuid": "0acd0ee0-10a2-49bc-8f91-07308e9c8000", "value": "PO New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce6b1ea-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542342, "uuid": "53d5f889-a540-435a-9faf-9143e206e2e6", "comment": "Malware payload", "value": "eb3acfffa207f9ddd40443917b60c995", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542342, "uuid": "0c5f2113-94ae-412b-9fbb-4bd6dbe5fca4", "comment": "Malware payload", "value": "4a407722c391d92dae21f8f950d5dfaec208e3fc9e7792fba0cd9305897a34eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542342, "uuid": "c3ae548e-7ea2-4691-9c98-edbba92d186a", "comment": "Malware payload", "value": "d43f88580955000e85a53f8358c74651ade41ce7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542342, "uuid": "7b57fd9e-311b-4e20-8202-2ea4101b4fa3", "comment": "Malware payload", "value": "91396ca2487e3e2ca601c28a51f148ff44c2d3b44559c09904fb98e40b0d7dc0446c16745d05e491767695bd7b715d8f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542342, "uuid": "b4137e36-7143-4415-bedd-ca839d91d881", "value": "F30423B4837BA141404AEF53AFC5E6DF4482BCDA4AF5287FD1E219D35683AB0BE43581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542342, "uuid": "f2538868-e992-47f1-8a3c-91066931ed92", "value": "3072:maKemLS2KcZ91Alx/8wl1cWnzrZrWcFYwhYeADNCK2kNts1HFC3g8ch9rsZgmpa:BaLSFSnm7DPAbwAZx2kNH3gL/oZdpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542342, "uuid": "c5b5157e-3ef5-4bd6-b9ff-ca07ab04959e", "value": 173719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542342, "uuid": "a6d1be23-2fde-4bd8-a123-b52a412945f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542342, "uuid": "9a27d4a9-5951-4a21-acc2-da322d9025d8", "value": "eb3acfff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befec28f-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533407, "uuid": "8ca283f7-dd88-4115-9212-41101476897e", "comment": "Malware payload (Dridex)", "value": "43869e6217015c992bdfbf3c906eccbd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533407, "uuid": "a392dd43-2396-4a05-b7e7-a6694aca3935", "comment": "Malware payload (Dridex)", "value": "4ac3a1406df692cd80736c3d463ce282e3b3f299d3028c9dfc11019576df83b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533407, "uuid": "06bfa3f4-a72e-401a-bf90-991ed88900a8", "comment": "Malware payload (Dridex)", "value": "920eb619cb821e7603a897619985418f079ae712", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533407, "uuid": "1e747a25-2ee1-4863-b4dc-937991bb61e6", "comment": "Malware payload (Dridex)", "value": "7f429ad6c43b7e8920ec2e6f30d77f7cd6f3ec6a2e3b0a828b63b5c5df97e2298bd02667d5d5957df0f2a6abe2849b8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533407, "uuid": "44062f46-71f7-495f-9fa1-8bc3107ac605", "value": "F604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533407, "uuid": "3a64a3bb-b466-498e-a883-32109e264b27", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533407, "uuid": "f3c747c7-1727-4431-bbb0-2ce0384db1a7", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533407, "uuid": "58a4e688-c120-484e-9b7a-2ae4c711e773", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533407, "uuid": "646f3810-8317-448c-90e4-8f1f20e4b327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533407, "uuid": "acd31c38-9c36-447a-a495-e00f5dba2172", "value": "43869e62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925e6992-b975-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621520018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520018, "uuid": "3212ce45-a39d-41bd-8afe-3b5a3b1eac2d", "comment": "Malware payload", "value": "65e59de3f91b48588debf4bac569a56e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520018, "uuid": "cbfd6326-35ef-4d03-8d5c-44cc6a42dcab", "comment": "Malware payload", "value": "4acaa23485b3925cd95eb6db4a8c3f05aad1880712cc0267983ba142f19bebce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520018, "uuid": "88b1dfc5-cfbd-477f-8d3b-9596790b8df0", "comment": "Malware payload", "value": "43ad00fe9cdcf95c1509c3310bc562bab863c457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520018, "uuid": "3c35c53c-cb15-4105-b405-3c3131dfab63", "comment": "Malware payload", "value": "35bd46f30535baf87cd121fb0e7d46db055a94e0bf1ba01685abb373d1b2877c11a50a19db49fcfc9f542401655d4d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520018, "uuid": "e1204006-a419-4c3b-ac65-f1e4ce1312ab", "value": "E6F4E135354DAF64E07E2BBBD461650057F8EC02A771D22D3CE4316C1DE2FA63AA1A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520018, "uuid": "a6822d32-1a1f-4802-8fbf-b84693b3c32a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520018, "uuid": "55b1e301-c11d-40de-a5c6-3d82393f0d4f", "value": "12288:WRSKzs++++++++J++++++++TLpEPwyikDaUMzfg7Htnllgn8xlskb:2ze+PwGz9g8xlskb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520018, "uuid": "8020abc0-1ef6-42d5-a78e-d6bd17b1889e", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520018, "uuid": "84acca70-27d4-4ab6-aaea-1aaa6518f81d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520018, "uuid": "f0b52e37-1772-494d-8058-8f070206de40", "value": "65e59de3f91b48588debf4bac569a56e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e1c609-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "e382dc90-9b82-4b5f-ae55-9bfa126391bd", "comment": "Malware payload", "value": "de17357c5343026479fcd454c593a8d1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "8e24248d-2ce2-42c6-824a-efe2b900c4ae", "comment": "Malware payload", "value": "4b0b043cbaabdf97a47604f43883f55b358217b430a9407b602358593af5b521", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "bf04e1f1-6d3e-4f05-899b-5481d038ab4a", "comment": "Malware payload", "value": "bc78ed0db121aa1a9b132c46a9ea643e36be2aec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541249, "uuid": "a4df3e52-7f7a-4d4f-bc8b-d8860fcf0c9b", "comment": "Malware payload", "value": "419fb58bdf888b2afd7a8df315cbdcea19585c24ca7db12c84ef37efa824d53811ecd36a2fad58bbbc751f2db085b37e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541249, "uuid": "48e57f2a-c024-4cc3-9fea-4a77197190db", "value": "F735E010B880E132E5A311354E77DAE9076CBC124B198ACB73D43E7F6D786F16B32666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541249, "uuid": "8fe45686-eb1a-4328-b98a-6d3926f68d70", "value": "24576:cEIjrPUaphvGvGUZ93/semhXp7AsWCaHESKHhweYkTfBR0:c/jhvGvGU93097AFCsESKeeYkTfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541249, "uuid": "e3cb8370-9457-4e47-b570-96bad482a659", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541249, "uuid": "193587eb-e377-49af-8ef1-7f824cb53b41", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541249, "uuid": "7a5ce6a6-783f-45bc-b220-fb82eefc1462", "value": "de17357c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be12926a-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539848, "uuid": "f8534b16-4df7-47bb-a021-65f911bd8c4c", "comment": "Malware payload", "value": "ad61b9c4b3211e2abd1345a818d7823f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539848, "uuid": "56d5f14e-8c50-480c-831a-6bb3fdfa40cb", "comment": "Malware payload", "value": "4b2557a1fa0df058f09c95d95f923c37db4fb16020607954ee7d6a26616125c5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539848, "uuid": "dbf37da3-9ba0-4148-8e8f-bc1d1e6b5735", "comment": "Malware payload", "value": "098f7ca05b8aba341dc004d029060255de24b564", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539848, "uuid": "a5d67367-446e-4fe6-b5f1-d120cff6cc7d", "comment": "Malware payload", "value": "54ae17747d31443c0455e4d5e0722b9234b7b017d84647f1eb69ed1df35a5520c53ae31bce8994c7e8fa43a91b117a32", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539848, "uuid": "2acb9451-25ba-44b7-a4af-17d90bcc7dbf", "value": "0004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539848, "uuid": "235f1536-bf04-4783-8290-7c7ca35017e1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539848, "uuid": "a62950f5-e374-4abe-967f-4effecd0d94d", "value": "3072:AV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:AV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539848, "uuid": "a47d8025-f636-42b2-8a99-18468eaf3f1a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539848, "uuid": "f5c2b911-2e24-4282-a60d-3b8cabe9cc18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539848, "uuid": "0427cf09-3ad9-4a57-9ffc-2760423f0c83", "value": "ad61b9c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d9d5ba-b943-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621498441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498441, "uuid": "adab8b94-979f-4354-b19f-f95bc326318c", "comment": "Malware payload (Dridex)", "value": "fd42f0cd93d783d413831876561c5b0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498441, "uuid": "5743dd8b-cce3-4991-943c-041879552581", "comment": "Malware payload (Dridex)", "value": "4b59c5f7981c0cdfab9e7aad42efbaafc2b56a6e99b47ed87bbf56abdacafab4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498441, "uuid": "8d02e766-2997-4383-a6be-7f1ff41957a6", "comment": "Malware payload (Dridex)", "value": "f53272442f35f090f7ad7de88be582e74a16aa87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621498441, "uuid": "ee0f705e-2330-4d2c-8f52-f9785f5a440d", "comment": "Malware payload (Dridex)", "value": "ee33961740a1e60c685641a634e5944deae3c7f7453621b351294ee073038957449614efec1d0e5e31f28b1365ae4cee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498441, "uuid": "08980d00-aea4-4bd2-b0fa-6614076fe71b", "value": "46F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498441, "uuid": "b96aff25-fb0c-445b-953c-1c02f242f869", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498441, "uuid": "fb8fe14b-355f-42b1-be01-69e056420d68", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621498441, "uuid": "f8fd16bb-247e-4d18-9e1f-491ba559a720", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621498441, "uuid": "059749b4-4733-4e4a-9f8a-4dde119a1f7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621498441, "uuid": "f65ea200-5977-49eb-a79b-a16bb94fa060", "value": "fd42f0cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa33f82-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520282, "uuid": "ff68e793-77f1-4c13-b47d-f7c4cab1d79f", "comment": "Malware payload (Dridex)", "value": "a2f41f04935bed136b193be0d57f780a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520282, "uuid": "ed990450-8d94-4818-aa18-45bc8110c196", "comment": "Malware payload (Dridex)", "value": "4b61cfa2d26ff7e4fba321f0564e2be5f83e440ec93f4470114983981b7107f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520282, "uuid": "7d9a07bf-f1cf-40c2-9a6c-e43f85fb75ce", "comment": "Malware payload (Dridex)", "value": "660736dda54e0289e744f154b1e18f6e12e03012", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520282, "uuid": "27ab4ffe-97a1-4db7-8200-a0ffaef55ffc", "comment": "Malware payload (Dridex)", "value": "8c5f551cd0a72ab360868103069e7ad1a13bc0546280061bc06d762f6da3e92f8546ad3c8b917bcdc18082b95d9767d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520282, "uuid": "e80ac942-e348-4732-b340-01ee0b2e966a", "value": "1AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520282, "uuid": "15bce262-a506-4733-8592-eda628990053", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520282, "uuid": "4cb0f891-0b52-45ea-ae39-1425a531060e", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520282, "uuid": "c5d7ea14-5f4e-4cf1-81d7-43cde98ec0e0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520282, "uuid": "bbe0fc4a-02cf-4cc5-b1c5-97dc521108f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520282, "uuid": "708532ad-ef1e-4b41-aa6b-071416b9b817", "value": "a2f41f04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d16020-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544939, "uuid": "15a64d65-36e6-4c7a-b16d-b391eb727993", "comment": "Malware payload", "value": "4bda063197b07ef07c065dafd62ba535", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544939, "uuid": "02ee743d-8bf5-42ce-8c75-69e517c4f1ee", "comment": "Malware payload", "value": "4b8ba20fd50dda664ab773213a220c6e187e4a6b541ce75979665d8dc8345cd1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544939, "uuid": "43291406-bf12-4649-991b-553f2288fc1c", "comment": "Malware payload", "value": "6afadf478e7258b6ed6f66f06cb327e6877124bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544939, "uuid": "8429f6df-85a6-415b-b799-0c84268ec7ab", "comment": "Malware payload", "value": "2266622e9b148c97770ef49edd2b6233392916e14d959d5ed1d419dfc557b256e8109203f9d1295dd2a36659ae987f84", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544939, "uuid": "6c49cf94-4e18-4639-8f68-5ae6c4b8d34b", "value": "6EE42370FA0ED44D84E2FE2770D01A68532AD170E761DF3A0D9AE49D9114AE28F45EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544939, "uuid": "c1c5786f-e26d-4b61-8c55-7bd11d076a69", "value": "12288:zkJCgIq8Js26xwH6oMJDZPpMdQKY2TqtjV89e5LAa9etaQW9HAv+wfpLBBrZ:bq8JJ6CSDZhDKY5tjqc4E392dZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544939, "uuid": "b347ea5e-edb3-400a-821d-efe1005bd461", "value": 683042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544939, "uuid": "b80776c0-17a1-48af-ab72-c1c2e9463ec2", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544939, "uuid": "574edf17-2ef8-4e45-a229-623dd38c9241", "value": "4bda0631_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c56a0b2-b986-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527148, "uuid": "ef1dd341-63af-418a-98f2-43be5a476acc", "comment": "Malware payload (Dridex)", "value": "3d6d66a98717fac9b53730ae2002b444", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527148, "uuid": "c717f565-ce37-47a5-863a-d4eb84eb73e6", "comment": "Malware payload (Dridex)", "value": "4bb487c588d108f926bd3be1deeeca8c49d71092ed3eec07edd7dd6ec671efa7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527148, "uuid": "d5c1baf8-a7b8-4cb0-a2c2-c61794d6c71d", "comment": "Malware payload (Dridex)", "value": "8f9f5dd78ccaa06a81c1ccacb2b5073c2a35bc56", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527148, "uuid": "3a9558f0-d1e1-42ee-b04b-7c8b9a436655", "comment": "Malware payload (Dridex)", "value": "7f501d69540b7f42d9aa85247d7a0b19cd8f569f314d0a91966333363116d251d4641c601c8a7c087f584a38ccf381f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527148, "uuid": "1faca8e7-bb79-46cd-8525-ffcf38cbfee7", "value": "E604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527148, "uuid": "479f1551-719f-45d3-be63-49a6b484a8dc", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527148, "uuid": "093512db-a07e-4918-aa17-a55e9950652d", "value": "3072:4i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:4H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527148, "uuid": "5865fd85-d008-4fb0-8a85-cb76aabbb068", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527148, "uuid": "dbd1f3bf-c90f-43dd-b7c8-2ca103e58c64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527148, "uuid": "6760ccde-f85a-41f5-a5b6-d0f51e5584be", "value": "3d6d66a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07494ae-b9c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554455, "uuid": "3bf7db34-0c75-4d1d-a6cd-16a540bbf236", "comment": "Malware payload", "value": "2d426916f7e6dc7313965b303be69c19", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554455, "uuid": "d97780d7-043c-4ed9-8fff-d11792065915", "comment": "Malware payload", "value": "4bbd1d8d48b693d00855dfcbf2bace23d9fd29418aae22c13bd137185ffd388d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554455, "uuid": "82600108-660a-428d-a33d-c1dbf4b2ef7a", "comment": "Malware payload", "value": "007c37443c1b65163db9673ad45538a86a515f9b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554455, "uuid": "7f03ebe0-19cc-4224-a1fd-23e7a2e2df71", "comment": "Malware payload", "value": "2d0f30f18a39ff9039d4428d4a0911df520bbbccef9022e0e41cfe8615d9b6f646acfeaa83673cd65580927a9f5ad7f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554455, "uuid": "626e14dd-7702-4a5d-a930-51493e7174f3", "value": "B204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554455, "uuid": "2901c75d-8e31-4fad-a1ed-0d46de79f864", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554455, "uuid": "266a06c7-f6a0-48af-8799-504bf7c695e7", "value": "3072:9V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:9V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554455, "uuid": "4f6850cd-70a7-47a3-9bd1-75a2bb470a24", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554455, "uuid": "d1e772fa-cf53-4e0b-9b64-fafe692f562c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554455, "uuid": "db42cfc2-a459-4f6e-bcea-520c67032615", "value": "2d426916_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d89bb9d-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535391, "uuid": "f29a8602-eb60-4f93-b4a2-ef0dbc2eac7c", "comment": "Malware payload (Dridex)", "value": "9e34bd33711ee1a39d524d7fad19ec3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535391, "uuid": "380f27db-fa09-40fa-ab9c-c43eb64faa5c", "comment": "Malware payload (Dridex)", "value": "4c14339582626243b03f8a444026a02351834bd11c4ab54fe05fe0b3817fac7c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535391, "uuid": "7e9aba58-2b08-4ae9-8d84-2327e52cc390", "comment": "Malware payload (Dridex)", "value": "a6f2bc178788a9cecfd55154eec05d0445fdcc75", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535391, "uuid": "57077a06-1d6d-4f7f-9523-179afe48bee8", "comment": "Malware payload (Dridex)", "value": "43f99fe5d57d8e2637c543dba646e69a524fd1c6053cd4be1ddad736de071ca11f9540ce19411c71c969e34e0a3175d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535391, "uuid": "eb1e807f-3170-45b1-970a-9409c33624e6", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535391, "uuid": "5b754f8f-66c0-4d6f-ad5d-391f129dc082", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535391, "uuid": "e9c7977c-588a-4d65-9855-699e20583647", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535391, "uuid": "f64d0410-ad9c-4a97-8498-3a208e994905", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535391, "uuid": "f913a7c4-d586-4711-91c1-90cf5997d01e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535391, "uuid": "94fad379-1755-4c3a-9f0d-5bc7d7e65c10", "value": "9e34bd33_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4d4e75-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534345, "uuid": "b7efb3f8-9f58-4d2e-96c9-82b1861374f6", "comment": "Malware payload (Dridex)", "value": "db38247d0343a853d6ef411cc3d7c5cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534345, "uuid": "628f30f0-6761-4bdc-b4a7-88159a0a2627", "comment": "Malware payload (Dridex)", "value": "4c596e977abd5ccbb53d0f98d0e1a306f60d67fe8962552dd21d554a31b91322", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534345, "uuid": "76fefb5e-74a6-45a6-a08a-871886413fa5", "comment": "Malware payload (Dridex)", "value": "771cb2b836a2cb150c6288340abaf22bc8291ed3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534345, "uuid": "7caec710-0585-48cb-a1ca-ead5cbf4250c", "comment": "Malware payload (Dridex)", "value": "54334676b1ff5a363d34fa4dd94d9a2d1d54b17a2ead53c72dcaef2b7999704d8e459b1fd534866ef50572c18edb124d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534345, "uuid": "3e9e975c-ed91-4ea4-a3a8-d953260b90a4", "value": "3304BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534345, "uuid": "de49ebe5-f040-4a37-9d8b-b3558ad6dae4", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534345, "uuid": "c14a1696-4277-445e-b6b8-90ab6cb01517", "value": "3072:Ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:JH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534345, "uuid": "62666c6a-7182-4752-9fe5-638f636c0e51", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534345, "uuid": "ec3c426b-7360-4442-a29f-4e44a212b109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534345, "uuid": "084bde7b-3149-4dfa-bbfa-67560ec99e69", "value": "db38247d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2847a70-b944-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621499026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499026, "uuid": "93c21588-1e8b-4d45-9e47-f30eca81f797", "comment": "Malware payload (Dridex)", "value": "29dbb2815c775dabf717871fcd8d0316", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499026, "uuid": "772d7903-1893-4208-ae34-1fd75bd0545d", "comment": "Malware payload (Dridex)", "value": "4c59d278650d02288c681d5306dc8ed3bf99f77ddb6be6e54434a9c911917595", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499026, "uuid": "17e32fe2-f032-441d-a211-6986e3f808b2", "comment": "Malware payload (Dridex)", "value": "417f3f67bcd72f434239b3548dfee99f7b95a4b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621499026, "uuid": "0b7efca8-a00a-48ba-9e1a-bb2f886af122", "comment": "Malware payload (Dridex)", "value": "f8f44af1c66668519167029252289d51499a90670ff918d1becec058b6f6252c659b425fb92e126f1a383ccf58b1a298", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499026, "uuid": "e68eced6-9a58-459b-8eb6-5c37d8900593", "value": "05F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499026, "uuid": "b0143a6e-7efe-4146-951e-6eeddbd2982f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499026, "uuid": "045f8f6d-d051-49fe-843f-f262b9d18108", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621499026, "uuid": "5c41ca14-707e-477e-9642-91c49c222f68", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621499026, "uuid": "d8aa3bb0-0cd7-40e0-82aa-bdd3b845353e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621499026, "uuid": "c32756ca-a56c-4645-8aa9-2d3ae70195c3", "value": "29dbb281_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bbae8b-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621533021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533021, "uuid": "d3df9415-a363-4198-8006-5c6148b82fdc", "comment": "Malware payload", "value": "542ac52c4d78fc0438756572bebbcf7e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533021, "uuid": "81adfa65-7f1d-4b96-a5aa-13c09b826447", "comment": "Malware payload", "value": "4c62c2ecd995bf191bb07ef249faea4c1f1f1e05a60fcdf60743cbd4bb9dc4da", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533021, "uuid": "53410497-136a-41fd-a796-12c7f6b184d0", "comment": "Malware payload", "value": "555feeac19216ee1d054209cb976a57c82aa88a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533021, "uuid": "f5eb525e-b636-4e41-a1cc-8bde88add394", "comment": "Malware payload", "value": "179fc289da8302ad0f7e0f351166fef342d655926d01db413dd647c0696fd5f564cd05ef07a2f8714adbc0af2c8e892b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533021, "uuid": "bc1110f9-8763-4d12-9142-1bab26213c76", "value": "57C4F13622D92F4AE57EAB79153010100BFBF499E736F70E3E9554DE49A7F0086B1B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533021, "uuid": "b9e8ddeb-bde1-4bf2-8d5e-de9135d1eb4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533021, "uuid": "a326047c-989e-4eca-b8e6-ffb05cfe4d43", "value": "12288:5JxoEKzlYlPKleAjcLTfPyz8n4CF7A6C6V4xsE9H:5uzGPmeAcvqYpAxZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533021, "uuid": "89fa69eb-efa6-4b25-8dd8-a097bed108e3", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533021, "uuid": "235890cb-7873-4412-b78b-a67610c57c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533021, "uuid": "95f4e85d-0db2-4cea-9c27-0eea17ffdcc9", "value": "DHL Shipping Instruction_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ae749a-b932-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621491354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491354, "uuid": "f133f8c1-3ffa-4cce-bc53-d824028daeb6", "comment": "Malware payload (Dridex)", "value": "14761b3a8006e6fd5b8f47c2a557e3be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491354, "uuid": "67775eb0-f94e-4886-aeae-66cf5e12ef1e", "comment": "Malware payload (Dridex)", "value": "4c8952a847cb9067962210f3946e6c225f89b409240c455fb2c27e41f2368a93", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491354, "uuid": "07ebdf2b-8521-4383-8b73-809af3bcc5fa", "comment": "Malware payload (Dridex)", "value": "64e1d5fea962bfb80aef476b8c51aad69ebc9708", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491354, "uuid": "fb06a70c-7894-4b10-a131-43b6d57fdaa1", "comment": "Malware payload (Dridex)", "value": "1de694b86e0b180082c21acadc12a1e249e1957f838f8801caf0810033f6eadbfe927e52bf9e1c7d3c24c478a236915a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491354, "uuid": "6e4049c1-af4a-40a9-a89d-860adb4a8c9e", "value": "CAF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491354, "uuid": "a6c46940-87cd-40b7-94c5-98565a0ea68f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491354, "uuid": "09bb1b8f-0228-4d88-b72f-662f6a33e39f", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621491354, "uuid": "ec899e51-9d14-4743-93fb-5b3e1aed87b7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621491354, "uuid": "9cb02e4a-c05d-4333-a5e3-555b04633893", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491354, "uuid": "80fd4430-4a67-4a4e-86ee-84461b2dff21", "value": "14761b3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca89c4f5-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472438, "uuid": "601ce184-9522-40a6-9ac2-e2bdef09014f", "comment": "Malware payload (Dridex)", "value": "04a2e7504b9a4027157cb7b3ea1ba717", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472438, "uuid": "15e5058a-1909-4d5b-8bed-f549125569ab", "comment": "Malware payload (Dridex)", "value": "4cb8bfdcc3a2e4e9ef0a1e086c76150b15236e0e0416b59f774b73fbb0cec64b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472438, "uuid": "6990971c-9663-4461-9040-39ae88183c7b", "comment": "Malware payload (Dridex)", "value": "cedecdf00465841ae8f7aa6d6421a0aa2efe49a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472438, "uuid": "8755eed1-ed4d-4162-83bd-5fa160f06f5f", "comment": "Malware payload (Dridex)", "value": "498cf735c998e556ea315723b2a770001e41b6b00b0af6ac0f6a22adb3f1d8474735e977ee9f7d40d7bbfba24992b919", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472438, "uuid": "45ae7448-6b1c-41c6-b162-052e90e55215", "value": "8CF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472438, "uuid": "7aedd63f-8237-4b5d-80ac-07d665ee508c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472438, "uuid": "34c37363-c85a-407c-8645-6827c6f903b6", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472438, "uuid": "11c37c9b-ed8e-4a9d-83c9-628a9f9b9f9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472438, "uuid": "78602ca0-58ad-4462-940b-a18634db3721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472438, "uuid": "1a52aa0f-5e78-47e3-8be3-afc32cea5bd5", "value": "04a2e750_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3fd288-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "827a2f44-cdff-4be2-8ab8-22e33f8f1643", "comment": "Malware payload", "value": "e5b3adf5836aaa754ed76ada10c4cfba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "24e2bfef-1ddc-4c78-bc7c-ccd810eec7d0", "comment": "Malware payload", "value": "4ceadffd208ce23b5ca2f3aa752f850663f707277c590456c7a9aea2b11c8cca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "c16bb7ad-8257-4da0-ab89-c76b63985c35", "comment": "Malware payload", "value": "d0d2ea57319dd33b7d0a603335dd7c05d56b77d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538775, "uuid": "06fc0e6e-fd6e-4fd9-9323-0dff63f4d390", "comment": "Malware payload", "value": "da06d3fa4c6bd30ceb00347f2f85b4b64d3ad7b07748d817c91c90311f242a71f65dae3ece32524414ac999c7aefc888", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "6be3b7a6-a5d0-46ff-9e0d-a765f8fe4143", "value": "5A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "34ed2192-00ea-468d-95ec-8eecd3101468", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "c576ab06-44e6-4464-9828-a33956f96481", "value": "3072:Fi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:FH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538775, "uuid": "a8388db8-aea7-4b06-aa8f-1848f624ac01", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538775, "uuid": "97e422f1-79a6-4c75-b3a5-936cd14dba3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538775, "uuid": "860f0840-f0fe-4122-96af-192550eaf02c", "value": "e5b3adf5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007ee428-b94c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621502164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502164, "uuid": "f267aa70-35dc-4e3b-a5ef-931c6d79dbac", "comment": "Malware payload (Dridex)", "value": "290b972242bd89a7c83359dd1977381f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502164, "uuid": "45af8c4f-0be8-4be8-89eb-386d8fdfef06", "comment": "Malware payload (Dridex)", "value": "4d08bb096f9a682eacc216136f0d5a68fb7ba7965d45647451411dd5551eaa94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502164, "uuid": "b2eaedef-9828-4190-a8f2-07deab794aff", "comment": "Malware payload (Dridex)", "value": "9d66ec79237fc8d373420d1e45119889662d7a1c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502164, "uuid": "61659753-e11d-4e6f-8319-c991413776af", "comment": "Malware payload (Dridex)", "value": "6035b3d8f30c9158877eef5de918a1769896693b06bb60401b2b5ee2d7be202b96c638fa17f2b083ae606cd9e3314dc1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502164, "uuid": "e0f231eb-0a9e-4cd0-9f8c-600bf89bab99", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502164, "uuid": "412ac481-6491-4a2b-8a2f-cb8bcfe9a034", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502164, "uuid": "dccae8ce-e6f9-4eea-8475-d5acc9b82f53", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621502164, "uuid": "509f248e-f160-482d-af9a-5b5eabaef5ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621502164, "uuid": "6159ca97-4667-49c3-b94a-12a0959f12a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502164, "uuid": "31a6f847-af01-44e1-bb14-a47e1f7a271e", "value": "290b9722_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e95aad5-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621523260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523260, "uuid": "63c723a7-826f-454c-bfa8-b7de55db641e", "comment": "Malware payload (AgentTesla)", "value": "98fd49a293efbf30152257f76b843672", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523260, "uuid": "dde0c9ac-24f2-4bd8-92e1-0aa3aba99525", "comment": "Malware payload (AgentTesla)", "value": "4d2e234a44120cc6c223a72cc80e1a96a34dd38e1fa55900188bf6f0e668ebf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523260, "uuid": "52a60f6c-17d5-4167-a3fb-14ceb10799d2", "comment": "Malware payload (AgentTesla)", "value": "1c0e21be03fa5f6a93c318c3f53f0c763cda5941", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523260, "uuid": "723811b3-aa52-400f-86fc-734a22fda61e", "comment": "Malware payload (AgentTesla)", "value": "547baa4b041ae5cf8fbb3abefb143d799e8ff5d7878c16c81ef09dd78489023643306e23b8babbddcf5d2692b5111c57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523260, "uuid": "34546e56-0847-41a5-9b99-4b0628afdc52", "value": "74642217BB684C64D8A042FB809FD551B3F07B468D325E1E394CAEA794277319B08BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523260, "uuid": "1b2c7ada-c5a1-4a93-b5af-5698c41823d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523260, "uuid": "93256e45-af52-4741-b19d-4f0e9a88864f", "value": "6144:/VkHlsLH7R2V++sjamCaG/7Z3cpv923oSGpXttdNNO7yL3O:/9ZAkjyDZ3cddtfNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523260, "uuid": "3259b0b9-3628-4a92-834a-3d2d4262c871", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523260, "uuid": "08e834a0-706a-4812-bf98-1dbaf5d27b5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523260, "uuid": "0f2f8ffe-be9f-4abc-966b-17ffc67b736c", "value": "dhl teslimat hata belgesi Referans Kimli\u011fi 671051984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184bae0e-b9ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543006, "uuid": "2c6c1918-8fae-49b8-9332-5b8cb071b293", "comment": "Malware payload", "value": "2fe2352abe5afbea4f10a2db073d4cbd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543006, "uuid": "e1f2f5aa-7aba-4cbb-b85b-e1bc7bc41f5a", "comment": "Malware payload", "value": "4d55038e07afbd4c728cb270e2cd622e8b5afc44bd541c61a448bb3ec88638b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543006, "uuid": "19419fea-8ed0-4608-b66d-ec8613021c34", "comment": "Malware payload", "value": "d7f23eaa22d232d0b76fdb74be6e41eb13ee304e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543006, "uuid": "8f763d1d-1dda-4baa-8686-09eccb5f2e27", "comment": "Malware payload", "value": "b86e51339ab000eb02dd68779a4a026f9a967f4449dd21cf347e96f68568ea33e4da0082370b628f580781adb675d7f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543006, "uuid": "f22f292f-8e0f-4104-b070-cded1fca2971", "value": "EE04E0D0C6C62687E4A7DA729CC17D2A57356809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543006, "uuid": "3b434814-854a-4884-90da-48cc98e24278", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543006, "uuid": "5fc1b0ea-b691-4ec6-b3a2-b03492af4a4c", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543006, "uuid": "d59e3ba9-311b-45c0-999d-a113da322758", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543006, "uuid": "93b02101-8eea-4030-9ff3-e8dea8337429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543006, "uuid": "15de99c2-415d-4d0f-a147-57bf36ce1d10", "value": "2fe2352a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef60387e-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533918, "uuid": "82fce596-1d63-450a-95da-36abbc19c448", "comment": "Malware payload (Dridex)", "value": "ab83382d2326abf808a71fde78086550", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533918, "uuid": "40c21f13-fc8d-4680-b6b6-b52e3058786d", "comment": "Malware payload (Dridex)", "value": "4d55d4f12426631a445e3fa26ddae3e11646a86c71e8ea74aa24ab4602f62748", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533918, "uuid": "d253a99f-27b3-444a-a707-ec04d08de7b1", "comment": "Malware payload (Dridex)", "value": "22dfbdc50f75a3cea01070a29c25cec938b84852", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533918, "uuid": "a03722e3-f38d-43bf-953c-ca34c4ffded4", "comment": "Malware payload (Dridex)", "value": "b23cd47b0f4267ef67518a5788c817eec790c9b7ca49b9dcf89aaee1241d63502a4d814c3981235e40dbb2be717883d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533918, "uuid": "ee96239f-2b7b-403d-a708-70d0b810a8b9", "value": "E604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533918, "uuid": "57610077-d406-4e5f-ace3-b22268ccd20b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533918, "uuid": "924ccd6d-66ad-49a4-9168-fefd5e55ee9a", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533918, "uuid": "c8bc6ac6-8942-4da0-a303-580f75c42381", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533918, "uuid": "4314da30-bcaf-47fd-9075-7cba3fac02fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533918, "uuid": "32ae37fd-2b87-4201-84a6-d39e20ababf7", "value": "ab83382d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1746e1-b979-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621521698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521698, "uuid": "55097ced-8cd8-4cbc-bdef-d988b55af996", "comment": "Malware payload", "value": "ffe15a5e40dfc3826eccbc6c3c96797a", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521698, "uuid": "86f034cb-8bf9-46af-b773-7fc6a9e79177", "comment": "Malware payload", "value": "4d583ef21001c083908706199a1b0eb09f0d9f70380e3f5c68c3557e4d9a5b5d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521698, "uuid": "e3c840ec-c30d-439b-9c4e-6d0e41ce914e", "comment": "Malware payload", "value": "89c02fc7391889ebc85ac2fd8df588b627af7414", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521698, "uuid": "c852c056-4d24-40b6-84fe-6621a6cd9f89", "comment": "Malware payload", "value": "376d221c6642ec5f62f3f294dda069d4a557e1db10aa87cb10f5bc800951c28d8db1bd368781acb969df039fbc745bef", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521698, "uuid": "e51d5282-aa21-40ff-997d-71773951fc67", "value": "99117D30830466A10D2013E6F615B996F101002B8DF27F6473CE9ADBDEA978D6BB4FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521698, "uuid": "6d3a5b43-19aa-4074-9938-d70e0aa27185", "value": "12:zH/yDvqTuP2rEBf79n4sZnM/4dgo/V8a6mZE8OO0JQxutzxeomdWXbR8sys1yslA:mDvgu+re79n5ZMmgomaiRJ48mdWXFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621521698, "uuid": "d1826b2e-6796-42d2-86f0-e6076936ea90", "value": 938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621521698, "uuid": "5c33e430-39ad-4612-90c3-b688a26721d4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521698, "uuid": "32f82dc3-1657-409a-83d3-714732414b73", "value": "aT2jrudb.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc219bb-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524382, "uuid": "e77224d0-2709-49f0-9285-70e7e060c822", "comment": "Malware payload (Dridex)", "value": "bbd89c9ea564cf62a6893506a73cefd2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524382, "uuid": "d98ec140-863c-45ab-bae1-9df93a976edd", "comment": "Malware payload (Dridex)", "value": "4d8dfc779223912518d3840e3ec51b5d215073ce0ac4b64f1010b0761c566b6f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524382, "uuid": "42eb7ed1-84a7-4169-a445-6f4b2aaf5c74", "comment": "Malware payload (Dridex)", "value": "a62cad9de81d41bea99e5a9a195f1a22e4e77256", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524382, "uuid": "f2562a8d-bbc9-4af6-b8aa-90097d5bc668", "comment": "Malware payload (Dridex)", "value": "42f0d0bf1d6491f892f425e1255b4f4140428c797337dfa90c42a9cab6f9d7e22d284f4684d794e339b3100634d547c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524382, "uuid": "ec7617be-8110-4b09-9513-d61b4278ca24", "value": "8004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524382, "uuid": "e8c00a7c-7309-42aa-a0ca-bfbad51f22f6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524382, "uuid": "904aa864-1f8a-4fa4-8c59-4384fd5f6573", "value": "3072:Hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:HH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524382, "uuid": "d610f315-d76c-4c5e-8589-9b4fe24bfe76", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524382, "uuid": "e772966e-b5b0-43cc-9bba-41c8e5cd23fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524382, "uuid": "705c156d-f5de-4510-98ad-1a5333601240", "value": "bbd89c9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58056f4a-b9ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543972, "uuid": "84bacbea-1c27-4c2f-80a3-09ef22eddf32", "comment": "Malware payload", "value": "0c00b0c45810b8a56b4b0f4bf6aa9113", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543972, "uuid": "ab730e7b-e82a-4038-af1d-8e774530009d", "comment": "Malware payload", "value": "4dc5f17acdeebdf1619248969e9b1b26fe75b9c687324844609da9ad7ecc64cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543972, "uuid": "91b229c4-4c47-43e5-a0e6-691044230cfa", "comment": "Malware payload", "value": "35c17f4b4e66c8b8e3d0682ddd28b33dff8d3c08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543972, "uuid": "02574bc6-f64f-4f64-9d57-524deef160b2", "comment": "Malware payload", "value": "54ca077c9661ac3ae28c5635058ed982149d61049d2c3704634b77d8520f6cf641c704d8a158c72aabedc577e3ad430f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543972, "uuid": "4152ad8e-6c7a-4fba-8134-479b658268d6", "value": "9004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543972, "uuid": "b29a1d80-0a52-41c8-af39-5c8a43574084", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543972, "uuid": "3f854fbe-8832-498e-9571-11abc1d075df", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543972, "uuid": "ac5b9bb2-d476-45c0-b42b-d85f9df23f16", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543972, "uuid": "0a33bfac-47b6-4563-97ea-f5ee4e8e2247", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543972, "uuid": "b408a2ce-300d-432b-9632-844e28e428e9", "value": "0c00b0c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f37ed83-b9b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546937, "uuid": "982fabe0-53ec-40d7-a211-b3ac35ce7d3f", "comment": "Malware payload", "value": "cff206f9928e4cf1d8a6a0ebcf402b31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546937, "uuid": "e9366c0c-e36a-4b4f-acbd-e8d131c267a4", "comment": "Malware payload", "value": "4ea8e672ce23dababb20992bc412b0843e2a5e6fd4664640b6b2f217eae5f54c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546937, "uuid": "84027f3a-8666-4ace-bc80-0baffda0c9bc", "comment": "Malware payload", "value": "946c12251737a568ae3d8b210d3d277cda4350df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546937, "uuid": "233db204-8797-4407-b99e-44de80b95eee", "comment": "Malware payload", "value": "4d58ba8104f180bb8ca7d35af3a3abfe9a8b8faa52722e7bbd2e487b0521ac42dc33b6f5b5114b0f0ae6cb5a3c98cc13", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546937, "uuid": "490ae23f-15af-4bdd-81ac-f19b61ffcd45", "value": "DB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546937, "uuid": "90d24db3-0f27-458b-b51c-9f8e4aef19d7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546937, "uuid": "7ed817ce-0bcd-4442-8bc9-bf38b994634d", "value": "3072:AV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:AV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546937, "uuid": "f6c8eefb-42f5-4746-a3c1-21bc1635fa4c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546937, "uuid": "e10277cc-cd77-4c17-b9b0-9210fb8f28cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546937, "uuid": "790361d2-74f8-4b9e-b734-37b000bdc101", "value": "cff206f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9224de2a-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534620, "uuid": "b31b73cd-c79f-4c4f-bedc-aa7cfc0986fa", "comment": "Malware payload (Dridex)", "value": "b8970813a94696e3957631a98bffe9f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534620, "uuid": "00c5c61b-d08d-41de-95fa-6d173901948e", "comment": "Malware payload (Dridex)", "value": "4ed37689fecef8bd06eea0d965b60c0291ac403e4f48892b944c3188645005d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534620, "uuid": "1862be7f-68a6-4e7a-a976-7087ba9624d2", "comment": "Malware payload (Dridex)", "value": "49e73b9b580b2490625f711861b4fb326ad67c3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534620, "uuid": "f61a6c26-869b-4ef3-82d9-974418d72a7f", "comment": "Malware payload (Dridex)", "value": "0cb72e433e8d6cd737a6e073d952d6bb5c0be250b1a8b6b116cd7bc03292c997e51d99d137078dbbca91b37823a9d1c1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534620, "uuid": "bda468f3-4810-463b-b13f-7ea7468074d4", "value": "D604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534620, "uuid": "fcf2fad1-4c28-42a1-95a8-037bf354459f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534620, "uuid": "d370addd-80af-4b01-b42c-613ce35d7f78", "value": "3072:ii49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:iH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534620, "uuid": "b04a2b90-a70e-4b3d-8de1-3b4d87a80fa5", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534620, "uuid": "55b3456a-838f-4632-97c4-11fa7fbccaa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534620, "uuid": "8d60c226-73c0-4042-a060-00d810b17761", "value": "b8970813_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20942a05-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534430, "uuid": "25ec8783-1272-46ee-9d69-4b3e7d6c6cf0", "comment": "Malware payload (Dridex)", "value": "910f91949368d7beb01d8ca87a2f5ca5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534430, "uuid": "5fe7a188-eaee-4b16-8ce2-6a1d4f7c51e0", "comment": "Malware payload (Dridex)", "value": "4ee95caa62400c90542b4229b0985b04f015eb03d6ed6f597921ea35fc081e3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534430, "uuid": "a7085b23-8c4c-4bc2-9757-7749ab9f9a4d", "comment": "Malware payload (Dridex)", "value": "f50b2c60e4f96e15ca170bddcb55860dda8dd3c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534430, "uuid": "45591f08-ac57-4e1d-ba14-0a6acc37198b", "comment": "Malware payload (Dridex)", "value": "664380d7f5386660f1f7d4cae38eb119adbc82888420611e381d6685a2ebb0cce7a65ceb7566d9e352f3c5c75eed23ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534430, "uuid": "a7bf5a3c-c297-4257-8550-4f76bdc9f0d9", "value": "4004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534430, "uuid": "4d4ef519-9747-47af-9629-d158fc0dc18b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534430, "uuid": "4766ea1a-856a-40cc-9516-9fd5f45e0d62", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534430, "uuid": "9f0a3843-2352-43da-b9bc-cb1b579c47f5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534430, "uuid": "ce39b8e1-2cf2-49a4-896d-0308563346ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534430, "uuid": "0083d96f-3713-44ef-9fdf-dd37096bffe6", "value": "910f9194_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707bcd38-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "95eebfbb-c9d3-4276-a630-b3e50c886ee9", "comment": "Malware payload (Dridex)", "value": "7df7a8c3cf1d3fc4eceb087c4d7c1cdf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "ed90feb3-53d4-4df6-a0aa-3926df9409e3", "comment": "Malware payload (Dridex)", "value": "4f11760e52b3ad525630ad12f9687da19f3810d48bd7a585bd7270d82249a581", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "899f22b4-1780-479b-9dd5-7b8d9841b054", "comment": "Malware payload (Dridex)", "value": "699211bfe09c591c090ac18561f5e8e0924c3de9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532846, "uuid": "278c2a83-a8c6-446f-9535-9864b7fbe68d", "comment": "Malware payload (Dridex)", "value": "818d84303a0da19dec8b56a0b7a33e2a6ec147218a1f7df5cb808baf221f32862a26fce5b970b5547b39fa5d54e716c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532846, "uuid": "31c89355-38f5-4b61-88b0-09d9e1dfd1a9", "value": "5704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532846, "uuid": "4989774a-6bc0-432b-b1f9-4b72b6f21699", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532846, "uuid": "9318cff1-bcc0-49c0-a247-e47ebf61fb31", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532846, "uuid": "dbc7ddf5-42d6-4a49-8af3-efb3227aa334", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532846, "uuid": "e8f049ee-b258-4305-882f-600add918bde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532846, "uuid": "f7c08e1a-8f18-4d0e-9688-386f00a5e302", "value": "7df7a8c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0975999-b9b7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548442, "uuid": "43225c37-a00b-4bbf-9d91-628ab37bc8cc", "comment": "Malware payload", "value": "189f9123a58c7cf469cb644b1ea6d027", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548442, "uuid": "96d855c9-0be6-4b66-ac42-5553cfb86e65", "comment": "Malware payload", "value": "4f20a39d9f4c990afec4adc567b19d454ccf22c507dcd45e42282fef839df5bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548442, "uuid": "b526e141-5fcb-45ca-94a6-bb83e86c098e", "comment": "Malware payload", "value": "d676e9131bbba3176a0beed1b1c53708df19e28e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548442, "uuid": "a3fabe4f-2799-4539-8a96-e40795a7a866", "comment": "Malware payload", "value": "7763c5a69f782dc39d5355f48c9a6c26d1c79cd22fe01df4fcda7ff90ea849ea3b37e7c5622f521a8a748cb1e2cf9e85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548442, "uuid": "74246572-81b8-45b0-bd0a-d842b87757f2", "value": "0404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548442, "uuid": "36cc5a86-6389-46ff-ac98-573534453cc3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548442, "uuid": "0606439c-cd07-4374-8d6e-455f3c5c1e2c", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548442, "uuid": "7e3f15ae-763c-40b9-8b11-85fb528c9bbb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548442, "uuid": "b4842f42-f034-490c-9c26-83e38ffccd79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548442, "uuid": "396f725d-4049-414a-8e30-60c4b1c8ca3d", "value": "189f9123_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89eb41de-b9ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543196, "uuid": "c8402143-09ea-4a32-a971-293e994b0eca", "comment": "Malware payload", "value": "bd791cf705afe42040ab1e20f68b5189", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543196, "uuid": "d00cb692-62c5-4f7f-8345-05c3a2f58fc4", "comment": "Malware payload", "value": "4f3a0f8d6478c3f405c6dbfc99612005b5969650b25f5b8080a9ada44e7c8d20", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543196, "uuid": "781eb3d6-ebd4-4ba4-8df0-1d8fdb4ce264", "comment": "Malware payload", "value": "8c6e3532200725919ca0f03a643c3566a51503a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543196, "uuid": "3dd97ec7-07fd-48bb-886b-e885748c4930", "comment": "Malware payload", "value": "fb152a670c2add7f22f2528b67ea430c480d9914f55c7fd4dac10137f0d379dd8d495917cb27f4734cbfa36dfda5b6f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543196, "uuid": "eae5cc7c-8e1a-45e6-8a71-0f9f797b7bc4", "value": "F904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543196, "uuid": "3663d794-11b8-4e4d-b960-059e7c2585df", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543196, "uuid": "452ae1a0-8f52-48b0-a68a-6775452a5fab", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543196, "uuid": "430f66e2-024e-4d47-8762-58eb79d0c1de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543196, "uuid": "8dc8c1cd-a2fa-4a04-a817-e5a230948adb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543196, "uuid": "497e3b58-7b0c-4040-adbe-a822c7ba90e6", "value": "bd791cf7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b7209a-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526701, "uuid": "2ca5d5f7-2be4-4fe9-889d-9297f5ffcac8", "comment": "Malware payload (Dridex)", "value": "c62e18253a8d4916a5f4cd01e8074c4d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526701, "uuid": "7d87eb1e-7a11-4e62-8938-6ba352f423f6", "comment": "Malware payload (Dridex)", "value": "4f5f323a6c2a2a5052911e8fce327b03aa4a9fa43e8f5caa6ad38421ee2accbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526701, "uuid": "8216feae-a7cd-4e2e-b715-f07e5ea7115f", "comment": "Malware payload (Dridex)", "value": "5b9a466755d99b12c52e4cb060fbff42f7320c95", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526701, "uuid": "93065011-455f-45e5-95e2-1c520701338b", "comment": "Malware payload (Dridex)", "value": "22a70306c90e2f9c6a3f0c2a677f94b4ddab094d633baa174260e01670c7c4de831b8317733ac97405564a1e82b298aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526701, "uuid": "93f4b349-444c-495f-b3cd-f8b266d60816", "value": "8604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526701, "uuid": "5871f6d3-6f8e-410b-8457-f3b843f573db", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526701, "uuid": "70a21b35-6ed8-4da0-85eb-905bca083c06", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526701, "uuid": "f37e4e05-dbcc-40be-b279-086b7894e9f4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526701, "uuid": "907e7e17-4792-4ec6-ac99-e2bfa8c56c78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526701, "uuid": "2bd6501c-01ad-43ce-8f59-4cad0b6aa498", "value": "c62e1825_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee55ea8e-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542076, "uuid": "583ce508-47c9-4323-befa-e9a5ddb48217", "comment": "Malware payload", "value": "33c19ebdd4c808087433fb6acf32cb91", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542076, "uuid": "7dcf42ed-198d-418b-8559-90d275e1281b", "comment": "Malware payload", "value": "4f608ac77a7a745cf870cadbd321d4ff78f511fbcb584d37f295d81742f41f75", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542076, "uuid": "c591d451-8408-47f4-b7e1-a69e5beaec23", "comment": "Malware payload", "value": "4873d459f878f7db8be673f18af011574e5e58df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542076, "uuid": "e3fbdc4e-b616-4927-8b8c-b6d68d60f1c3", "comment": "Malware payload", "value": "d3f2ea80aa948900338ad9687e748fb88fc0772c238e399cc5d0c39f44d46bfe1c3a74e14c5998c1065526e39916ca35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542076, "uuid": "4bc9cb38-b629-4f89-9952-32ef3ece9c18", "value": "DEF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542076, "uuid": "23f351b8-0c83-43d2-866a-3db159e49955", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542076, "uuid": "e96b0558-779c-47ea-a947-c733ab38f8e1", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542076, "uuid": "107215f0-44f4-4e34-9799-71380021cf9f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542076, "uuid": "999790b2-24ba-4f9b-bc9f-914c90e1be61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542076, "uuid": "ea30b7de-48e1-4b60-928f-ce7da3ac3f86", "value": "33c19ebd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c159e985-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534700, "uuid": "2f41eb5d-19dd-4b08-b684-8e97d08a921e", "comment": "Malware payload (Dridex)", "value": "1ef0ace95be188aafafeae45e2b6f625", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534700, "uuid": "aaf9dd96-bfe6-4ea2-979b-552b2a7362f1", "comment": "Malware payload (Dridex)", "value": "4f61d93c5a97536f664f1bb5ade9e7720b4569b1426c8ef10b3fe13b408f6942", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534700, "uuid": "33f56edd-1777-4e35-a1ae-d2a00760ec41", "comment": "Malware payload (Dridex)", "value": "4085d392de83f37bb4d3ca4dd40ad20ce5e1b8c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534700, "uuid": "060cf187-d46b-41fb-b7e0-094410b8e910", "comment": "Malware payload (Dridex)", "value": "95ca89d6dfdd167e47aeeb1a1f5ab4a0cb120be34aa9dc3283a00d5607c5224d33ecb764d29dfd00a29442904c3a730f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534700, "uuid": "9985d48f-d4cb-4507-a3bb-c411d71f0726", "value": "F904B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534700, "uuid": "5987d4b8-e748-4c1d-94e0-39b746774309", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534700, "uuid": "e2a1def5-eb56-41e0-860d-3df9b33e5aee", "value": "3072:bWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:bWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534700, "uuid": "f100489c-d5c9-4824-bbf4-c102b2a1cc92", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534700, "uuid": "d879aefb-6200-4149-8f03-4eaab7615ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534700, "uuid": "e0b05314-389e-4164-8809-3d7a105057fa", "value": "1ef0ace9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9932f36-b9bd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621551007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551007, "uuid": "da5fd18e-df2e-4de3-ba0f-3b1245803e25", "comment": "Malware payload", "value": "a5bd73d0c290c052952405a0900f2212", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551007, "uuid": "bcae093b-6338-4a9b-be9a-3039a52a745d", "comment": "Malware payload", "value": "4f70d82db2b411456718e8eeac588cb8a16be1ce791244b666dc4f802d829cbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551007, "uuid": "1dcfa0f2-3c7a-467d-ad60-2f8468839c59", "comment": "Malware payload", "value": "264e30d5398e01352202decf22c9b74bac20b666", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551007, "uuid": "962e9d54-c589-41f1-b5f2-7523bb55bc43", "comment": "Malware payload", "value": "d6475b148928ffc57c0ad1691a31db02cf6c4d777c4e7dfd84003978be424bfe97f14426c8287175e8dd0e6ad233528d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551007, "uuid": "03500443-334e-4057-bd2c-979a8ec1d5a2", "value": "0104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551007, "uuid": "c11bf471-9169-4180-b592-7e8c45a94bd9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551007, "uuid": "6f1d9c28-c26b-4b55-bc4c-1f3f04a73bcb", "value": "3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621551007, "uuid": "d4c2a405-66df-42fe-a96d-a26f50af661e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621551007, "uuid": "31441b64-55fd-4ccf-9ed9-487fa154c15c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551007, "uuid": "8e90f042-39ce-4baa-bd59-34915abc11d6", "value": "a5bd73d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dc87a7-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541423, "uuid": "9dfa2ba9-7016-4b54-b65a-f18bb9aa562e", "comment": "Malware payload", "value": "6fb2888656a0d5f6ba32fe24ba8364a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541423, "uuid": "90265379-a406-4708-b5e6-03c519fce403", "comment": "Malware payload", "value": "4f8d5fe83d328886b608192121a21c93fc95a09cb05ddca622d079c1926f5177", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541423, "uuid": "ff0de99b-a6fe-479c-b6c1-bfec4fca7406", "comment": "Malware payload", "value": "4eda0583f0a1f2d9c033248d7af2a6f5828bf46a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541423, "uuid": "e1c8fb76-2de2-4d60-b57d-6a27fa727b61", "comment": "Malware payload", "value": "77c43e07e7cdd17cdb57ff690133eceff04ab29202c25b7f5d8f0f340b7728d530cfb9303eec6c8e6f25e8a29232f7cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541423, "uuid": "9ec6ed64-2120-4e13-907e-82df9b0fe061", "value": "AF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541423, "uuid": "595c7028-cb15-4792-9aea-3c40c57ee279", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541423, "uuid": "f370efb0-95c5-43f9-a03c-598124fb7379", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541423, "uuid": "903f3514-a606-4699-b3ca-e447f2082068", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541423, "uuid": "8f8989ee-244b-44b1-8690-ca2eca990146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541423, "uuid": "8b0ccc61-782a-4234-9447-052491020038", "value": "6fb28886_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c17239-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533095, "uuid": "3bb267df-099e-42b0-8ba1-6acf8cbe99c5", "comment": "Malware payload (Dridex)", "value": "76982d282c4f3499ba35cdf47b611f6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533095, "uuid": "20bc0399-0424-43d5-b7f0-58ae16ff5944", "comment": "Malware payload (Dridex)", "value": "500a2cd875460e5f107096550d7c1132bc105ff18b9fdd14f44af2e45a73e2d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533095, "uuid": "18d9bd9e-163b-4bbc-9df9-33190c2a4fe8", "comment": "Malware payload (Dridex)", "value": "385acb09d487439fa7b73e67fb029be6d57c552d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533095, "uuid": "cd5478dd-2c4b-4fc0-b955-84130199ece7", "comment": "Malware payload (Dridex)", "value": "6ebd249d3154a3c2be549c9eb157d0078662872b082997078f06a378935fd1cbcf274487cf226da10d94d1dd8f699eeb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533095, "uuid": "1c15fbcd-9cc3-43c8-897a-99929f34365b", "value": "D004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533095, "uuid": "5b95b5c9-98ce-4a44-b1df-238e27a5b811", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533095, "uuid": "fbe74370-42cd-4a15-96d1-5bcbe0e8ddd0", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533095, "uuid": "fec6a9c8-4033-4f23-9da0-ebc1118971d7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533095, "uuid": "21dc4b34-1391-40b1-bbd4-a338face6ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533095, "uuid": "1e81975d-ad28-48a9-b0ac-2ab02a532a1b", "value": "76982d28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98eb771-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524030, "uuid": "f0f2f060-9e5c-419c-8133-11f03bb85ad7", "comment": "Malware payload (Dridex)", "value": "a76b907768aee6f474d907f9b03f452c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524030, "uuid": "d778572c-df45-491b-ae45-8af290f83150", "comment": "Malware payload (Dridex)", "value": "500a4078eae8ba0fe2a635d549336a06bee7f59ffd79c853ef31d704d0990462", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524030, "uuid": "5f10b610-0dd2-4932-9a71-975e9de3f610", "comment": "Malware payload (Dridex)", "value": "1cb0b03fd0f0cffd68e49d610aa2ce6391154e1e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524030, "uuid": "d2de8ec2-b187-424f-92a9-c7d7bb2b5d4e", "comment": "Malware payload (Dridex)", "value": "479601729266713149e7d82557e20c415a1cb7d3f74f1f853e1e5b01294b64c52f23e8c39af52f63aac79f51b2282f07", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524030, "uuid": "31421177-10f1-4fdb-90d9-cdbce5e0cbc0", "value": "4A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524030, "uuid": "9dac522a-0fa9-466a-9566-5441b6192aed", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524030, "uuid": "989b3f12-5110-45cc-bc96-50422340464d", "value": "3072:0i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:0H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524030, "uuid": "183d3153-e44e-4341-984e-0f34d28c91ea", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524030, "uuid": "fb53fa04-b437-4181-ac07-b3fe6118004f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524030, "uuid": "4aec95ec-d2b2-40aa-9dd1-a46aeb81ddc0", "value": "a76b9077_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b27d0c5-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468896, "uuid": "3a33174d-8cc0-409b-9de9-425329d37245", "comment": "Malware payload (Dridex)", "value": "3b43624c99cbe700b4d2aacc280e355f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468896, "uuid": "afc3d9c1-542b-4b5f-9a1e-cfaedaeaad17", "comment": "Malware payload (Dridex)", "value": "500a8f606f3958b6d791fd923ac2d05c4507564e7e09f8de7171439655f1fa74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468896, "uuid": "be0fc6da-5361-4469-bf13-9b8fe18812b2", "comment": "Malware payload (Dridex)", "value": "0ce70dd2572482c70493fc1bafd76c1f528b9d83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468896, "uuid": "a5fc4848-bb87-404f-b407-95b7ddd45398", "comment": "Malware payload (Dridex)", "value": "82ba7324795e26340e2b8b61ae52760d957544f17d8b7ab5f347ed1d76580d1b98e3708c5c689aeb2ea3c295895d4b30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468896, "uuid": "50d53589-862d-4ea7-a7bd-d8811e6d850c", "value": "A2F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468896, "uuid": "9deb2b8a-2633-4b2b-a71f-f29a94d4c79f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468896, "uuid": "abb5733c-f3ab-4abf-837e-224982468f49", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468896, "uuid": "57c07b67-af72-4919-a989-ff73f6db734d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468896, "uuid": "da153bf4-bc7b-4288-9b9a-d7a72a304cb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468896, "uuid": "790a346f-85e9-4356-9290-f7cff3a2168d", "value": "3b43624c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bb551f-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "306b66b0-a8b3-437e-b2cc-f935124601a8", "comment": "Malware payload (Dridex)", "value": "02c7c78f3dfce1295961c2355ba034fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "dc1a5629-4bf5-47b7-a2b2-fc23365e8d43", "comment": "Malware payload (Dridex)", "value": "501e7c1e6fda933e85de5731120ff39431e4a6539b0493babc3773f80558036d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "0ecf456a-b798-4078-8605-698f1e4527a1", "comment": "Malware payload (Dridex)", "value": "95c0105d7a7083b36a36f2a81801b3a5eaed0ee4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "963d676d-0520-4a41-99f0-8fc0849a0977", "comment": "Malware payload (Dridex)", "value": "ab5c6b61e5ce764066714e54c7c3ee5513d7e5eb0e84c4350ad1f72341301775f488ecfa8dcc53e578a99f4230408c54", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "0c969c6f-118c-4e60-9671-49e278b68a1e", "value": "A604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "53910795-40fc-4031-9364-ae4b3f73c3c6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "ddeae1e4-e57e-4659-80a7-753fc8274463", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533494, "uuid": "80f6d6f6-f8cd-4446-accb-76ec7b0dd48d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533494, "uuid": "3fb67096-57fb-47f7-83da-10001307a95d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "7698fa8e-7ac1-416f-bc22-d0065b915b99", "value": "02c7c78f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4745278d-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534495, "uuid": "84033db6-61e1-4206-b55d-a96270ba3825", "comment": "Malware payload (Dridex)", "value": "e3f7b73d4e1bfecc83a8febd759ae0eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534495, "uuid": "6147f476-00e2-4770-befd-5bcb9da9276d", "comment": "Malware payload (Dridex)", "value": "50293f5d3e3ef629fb6f3aa0b9b5b126dcbd5ac6fad1770373277e79c3dea08e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534495, "uuid": "faf60445-8497-4c9d-87b7-fa2ae8560297", "comment": "Malware payload (Dridex)", "value": "f81d3871a6e89bd1355dddddcdba6ff129aebf49", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534495, "uuid": "f438df6d-4ede-4613-8ee9-74429b6ef005", "comment": "Malware payload (Dridex)", "value": "a1a0bf590e39126f0cd0006429ca55bc3b3731da48cafec63931add2b8e5d6c9f32ce9d25f5b916e49a4a5ee3b8ec513", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534495, "uuid": "facc57bf-f18f-4895-9c3c-21dcc5e9c90d", "value": "0C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534495, "uuid": "9b98c0d6-1dd6-4e15-96f4-2beca4ce02e6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534495, "uuid": "82037652-e18a-48af-8612-31959bfac9e1", "value": "3072:ni49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:nH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534495, "uuid": "408744b7-3f09-4ebc-9e66-b4608dfb3b27", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534495, "uuid": "736074b8-5afb-49f0-9bae-3c119ee43b7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534495, "uuid": "3fb21d5f-ea24-4056-a827-3f0f82261370", "value": "e3f7b73d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2096df-b977-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621520865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520865, "uuid": "574aa327-d527-44f0-90ae-66f8da49dc61", "comment": "Malware payload (AgentTesla)", "value": "c2eed737336b1194cd3297da7dee1128", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520865, "uuid": "24afb007-38a6-4119-9417-1cc765e7260e", "comment": "Malware payload (AgentTesla)", "value": "502c562e6432e3c8a0291f7d4d36a3f7b212191f4db39f86f99fe3e8f72f7ce3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520865, "uuid": "0984381b-9ff7-418a-845e-f026f0eb63fd", "comment": "Malware payload (AgentTesla)", "value": "ecbabf86f7abb39d2dcfa12911c7c639040292ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520865, "uuid": "dff07e80-433c-4c47-a594-8210c2f3f4a3", "comment": "Malware payload (AgentTesla)", "value": "03d5a00d8e8292141de1ae81b0f0e133cf569b20400fca1688c2c4a5924a62982378f592a18840d347ec6d0eb36523de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520865, "uuid": "8a394258-525f-4ff3-ab51-025699e99792", "value": "B7F4F137224A9FA5E13F5BBDA07021486BF0E806E760D31C7D2060ED1D92F659FA5E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520865, "uuid": "2b1099c8-3e91-4d5d-955d-4eb757df09bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520865, "uuid": "9a0f516d-a8d2-4aa7-8e3f-a6d8827be56d", "value": "12288:n68Kzi++++++++f++++++++LB1Sljb7GiUjRoyUwWt6H+gFF8HO7gE:6VzY1SlzGBiwWEHFFFjgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520865, "uuid": "ee982e46-5e93-40ce-bfa8-528ffa186510", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520865, "uuid": "befd7e37-71f4-4004-9c93-7a4dc20557cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520865, "uuid": "cc08fa1c-c390-4657-84bf-95ecf321795a", "value": "c2eed737336b1194cd3297da7dee1128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8444998-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532510, "uuid": "bb46ac40-0d09-4273-9818-20362dce0390", "comment": "Malware payload (Dridex)", "value": "47507d76d3945be80363eb56ab91fdd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532510, "uuid": "64406dd4-8285-42fe-88c9-c73bb8172e51", "comment": "Malware payload (Dridex)", "value": "5049117db7d5f944bdd11b79158b332a7d0ca62b73e8442bf90bf479567a5698", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532510, "uuid": "bac5a1f7-b8f3-4e66-971d-fcab54fd4a7a", "comment": "Malware payload (Dridex)", "value": "6611b3ade288b2f4db380d905560db94f7fe463d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532510, "uuid": "6faf7dca-dea7-47d5-9e2e-02cf36f7c72f", "comment": "Malware payload (Dridex)", "value": "3746c64750fc9e50ff290fc1e44a1091ae379ad6e6aa5af435bd8acdfa66e9bbfb2a0f90d9dd984d4f515e95456224f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532510, "uuid": "75ea2fcb-2041-4e62-98e4-27824f956847", "value": "3C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532510, "uuid": "0f6167d2-14d1-4a97-aaba-1fed4dec73d3", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532510, "uuid": "35b8d6cc-756a-4cf5-955b-122217021b39", "value": "3072:JGi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:JGH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532510, "uuid": "8fee21fb-19a7-44ae-883c-048036231cf7", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532510, "uuid": "73072718-144d-45a4-9bee-a65f7ef10126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532510, "uuid": "912263ee-0132-45b4-95de-5d16de329d9a", "value": "47507d76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c70ba9a-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544516, "uuid": "548c6511-6b9b-4dea-b9f6-e3876460eb6a", "comment": "Malware payload", "value": "81d508095560bb849fad2ccdd13e93ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544516, "uuid": "c20cef15-5663-4a9c-a52c-4ddd0f07d6a6", "comment": "Malware payload", "value": "507c1b5a7fc5e20c8be5e5a881e743f45c0da220aebbe6384ac551983612627a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544516, "uuid": "e94c7088-f587-49f1-a5cf-2d7d3312ed3b", "comment": "Malware payload", "value": "0a32f1b95f4c62774756286e08986a3bf1925118", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544516, "uuid": "8827445e-7695-4163-bdd8-9cd8bae12eb1", "comment": "Malware payload", "value": "2f452761955e0c7c01145f812a5edccb3bd85b32ee9f840b8b1f98b72bd3c6ca78b06f4fdb447f7d3b48eb424823f835", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544516, "uuid": "d4ff1aa6-e047-4a8c-8092-9a6343a92b45", "value": "B404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544516, "uuid": "78864ccd-cb7d-48ef-930d-47a62a1fdbaf", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544516, "uuid": "86b9f8e0-f586-494c-b411-a0d2eb946d05", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544516, "uuid": "d9fabddd-ae76-4b56-aed7-9c267840a001", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544516, "uuid": "035a6536-1668-47dc-8411-7caee130760a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544516, "uuid": "eb3ff6ac-c383-4d3f-9400-82b87d0f88b7", "value": "81d50809_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d99852-b931-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621490570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490570, "uuid": "00fad0ae-9c6e-4c77-af2c-651a5579e976", "comment": "Malware payload (Dridex)", "value": "9fc9da902d34a06fb463efa6c879324d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490570, "uuid": "9bce22c9-6ae3-4331-aec6-8f1b0cdaaaa2", "comment": "Malware payload (Dridex)", "value": "50859d9f36d439ff4e7cf55f3ad65be20ca5743b6fb1f936fbc6fd2f5ecb6bad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490570, "uuid": "527a32d7-19a6-4599-9104-a43bf989f778", "comment": "Malware payload (Dridex)", "value": "550f1d1c60b6bd94d61aaa4c366d379af78bd51d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490570, "uuid": "81ad40c8-25c8-48e0-91f0-0ca87da30ba8", "comment": "Malware payload (Dridex)", "value": "a38c5d0b72f8941d1f4ab312c909bbc25695f3d0e82b5945d62957a78b816d45dbaca3b7140b850075a9a6279a046716", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490570, "uuid": "0d6a2413-a2f0-4656-9622-15a59effce76", "value": "D2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490570, "uuid": "ccdb9b03-b7aa-436a-951a-06b8c6818b86", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490570, "uuid": "11cf9075-2f57-472e-9c2c-6e9b7d1928ec", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490570, "uuid": "d4b2448c-cc11-49c9-93c1-9dc3c83bf5f1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490570, "uuid": "e8d598b1-4594-4fce-8925-bf41c0c47be0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490570, "uuid": "7502aa2b-9eac-4927-b20c-d3bfb933eff2", "value": "9fc9da90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52039156-b9bd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550834, "uuid": "2f3cee6a-8388-488c-b2a4-27bad55e028b", "comment": "Malware payload", "value": "4d8aa3ee6eea845c73b802803c179915", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550834, "uuid": "43dc5bb8-730f-48ae-b7f9-bba7cbf49519", "comment": "Malware payload", "value": "50bc4d61208e8bb13762b6e47615bb0ec20ea0c7f0ec91bc1f40d59d7ae10d75", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550834, "uuid": "4ac5486a-ed7d-46bd-ab95-27bd06152061", "comment": "Malware payload", "value": "d2b91b80f16ce4c877fa72b24408190b06c786dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550834, "uuid": "9c8fdeb8-bb14-4b40-b4ba-5f732588057f", "comment": "Malware payload", "value": "90aa58ec290d53a1c0fd0149ec66d6221ac5e848325244104e15953301f87a156b2e816ddbf0df9436840318e36a4d2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550834, "uuid": "fd1c6ad8-aab4-4c67-83ff-51c2133c0a75", "value": "89A3CF1AFD6AC5F6E517543B6508853AE70CA2D8E407A32F22FD10968CB48BD0716B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550834, "uuid": "c02425e7-ffa2-40e0-b473-050aebeca6b2", "value": "3072:S9J89UFjdur84xaDRLNVHgeADhEGsk8oYuOF8zAX:GJ8KFBurPaDpbADeGskGuOmzAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550834, "uuid": "5b4bf388-f4f4-4668-857e-fe853eefbdda", "value": 100370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550834, "uuid": "69444d69-3a13-44f9-9fcf-b892bee2d88b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550834, "uuid": "82cfc432-3e06-4d2e-a59b-73feb7754b3a", "value": "4d8aa3ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb08626-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527657, "uuid": "8edc6eb4-be49-4731-9931-85aad84100b7", "comment": "Malware payload (Dridex)", "value": "bbbf5d01ff96842c7bf6220408b85e4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527657, "uuid": "9256cded-0ad2-4488-aa9f-0aa2dba18cc0", "comment": "Malware payload (Dridex)", "value": "50e18acc345abd6e3c3f16da5074a36b2e4ea84005df0b1419a1dd59fb5a7325", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527657, "uuid": "b41e5625-387a-4424-985d-1dedfc26679b", "comment": "Malware payload (Dridex)", "value": "98bfcb9766b4315ea6bc21df71f02ae8f885fee6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527657, "uuid": "95088ff5-14bd-44fd-b9f2-eb62fc59f1ba", "comment": "Malware payload (Dridex)", "value": "14c5286577aa869f8b0bb2cb5f1230b233b63364f826cd6a001e3ddfe18769b701136361a6f32b11da75ceadb885072c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527657, "uuid": "2a17615e-4a61-41f6-a985-745c34eb7416", "value": "7504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527657, "uuid": "ede500c3-b104-4efe-8215-90d57c7476cd", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527657, "uuid": "57509d9e-7d86-4023-acdd-47035f8aca23", "value": "3072:fi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:fH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527657, "uuid": "0952a484-88dc-4e87-8fa8-d5b5b6e4d6bf", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527657, "uuid": "fe9f3fc5-2c7f-47e6-b1d4-b9e3d1bab6d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527657, "uuid": "1838a01c-a20e-4b2f-9c00-95aec7b2bfc8", "value": "bbbf5d01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30715223-b9bc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550348, "uuid": "5e913463-a822-48dc-a247-7573a68d8298", "comment": "Malware payload", "value": "2d4d06c61e9f873644b6b121c345c7af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550348, "uuid": "48d1284c-84ee-411a-b5f9-fa1bd0b2865c", "comment": "Malware payload", "value": "50f025e60814e7d63da4323c4d93996236558301d73649ca6b1fb68de5c66e4c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550348, "uuid": "edae44ef-f547-4071-98fe-461978eac8ea", "comment": "Malware payload", "value": "33b062783f2140ef014c4b077b65fa4b1cef3987", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550348, "uuid": "a8500a5d-fe36-471b-9084-914e9f408f6b", "comment": "Malware payload", "value": "7b9b2308b59af0413f24cd3e248b1acd93e4fecad00fa1d901c5d73e8b19b8f8c8263038ee7f1c60e757f559b4ace273", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550348, "uuid": "b36d7ed5-8996-42f3-92d0-cd7263c17db9", "value": "4504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550348, "uuid": "1fa824d4-ac57-4ae8-adcd-ceed201dad22", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550348, "uuid": "6f9ff5d4-ca37-40e6-80c9-743a69cf5199", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550348, "uuid": "08316ac1-affd-49de-bc75-ebb4c498676c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550348, "uuid": "b59f5e66-1069-4c60-807d-0764894f9597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550348, "uuid": "2616e182-c058-4f81-ae3f-e70c7d95bda4", "value": "2d4d06c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1184b084-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523238, "uuid": "24cab9f1-e190-4dca-8cd1-35725c57aa57", "comment": "Malware payload (Dridex)", "value": "4af1416bc4ff8089c1c55d1c31a395ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523238, "uuid": "dc55dd8a-9a15-41a4-b742-7f913a8f771d", "comment": "Malware payload (Dridex)", "value": "5107c7f66d36c96a719a53743d01e35a283ff75e920479af5bd3aaba359ce70f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523238, "uuid": "c1e26d4a-d9c4-4717-9b68-293f9da9ef2d", "comment": "Malware payload (Dridex)", "value": "30c184846b4c0012820e41aba03196a33dd23b96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523238, "uuid": "e2e7a461-ae2e-4581-b418-99fbd3b2bf80", "comment": "Malware payload (Dridex)", "value": "c426974ef6e76fcec1775267a2f1db0108fa674f8eaf0432915f623ec6a618473d5f65c2f88847e51f262b6150f286ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523238, "uuid": "65eebc80-24da-45b3-adf6-05e338cbd7a8", "value": "F804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523238, "uuid": "97f575c7-2660-4ab5-951a-c73f4ad44ff3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523238, "uuid": "3fa645fe-15fb-428a-8714-ed3aa5731dce", "value": "3072:9V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:9V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523238, "uuid": "ef733665-28bb-4d28-9948-687e3112e411", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523238, "uuid": "db9f3193-dd54-4e81-9814-00d9bf52be47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523238, "uuid": "46008235-ed5d-483d-b65d-d62d0e37008f", "value": "4af1416b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70551058-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532416, "uuid": "d524da82-f3cf-4051-806c-873a2b59fb23", "comment": "Malware payload (Dridex)", "value": "179803564a3201ba02f7f9838df82dee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532416, "uuid": "3f5b67c8-4bf8-4fa4-8d28-d346ec601410", "comment": "Malware payload (Dridex)", "value": "510859c8e17cd9197c6f069f43c85d6e0eb91faffdf491a123f85b317076e59a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532416, "uuid": "8491dde5-1b4e-4869-b25c-6646979ac475", "comment": "Malware payload (Dridex)", "value": "8327c36d9f07505207359780a7cc900aad5e639a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532416, "uuid": "efcae77d-4d64-4818-be00-2d007044bca9", "comment": "Malware payload (Dridex)", "value": "b26b9f3dbafab09ef710a1f5fa2b38be427559514596cb6cb8d17fd08b813c53f8d1a4e15d34e1b93500c0b110239771", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532416, "uuid": "c54ee5c2-34a1-45f7-a4f6-40c481bb9487", "value": "8DF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532416, "uuid": "31a8a1df-2736-487f-90e3-7aeb4b082147", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532416, "uuid": "e51b2e0d-2a81-4041-b844-35b59f75dc86", "value": "3072:pA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:p3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532416, "uuid": "f3398f39-7755-408c-83e1-afed53963e48", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532416, "uuid": "529752c7-d97d-45d3-8191-8f45597d23b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532416, "uuid": "b768c820-7ff4-4a62-b846-e93176338ee0", "value": "17980356_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f401fc3-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530347, "uuid": "17de5239-fa87-4ade-9207-dfd420210dff", "comment": "Malware payload (Dridex)", "value": "1597180901b3acfd10932415bfd2cbb2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530347, "uuid": "e303bebd-78ff-4e4e-b51f-07cecb7571a5", "comment": "Malware payload (Dridex)", "value": "512d9b9f63ecfcf3b988ad7ad73de62332f74e8b9594bdf16649522fc82aed6a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530347, "uuid": "0f0d4f73-8c27-4a8c-ad3d-78796c49a0ad", "comment": "Malware payload (Dridex)", "value": "f4228210d6acbaf340f504f9fe91ee5a770bebfe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530347, "uuid": "021919c2-637c-4bea-add6-8afaabaf9047", "comment": "Malware payload (Dridex)", "value": "fc1a1cf20cc374abbc4ea7d768b0c2185851ba4e81b986574ae6593753dbd0ae19c224492c00fee47270ac3563f2b5f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530347, "uuid": "c4c66389-b726-49f9-98f6-892c67fff99f", "value": "7204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530347, "uuid": "78976ac3-e756-4604-8e91-0bfac6ab2e4b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530347, "uuid": "8876baf4-b8ca-410c-a311-a71901cf1316", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530347, "uuid": "c9af440b-9a61-47bf-98c4-6870ba52ee3b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530347, "uuid": "aeb543d2-fbf7-4794-aff1-dfa136a539cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530347, "uuid": "05c04ae1-fb26-43ec-8986-1d0bfb0a273f", "value": "15971809_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ede1213-b965-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621512979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512979, "uuid": "71cb2748-e4f8-4855-a065-709ee43d3808", "comment": "Malware payload (AgentTesla)", "value": "85cf109deba9d0a11782f6b32f3fe2f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512979, "uuid": "9e7ab06b-b244-41dd-99f1-7cdfcba16369", "comment": "Malware payload (AgentTesla)", "value": "515212213cc20758110038963c28d94d9f713bd4ee2d88e2f5eb4a917af0979d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512979, "uuid": "095a1817-86c2-4f89-872c-ae377707a0d1", "comment": "Malware payload (AgentTesla)", "value": "3bc0d304da856bde99b093930356e3d43939322e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512979, "uuid": "880e2343-5434-455a-8418-b6888cfa44a1", "comment": "Malware payload (AgentTesla)", "value": "41e2a2a183665c5bfda90ae0f5562dd2de9d9283e266c6bf63dead367eff470647da28d5b7019913d7f4b4d34f9de5c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512979, "uuid": "1728a9e7-aabf-4024-beea-8d26207746e9", "value": "AAD4CE233E98AB70E3BD673F1021150043F1A94BD7EAD74D3D9CD19E6D72E848A62792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512979, "uuid": "d2a22146-def6-4995-a0d2-b4d4da6e6f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512979, "uuid": "393ba116-acf5-40c3-94d1-c15691e2e5af", "value": "12288:7UNLhE3Y5b7yqofb99+CeGpMakv5IvBenxEu1AIqwViIG6KOMYbJ/kZDiQAEF/UE:zx3AeztZqTg5eY2gk0me1TFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621512979, "uuid": "0c735804-9c5d-4633-8564-f1808b51357d", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621512979, "uuid": "941da143-e5a8-46d0-add2-f3c31608fb7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512979, "uuid": "58876c58-1805-4116-9ec5-0318f33c2b8d", "value": "85cf109d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9f697a-b992-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1621532574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532574, "uuid": "01c0b731-ca80-4404-bf80-b25ad91cb96d", "comment": "Malware payload (Vjw0rm)", "value": "d144f1c7a469417c99c5db12a5019673", "object_relation": "md5", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532574, "uuid": "bfc4374d-095a-4690-826c-4ffc0e741868", "comment": "Malware payload (Vjw0rm)", "value": "517d253fe8a63b8b33a37b3ea548fcf36aaf1a7b332a31eb13eba5bab2711e05", "object_relation": "sha256", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532574, "uuid": "680a46b8-d40c-4b49-8552-37ad5be28ec5", "comment": "Malware payload (Vjw0rm)", "value": "7195078d0fa18090fd9f3eceb6367e140757091d", "object_relation": "sha1", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532574, "uuid": "ffeaacf4-4a29-4d4e-9e38-abddacad8a05", "comment": "Malware payload (Vjw0rm)", "value": "22588870b8a14a1e0947f999be741e842f7fccdce2e50090fe86aa93748fb2d41e086b7acebbd0ff608769cae22a5bfd", "object_relation": "sha3-384", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532574, "uuid": "18764a79-626a-4ae0-982b-0ac315e32193", "value": "1B95AE607F945AF9EF8D1D0ED06EAB1D87F0421B2D22706BFA516F01B9DB146C10B26B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532574, "uuid": "a352d076-d71b-43b5-89a9-622efae6c38d", "value": "24576:SRTpdT3/RPEyK7d8FOaakmKacXBq0uYV+SZCODP5NNkhW+sgUKdA7CZaCd9Ys40e:FGvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532574, "uuid": "cbc4bf2e-f765-4d6c-a7ab-326fc4d79d6d", "value": 1914390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532574, "uuid": "6aae1936-1534-496d-bf59-c823b66d3be7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532574, "uuid": "e9e4882e-9af1-4f75-84a5-67f7140a8c88", "value": "El instituto Departamental de Transito y Transporte procede anexar copia de la notificacion personal de la orden de comp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c6e3ee-b95c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621509279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509279, "uuid": "30d11bce-289d-47fe-981f-b2b1986d90ed", "comment": "Malware payload (Dridex)", "value": "3b318b0625c98879822e99ddf9e6d06e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509279, "uuid": "179372b1-3187-4b47-8027-b61f6b750f7f", "comment": "Malware payload (Dridex)", "value": "51a297ec7d34ea347fa04a780bcccdffa4d6fcb8a89e889acaa1cb0ce27e36b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509279, "uuid": "81bdf393-c859-418b-9c71-3dc873df85d8", "comment": "Malware payload (Dridex)", "value": "30bf76f772986bfc476de5cf12c84c67f77e458a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509279, "uuid": "7eae3f85-0790-41f1-b0bc-d60729fe111b", "comment": "Malware payload (Dridex)", "value": "352b344c27461e283f314707145900a04c2b1cdfb80e7a22829b3e40bcb1313e0338ae551ae15fea82467054fcccc836", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509279, "uuid": "0923612f-d82c-4e9f-9c51-c59f2af6fa49", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509279, "uuid": "e1e49685-d4f5-467e-96b3-2c13c1d7d453", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509279, "uuid": "9df575e0-3dd8-4778-9a48-5d4c52a92758", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621509279, "uuid": "8ff53ccf-495a-4fad-8669-680ca142fb12", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621509279, "uuid": "81218737-4efc-440a-95da-44240d24dd36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509279, "uuid": "dd66f264-d08c-4281-8777-732fbba72bda", "value": "3b318b06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb8af5b-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621520307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520307, "uuid": "477bcbd3-7c91-478b-aca8-73e92d8aa456", "comment": "Malware payload (RaccoonStealer)", "value": "9e0637d40ac3dfd9fed6e63763394d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520307, "uuid": "65df923e-c534-41a8-8a42-71c0257afbab", "comment": "Malware payload (RaccoonStealer)", "value": "523105c466693a60d62ce69ed62e13eca290d4b23b45ada3eabcb2e5b74b1e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520307, "uuid": "c350ce8a-29c1-47e5-a81a-01be84d05388", "comment": "Malware payload (RaccoonStealer)", "value": "4771bab4d1742d29774f72ed3a91f7036f50a1fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520307, "uuid": "a18b8136-440c-4d01-8db5-8c6beb1b095a", "comment": "Malware payload (RaccoonStealer)", "value": "07185b130f0c046df971460401ebef68406d53f9bd1a3c002721b7bb1e506c8fd69957f6c9f21806f070548fa1aa325f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520307, "uuid": "67e09862-27fc-493e-87dc-234d9d8d0e73", "value": "B7C4BF3275724076F17240B06E7CEBA115BEBC7008718E6B73C90A2D5FB55D29B22A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520307, "uuid": "078c8b40-6a9c-4fa8-9ba0-d0c8144a7411", "value": "51747c8f67e1906217336bcac3925924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520307, "uuid": "9644a015-ad32-44b2-a462-da8fa00d8990", "value": "12288:D5ntsDk51T1v2AqWsmCsWZC6cm3mS5Osw4KT5uImXzsMAi8Lh5Qm6f:dntso1T1v2AVZXWZZqRzFDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520307, "uuid": "f4dac941-8687-42fb-93df-2cea4823ad7c", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520307, "uuid": "34dc54cf-3449-4bc3-9976-8f6c5883bea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520307, "uuid": "ceddf99d-a6f2-4532-8c0d-fd86a0fe26c8", "value": "9e0637d40ac3dfd9fed6e63763394d96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cdc78f-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621523934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523934, "uuid": "aa220096-3eb0-4524-8821-786c2ec4a28a", "comment": "Malware payload (RedLineStealer)", "value": "5624a868327f9790df66cd209a7583e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523934, "uuid": "2d38bc99-8537-4915-b078-9ad4ef0285eb", "comment": "Malware payload (RedLineStealer)", "value": "524c53b84d8d7d5434d82e266cdf1fce9665558ca8a9ced8e7404b12e0604a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523934, "uuid": "ba3835fd-1a39-4436-925d-d202341b7736", "comment": "Malware payload (RedLineStealer)", "value": "51cb889aba4f8c0046aa9d2f095e75eb433a939d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523934, "uuid": "c3654f24-c8f3-4584-b9d0-59909c0cfeb3", "comment": "Malware payload (RedLineStealer)", "value": "41bdca6beeece713d260333984f0c107f341dc738b49442424c2aa6423fb9ecbe5e1bc4b76fc44eccfd8179a811cb1e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523934, "uuid": "5d2778e1-4af6-4b40-bab0-0d37e9e0540c", "value": "CAF4D020A7A0C035E1BF12F849B99279653A7DA16B6440FF12D52EED06336E4AD307DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523934, "uuid": "3935a392-e372-4eeb-9c90-c3bd5cd88988", "value": "6b55f630541fdcd5757b3e440357a9c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523934, "uuid": "cb35d66c-bf39-4dcb-a816-58a1cb083565", "value": "12288:RR5aP/+pdSBM6wP9RFDWWMv65nMyFqbEbEdhMuAWUw+XsLI:Rm/+GSRMGFeEgvMuAWUJXsLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523934, "uuid": "c53e9e9f-b9ba-410f-a52f-5f9724a466a7", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523934, "uuid": "5d976d94-308b-4a8d-8311-dbf3483d89a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523934, "uuid": "dd4d166b-8f17-4f9d-9baa-17ab5c845d2e", "value": "5624a868327f9790df66cd209a7583e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0232e09-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537355, "uuid": "1a5cbd0f-8555-4f10-8ea6-3ca24743fb6b", "comment": "Malware payload (Dridex)", "value": "16b3a78012e0e7079be4b4b111331fe4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537355, "uuid": "978e44fb-16e9-432a-af63-92e3251e2447", "comment": "Malware payload (Dridex)", "value": "525ade95de5d7086ccc2e23ddbe2d6128b9c4f134398281252b270af7422abb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537355, "uuid": "69c4e019-5214-47ce-9664-158dfd99692b", "comment": "Malware payload (Dridex)", "value": "e18fc79f4a19ae40333caad466a7593170ba54a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537355, "uuid": "51125e8b-c606-44ba-a47e-18d9f46d6de5", "comment": "Malware payload (Dridex)", "value": "33e3e931a208129c9b0276297d308eaea1155d19ad19f02cfcfdc0474561358d34657ed19759aa32c2a0160abb31fded", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537355, "uuid": "969c3add-5d32-4a5f-ad91-47960a4cba8c", "value": "7904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537355, "uuid": "8fe0a9d3-cf34-4b8d-8381-c8598e334572", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537355, "uuid": "013b0c14-5641-40ef-a3f0-ecbfe12bfcd0", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537355, "uuid": "be752056-ff4c-4dd2-9253-67f4f0389137", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537355, "uuid": "504f582a-e72c-4731-a231-beea7462f2a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537355, "uuid": "5ad56048-c4c2-4c14-a559-c3f9316ecb9a", "value": "16b3a780_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d65544-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528016, "uuid": "e710b6ce-e1e0-48d4-a9af-213172ff603d", "comment": "Malware payload (Dridex)", "value": "f6338c95e417d7bf42f8003a3f59a4ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528016, "uuid": "f7fc65f5-dbb8-4f59-a718-3b1eb538f20e", "comment": "Malware payload (Dridex)", "value": "525fc78e75ba19e94574e2929354df4074d301b67624de1d2b23d80a910dfe6a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528016, "uuid": "7bb016af-ef56-4480-8aa4-f176cf9f4bef", "comment": "Malware payload (Dridex)", "value": "470407abe678e5dd58abe850a59f11b14d62e9ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528016, "uuid": "a873243d-d3a0-4840-b7c1-42319eaeb5d6", "comment": "Malware payload (Dridex)", "value": "2d87013eef126a004774854c2d3db93b30b4f6b49c9071892d541d85fcd25947ff9b2fe8a84e52a403c8f843f542c820", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528016, "uuid": "6ef40da9-105d-4c58-919f-2159785f9ed9", "value": "4404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528016, "uuid": "c5e5813a-010d-43bc-8566-24477957a8c5", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528016, "uuid": "44dd186d-502a-47ed-8b9d-a1d0de509443", "value": "3072:Ci49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:CH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528016, "uuid": "f06038fa-1c41-458a-82d3-92d393fa24f9", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528016, "uuid": "4748ef86-5a0a-4971-bb1d-ce40129fb7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528016, "uuid": "23709143-b21a-4492-bf26-4634570d87b6", "value": "f6338c95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d972dc1f-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530874, "uuid": "5a1c6dc9-fe16-40d7-9146-55b304ee4d54", "comment": "Malware payload (Dridex)", "value": "915cb77b6c267cc160034f862a1b8108", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530874, "uuid": "49f8a734-51b5-46de-a36c-21430c6d848d", "comment": "Malware payload (Dridex)", "value": "526c52fd7e5f2449fe9bf486718ef962937c028344eac3c9b1f29bad2162aeb0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530874, "uuid": "b1765562-317e-4b95-8659-2d57acbe704c", "comment": "Malware payload (Dridex)", "value": "479f523f01acf10bdf4ee969a5a7a6447269c5e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530874, "uuid": "19e242d8-15ca-4d46-9c41-43d232cfbf4c", "comment": "Malware payload (Dridex)", "value": "843d974e6bca2065ed634a8c7465c45664d1f466fbb83a25ae838de95744756b69fcfad2e0dbbac4e47c864d9b8225ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530874, "uuid": "3025deea-0439-4656-99b9-f6b696545a2f", "value": "6204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530874, "uuid": "a719a5af-5288-45ad-a364-2440b83376fd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530874, "uuid": "0c483741-070f-4a24-b340-8c2557524b34", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530874, "uuid": "cc74d9e2-6503-4ba6-b724-b9cd951fd2c7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530874, "uuid": "94723ecd-0aa2-4781-a8ee-3cb60d6a9634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530874, "uuid": "d97c36c8-61f6-4af3-8e88-beee27eef9ac", "value": "915cb77b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8283608a-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527722, "uuid": "2b44d42a-4398-4dfa-92a0-6635362924c2", "comment": "Malware payload (Dridex)", "value": "9d0e975ec49b96e6d557560c09f5270a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527722, "uuid": "8d129221-3d94-48b4-b9e3-347872025963", "comment": "Malware payload (Dridex)", "value": "528c1534164afe12cf076cd8da16b617e6e0c7061cb3fe4c6ad7463b5517ad14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527722, "uuid": "e7e6b999-1a0f-4861-be22-dc5a7a625307", "comment": "Malware payload (Dridex)", "value": "4dd64cf977a8ce854edc8280e97c988c290abe8c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527722, "uuid": "675cf646-9875-4bd1-8b8c-a0b19f4af76f", "comment": "Malware payload (Dridex)", "value": "0c457bfc22ce6531dc9641182c4570ef77aa573f11d3a51a0beae1c038c0018d63f34ff7bb4a5b0c38015a0853154324", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527722, "uuid": "5f306e82-69d2-4604-8a93-eba0521539ed", "value": "A204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527722, "uuid": "4b95897e-fea1-4165-8001-040710872e8d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527722, "uuid": "a8d0b1da-1362-40e0-b8d8-a044ee9039ac", "value": "3072:ei49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:eH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527722, "uuid": "8b9a06c1-cf79-494c-9859-b7a6f244f5a2", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527722, "uuid": "cf770025-d298-4ad0-80e3-b3854880dbc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527722, "uuid": "2e7bc543-23ce-4782-8f73-d0aecdbdf647", "value": "9d0e975e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c7c731-b9b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546516, "uuid": "aa0e2530-468a-49b7-849d-8eb6ff9be9e6", "comment": "Malware payload", "value": "8a7322bd1014e7d2cee2ac13d56bd3cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546516, "uuid": "c3bce66b-8aee-4b15-892a-98afbaedc161", "comment": "Malware payload", "value": "529f067f134ed88d77f626b4b78c65172ed9d54e17037f242c3e7e20bee0cc9c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546516, "uuid": "38860b92-7f38-49b0-9485-1584b4c47d49", "comment": "Malware payload", "value": "04fc4e69fc381950ddfab22c02709ce1c5ca386a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546516, "uuid": "ded3934e-cd30-429d-b13f-0af1005e7148", "comment": "Malware payload", "value": "c19b4612770dacaa9eae30eaad93645e1e043beaec159ad59ed06caf99c6f8c90066e076888332b9adfcf300926bccd3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546516, "uuid": "1491c79d-c093-4fc3-b99d-252d4a04039c", "value": "5004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546516, "uuid": "23bc3ec5-4ca9-468f-98f0-2e9f58eeb49f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546516, "uuid": "cbe9e660-4078-495f-a253-771e242da1eb", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546516, "uuid": "61afc84f-7592-4c78-a1af-7f8c8f679988", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546516, "uuid": "e1bcc544-00bd-41ac-bacc-f64be137017b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546516, "uuid": "c203a8f5-e0ac-4775-9da1-927acc9fca8e", "value": "8a7322bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8e5d9e-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533858, "uuid": "c4cf7de3-ad62-4dd6-9b98-c986a14d11f0", "comment": "Malware payload (Dridex)", "value": "24986b36a0fc39da918ef0b2dc24f8f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533858, "uuid": "c5cb79e9-30a8-482b-a0e9-36c7f0f54da0", "comment": "Malware payload (Dridex)", "value": "52c88ab58021f74a9e4dce057efd9ae7f6baeaa1a03e9c2f7ed8faa8f6f8ba2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533858, "uuid": "b6d86bbb-30c2-49c2-add2-d72160206e97", "comment": "Malware payload (Dridex)", "value": "cb9303da148b867ceb7a0423a896656f821a6703", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533858, "uuid": "b37a957d-dfc9-47ae-892d-26ba8d66cf48", "comment": "Malware payload (Dridex)", "value": "b148d1700deee46fdc61febb799d8a02c139790f6e9f4d8337b6003f2d7bb475fbaf26485a9bad24ee3e6350d02d90ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533858, "uuid": "335cf515-bbeb-4fba-84cd-b3a9039f8af4", "value": "F704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533858, "uuid": "df1ecc3e-5e07-4160-8834-8ef247a71ff0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533858, "uuid": "86a9f3f4-889a-4b99-8e77-a25000be743b", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533858, "uuid": "dd85a8dc-f63d-4dfc-a2ee-b0bb42358b44", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533858, "uuid": "b68b88dc-d904-41e5-8970-6282ea03402a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533858, "uuid": "1f806e90-bcd7-41ec-9e4e-6612ac441372", "value": "24986b36_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f8bea5-b9b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548671, "uuid": "b9d3f7b4-32f4-464d-8d9e-5ae9227fbaf0", "comment": "Malware payload", "value": "cadf7cd2e25c7d7590cf74063de1269d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548671, "uuid": "9a4f6dc2-2e83-4769-976d-7a8d1a2e707b", "comment": "Malware payload", "value": "52cd6e49c4ea26038f46e800a7761c20904fc270d5530bad8b34b66a036ca297", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548671, "uuid": "95245767-dad9-4c34-80fa-51410fed261a", "comment": "Malware payload", "value": "dc9c114e69420e2362a497f50c2d3b11a395154f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548671, "uuid": "0d5f5a18-4307-4d4f-a46a-6559e23d2f98", "comment": "Malware payload", "value": "8fc049c7050c477bcf1575da5efa086bbb5a26ff78df64d420cde540dccff6a8e4ea4887ca6a0877a68316e4eb7c7512", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548671, "uuid": "3b5088f4-52e1-45fc-bb03-a72c01e01575", "value": "0604D05CDA6B6D43E8EF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548671, "uuid": "56ce8ce9-23ea-44ff-b7b8-8091adacecd3", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548671, "uuid": "935b9f18-e376-45a8-963d-7eabbe34b2ce", "value": "3072:gqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:uVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548671, "uuid": "96110a7d-9293-4d97-a02c-c5300480cb58", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548671, "uuid": "c2c60cda-30d2-4d48-b51f-1289833d3e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548671, "uuid": "b17a848a-53f5-4f08-80b3-ae02ae9dbd03", "value": "cadf7cd2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724413cc-b9bd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550888, "uuid": "cba5537b-7bc5-4344-a54c-041adc0fe6b3", "comment": "Malware payload", "value": "f3462b85b1b4646be93fedb87a1cd1b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550888, "uuid": "b927faec-ec1f-4b86-8daf-c865645517ea", "comment": "Malware payload", "value": "52e980bf7a7611bf0809faccb05943119a1eeb360f8ac4d09ca8166cdaeb50ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550888, "uuid": "c76c1fc0-3183-4e66-9b36-ae9918d51c79", "comment": "Malware payload", "value": "2d1fabc4df4da98e19a6c628d143a9b611bd6874", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550888, "uuid": "536a1783-d785-4671-8227-8a6a410ddc11", "comment": "Malware payload", "value": "25fd4263104b8266a68679cc1ee1c0223b08e045fbad9b47e1037c887f39b9b7941dec4e485a716b19e23badfbd32672", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550888, "uuid": "be58dbec-41f1-48d4-9c36-1ef3eb4dd0e9", "value": "1104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550888, "uuid": "4b8b8205-335f-4e55-b847-dd8690dbd847", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550888, "uuid": "b8dac95d-a158-473d-8e0a-a6cae4a57095", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550888, "uuid": "3b2202e2-4b6d-4599-8714-bc218b2b60d0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550888, "uuid": "400453fb-17e8-48dc-a883-b02ce6249f8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550888, "uuid": "7396be42-8e3d-46c1-89bb-1e1b543d38f4", "value": "f3462b85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79006cf1-b963-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621512244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512244, "uuid": "ad4fe31b-9cbd-4326-89aa-06c4327472ef", "comment": "Malware payload (Dridex)", "value": "479665373c81d5e600966b7f3390a2d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512244, "uuid": "24a30a2b-383e-4b7b-a3f6-3f5b004e13c5", "comment": "Malware payload (Dridex)", "value": "52f100f51f8b887f740d28e19d4a826e1e9f9460494d7b4bf8f2a9925c3dac0f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512244, "uuid": "9511e4d6-010f-4096-b94e-c153f97c7f9d", "comment": "Malware payload (Dridex)", "value": "9e7779865a5c56bb9228a7a3ca09a012c56b3c4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512244, "uuid": "d842021a-3b78-494d-891d-d2ef4d206aca", "comment": "Malware payload (Dridex)", "value": "1f4286ffe850b82c7875a3b86c7f6511b24815a84365a82301084e5bb451b87207d3b7721de4a2509bfe340183499485", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512244, "uuid": "e0cf480c-12e4-41b1-aae9-0fa1f23178a3", "value": "3FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512244, "uuid": "e9ba115f-36d2-40c6-a82d-363ca25a0a80", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512244, "uuid": "871ac66a-a4c0-492d-9473-40012720a54a", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621512244, "uuid": "820b5c6f-a2a4-4d9c-8046-53b1cd26a15b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621512244, "uuid": "4a1ee0c0-e523-4e50-b496-f97d533a3aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512244, "uuid": "683719f0-ce3a-473e-b783-4f7a86c7386b", "value": "47966537_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61906435-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538834, "uuid": "ef79bf21-37cc-4b51-9d39-d5d64906f528", "comment": "Malware payload", "value": "7fbf88278ea4b5b7b1a3e2c46b21718c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538834, "uuid": "e9235d89-99c2-4dd8-b21d-869dd0718688", "comment": "Malware payload", "value": "5316d6a3fe390eab84195871e01b591238f772dc948fc030c92cf3b0951ae63f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538834, "uuid": "7ab330f1-47e2-4568-8961-19dd57ed9a56", "comment": "Malware payload", "value": "1b96f3c4a32d3aaeebd1446df900830152c9a699", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538834, "uuid": "0880754e-d72a-46c6-827b-4f0ae402c104", "comment": "Malware payload", "value": "1a4e40de3426b45b034ff254059cb867f3861b2965cc29a78645387619abd4662a021a3af5be20037ed6cde7609aea6e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538834, "uuid": "d1f613f0-b2c9-4ee8-a5e3-abf2080ecbd7", "value": "9704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538834, "uuid": "47fec4d7-c508-4bd7-b2e7-844e9643b693", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538834, "uuid": "8e4271e9-895f-402c-adac-e2864632ec13", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538834, "uuid": "c0f70b6e-bc41-4bcb-8e9f-b23d9da02c13", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538834, "uuid": "936e82c9-d0b5-4b9d-86fd-b58a6a28d783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538834, "uuid": "28a29803-250a-4d69-bcfe-764e89245aa6", "value": "7fbf8827_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80005f36-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1621523852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523852, "uuid": "078897f7-94a3-4899-a12d-25249b9430da", "comment": "Malware payload (Hancitor)", "value": "5c8a1beaef7e504654fefcfe369a2009", "object_relation": "md5", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523852, "uuid": "336909f8-63a5-4ed2-a488-32414ceecdcb", "comment": "Malware payload (Hancitor)", "value": "533aac672d8b5bf749eb282b985765fec5f5fd5c2e4b5c27935b7f3d2dfbc9cc", "object_relation": "sha256", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523852, "uuid": "d2a25c26-f681-470f-83a3-ce79501eb6bf", "comment": "Malware payload (Hancitor)", "value": "739e47e3bc81523c9451b6ff398a28288544d65a", "object_relation": "sha1", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523852, "uuid": "16088086-91b4-44e5-8d69-57f5d361c526", "comment": "Malware payload (Hancitor)", "value": "42249b0b5ba747ca8894cb8ee9c65823f8b992c46c6d36c2c69e470f33a6e8e89b474dd7411cb46c544070fe03950129", "object_relation": "sha3-384", "Tag": [ { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523852, "uuid": "556e6798-b475-48d4-84c7-f862bbcec695", "value": "1135E010B880E132E5A311354E77DAE9076CBC124B198ACB73D43E7F6D786F16B32666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523852, "uuid": "ac262686-3703-4080-9674-7513cf0ad616", "value": "24576:AEIjrPUaphvGvGUZ93/semhXp7AsWgaHESKnhweYkTfBR0:A/jhvGvGU93097AFgsESK+eYkTfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523852, "uuid": "c35da65f-aa38-4080-acd1-558c025d1e4a", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523852, "uuid": "d62efa46-5645-443d-b79f-18a9ee0d1520", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523852, "uuid": "3feb9b09-3270-46b0-9b42-b95ffde1aa19", "value": "0520_3044270461562.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176450dc-b971-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621518093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518093, "uuid": "91d478f6-1add-4588-a276-1bf098a77685", "comment": "Malware payload (AgentTesla)", "value": "551fff4eb6bdb747caf6610582b959ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518093, "uuid": "e3e1dcd8-0e03-41f4-8050-6833dbd7eb6c", "comment": "Malware payload (AgentTesla)", "value": "533c97ab5f2dcd8828077bbcb3e34636416d5a3b3b049229872670ce60fc34e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518093, "uuid": "8ea99bfa-de67-4acb-97c3-4a7469c7f87a", "comment": "Malware payload (AgentTesla)", "value": "841bfbbfd7a25242149b8ab819e8d3160978893f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518093, "uuid": "ca28c869-accf-4e9f-b562-e0b99da0fd13", "comment": "Malware payload (AgentTesla)", "value": "ac663a2886d13f35ec6c427d6a0073ee7134aabadd3aa50eba8cc760f668fd7c3a1ce9e9fc0c804d0d9da61b0ab1e5ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518093, "uuid": "1295f62f-7170-4c0c-98b4-1bcd6a2628f1", "value": "59F4DF291610BD60F8BE0F3FCAD98160E6BEED039903D7AE94E535ED98B2BB1C451507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518093, "uuid": "1171caa4-424c-4db7-bf09-20b38afe2a02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518093, "uuid": "a2883a94-967a-4404-a247-d5552e9d9c34", "value": "12288:bVoD6Kzcx30pdf4lITTkqMYgFJ04NGLNxjwu5RdoUXNL0QW:6TzPPyYFun04NGUuPy+N0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621518093, "uuid": "4f7fe4f7-599d-4c8b-9bf2-3187ec3f7efa", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621518093, "uuid": "3c71c829-0a9a-4af7-b2e1-883552602a21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518093, "uuid": "91229e8f-2d81-40cc-a34f-c9bcdd3ebc09", "value": "DHL0011739892020PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deff3231-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542051, "uuid": "f93da5ea-7c04-4d52-8263-e857b684991b", "comment": "Malware payload", "value": "27726a68538123ac88508e33d4e2cd03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542051, "uuid": "fa30e808-f452-43c8-a1af-870816cbbab8", "comment": "Malware payload", "value": "535bd3219285a41bb9771b942f7f0930ab86d78734070045531a753ddc1aa09b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542051, "uuid": "fbd5229d-51dc-48ac-bd50-1a290175b2a3", "comment": "Malware payload", "value": "7349bd43f2fcbb8a8e559075743bc2975f6a34b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542051, "uuid": "b66e08f1-3573-4f32-987b-d92735f8039d", "comment": "Malware payload", "value": "36954e500d2b6e20effd06925f6fff901780f3b3948b8809bc98bf506cfba9d51cce149890fe760322c901e390b37601", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542051, "uuid": "ae497b3b-d96d-47bb-aeda-51da7f8b7d9b", "value": "C7642352E3C84500DB4C8E71BB773670EF9DDACFA424879652BD0614E5F326609E9F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542051, "uuid": "3e4c1a35-6463-4d06-accb-4dc90227d512", "value": "6144:rsV1ryhvwC1iuBoj/pp38wcqRf4VIlvnlims2nUamiz2O/AgiF6ADL/2VEn2:rArSv9eLbFcylvlJUanaaiN//2un2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542051, "uuid": "2a78de9f-7e2a-41c6-8348-08cd87978294", "value": 313866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542051, "uuid": "450223fe-a582-4a5c-865f-09fe826f74b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542051, "uuid": "d517fe7a-911f-4363-8841-ad2069a909ef", "value": "27726a68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6f09e9-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530452, "uuid": "d6ad7438-bb36-4d9d-87f5-60280b919233", "comment": "Malware payload (Dridex)", "value": "1af76c2ac36f35c87d28aa1ef20aa9d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530452, "uuid": "156009f4-36ca-4bd0-a29c-d0636717be5c", "comment": "Malware payload (Dridex)", "value": "53813b47a9acc91ba434a485b14d83d0d07426a8a319e699754e0441f1945948", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530452, "uuid": "bfcc8033-49d5-47a4-8936-af317488688c", "comment": "Malware payload (Dridex)", "value": "eaf2f37c18c4293e0b6dcd79f1c6a42a4379a784", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530452, "uuid": "9b2802b5-1464-4aa8-9582-6d38144bce58", "comment": "Malware payload (Dridex)", "value": "df64ab4484ea7db1945da5ab3ea910445e880bfc0bff59e664d4efa1f9c827767572ef18395d00b985b23ab3af5daa1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530452, "uuid": "80f97a92-a8b0-437b-9e6f-1c8ca1a5ee50", "value": "9204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530452, "uuid": "942237fc-45c2-4061-b124-2f9cd2432dd3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530452, "uuid": "8f5336fa-3196-42ab-ab90-8e0d41847c62", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530452, "uuid": "52ed997d-6139-4239-ad03-9d263be6be59", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530452, "uuid": "75502ddc-6f98-4cbd-aff1-1839d7fb9785", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530452, "uuid": "c3e39bc7-e3c9-464d-9698-adc5025db719", "value": "1af76c2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a16f614-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533721, "uuid": "3ad2fe35-8e14-4fc1-807c-557a4fffff04", "comment": "Malware payload (Dridex)", "value": "60dca31393e887f7641731cc0d776fb4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533721, "uuid": "c1c1f081-acbf-48d2-8c5c-5e771e2940b2", "comment": "Malware payload (Dridex)", "value": "53976986f00eeed535ea6c29038fc6223a0fc200f1947f50c14f0c9616be3f05", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533721, "uuid": "249865dc-e2fd-485f-b327-26516ac76058", "comment": "Malware payload (Dridex)", "value": "96a8a8c8e1be1dce157a5ffbc3cca5ef619254ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533721, "uuid": "5373e6ad-9e18-4bda-8f40-0d7e13a02254", "comment": "Malware payload (Dridex)", "value": "5d35a7dd49827708db101a44c4d24bc9c4a1af0b0a7ccc5350ec32e33ef633a251b0d90eceb3e55f481c1ee6bb5c8493", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533721, "uuid": "6ee6f72d-fe79-4c88-98fa-9b8cbb049c27", "value": "7204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533721, "uuid": "c8fa7586-b94b-4955-a9aa-12a8b6b53891", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533721, "uuid": "66c3520f-ba90-49f9-b9f4-be8fe72b57b8", "value": "3072:Di49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:DH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533721, "uuid": "659c95b8-cc8a-4c3e-ae41-27123f924b78", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533721, "uuid": "1a2b3d14-287d-4c06-9b80-de83c658dd12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533721, "uuid": "747ddb3e-e77e-4d38-9c03-a19aa577f783", "value": "60dca313_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd94097-b986-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527147, "uuid": "acb94488-43c3-4bb9-9967-10d2a7ea837d", "comment": "Malware payload (Dridex)", "value": "f30aafb17e7945071b1147a21af03379", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527147, "uuid": "985ad65f-5d9c-4f2c-b71d-8c8a63797878", "comment": "Malware payload (Dridex)", "value": "53a49fe3312b74318a8c313a66548fb0d135ee85201920fc6713971774ec0d79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527147, "uuid": "3c5326a8-a120-4d54-b044-2a788eea8088", "comment": "Malware payload (Dridex)", "value": "06679c4f54a9078812067625686f3ca9675e358a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527147, "uuid": "3473fcd5-f6f7-49ce-9d65-ad72cbcb47bb", "comment": "Malware payload (Dridex)", "value": "c519493e45887c5b604f531a2759895d6a5501a82a0145eded48db930c63aabad5f8033e80d21355c7bcf99adc0b6b06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527147, "uuid": "0dc53cac-3a03-48ea-a312-ed924506c006", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527147, "uuid": "79a0a85b-9cd0-403b-9042-8c68ddce2c76", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527147, "uuid": "e4d098ea-b590-41f5-9252-39ce5087e3b1", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527147, "uuid": "314b290f-e6d6-44ba-a866-1221004eb460", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527147, "uuid": "7649f1f7-1b96-4336-86d6-23a0233baf32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527147, "uuid": "0b609f49-b043-439f-b78d-a853bc501c2c", "value": "f30aafb1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3a3b29-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468921, "uuid": "0d9b6602-cc10-45fe-9317-57bfd5ef7a67", "comment": "Malware payload (Dridex)", "value": "f358b559d8c4b59d762d7351a8b7e602", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468921, "uuid": "719047d3-2f25-47bd-8e72-c9700a126edb", "comment": "Malware payload (Dridex)", "value": "53ab02d081bc0849ca4b00439b37847d03dbf0d699c78162ccc009da08edfeda", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468921, "uuid": "9de3ab9f-0545-4df1-b872-0953c42eef9c", "comment": "Malware payload (Dridex)", "value": "c3f87adc4018e84a5154849ecf091a2372f7d1e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468921, "uuid": "32675c6a-4bab-4762-be72-4625c149c360", "comment": "Malware payload (Dridex)", "value": "61c48199694fb852c1f4f74f79b111a50a2f169b03cf15f44a298565a1c32b01f02ae8c9bc9e8d276ce71bc43629d57b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468921, "uuid": "00259728-b396-42af-807f-ed1373205671", "value": "58F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468921, "uuid": "224849d4-8109-472c-9537-1ee734979461", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468921, "uuid": "758463c6-4a19-48d6-b6ec-929684c4d007", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468921, "uuid": "4cd49a24-96cc-4c88-ac40-9c4fbbf3a56a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468921, "uuid": "377c402f-38f4-4004-9107-2c3863bb9223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468921, "uuid": "05c08e43-83ef-4a47-a15d-8411f0349aaa", "value": "f358b559_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8536df7-b9c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621553663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553663, "uuid": "ca0ea5d6-be80-41d1-ab43-f550e6423a54", "comment": "Malware payload", "value": "25d65dd664ad7ace428a7fb8415627b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553663, "uuid": "063e16c6-e49c-4111-add2-2bf276ff7d33", "comment": "Malware payload", "value": "53bb916762136e0ddc7168a9a19d53771d7418f5643e4f85ee096c7374e2e4a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553663, "uuid": "0849df4e-c98f-4d6e-b214-249963a2fa8d", "comment": "Malware payload", "value": "56ba12f65d94b25beab1dc1ed8d48526b9d70fae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553663, "uuid": "14da8c14-d52e-4705-b068-7e7d1b3e8bb7", "comment": "Malware payload", "value": "96b106888248903c7884ab54de8517eda38f28cd95ffbb018bbe985bb87f885cf6d1ef209a5fc4390a36d3a82d463434", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553663, "uuid": "caf80df5-7ad2-4c7c-9b3e-b993cdaac70c", "value": "8304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553663, "uuid": "02403e52-be26-4f81-ade8-bc102f43ddf9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553663, "uuid": "ba4d76d1-585d-410c-a04d-cef515a5c785", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621553663, "uuid": "3c42f3ac-2d9c-4718-9ffc-ceddd782ccf4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621553663, "uuid": "f8863056-e399-436c-8028-dd1e8b85def2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553663, "uuid": "798bf1d4-dd53-4482-9bb5-1e42bb5faccb", "value": "25d65dd6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75ba8bd-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528267, "uuid": "037f514f-32ed-4460-b80c-3a30ba18c6d6", "comment": "Malware payload (Dridex)", "value": "01aa59a278694f82adb7dcf306dacc88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528267, "uuid": "b2e16f97-3fdc-4900-ad61-90b7e3353da1", "comment": "Malware payload (Dridex)", "value": "542bd50f2a26ed6170f5045c128267ab04c42efef70293d20ef0d9c6baeaa2ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528267, "uuid": "7ed70de7-68a3-474d-a7ef-aa7096cdfaf5", "comment": "Malware payload (Dridex)", "value": "e598b7622fad8b22604ea77712ebd666ab76a7be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528267, "uuid": "33b2606d-de17-4b3a-8d69-fba2b65252f5", "comment": "Malware payload (Dridex)", "value": "73935c4a1c8e73a2241ff2ae03fe4899765755aa7e028b92902c6a3b4abd1aa6bfb523a589979f3cdf6ce105edf35ffa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528267, "uuid": "32a7ae99-c5ca-4556-85cb-31cda4377111", "value": "2E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528267, "uuid": "b5b8a6a2-4739-4a7f-8c24-302b5d21ec80", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528267, "uuid": "9da4c3e4-c763-48db-a8d2-f00c5d1fd1e4", "value": "3072:hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:hH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528267, "uuid": "c72312a5-bb96-4574-933f-578354df480d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528267, "uuid": "dbcf1f3e-a40a-4e6e-9149-30c7c3e95c56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528267, "uuid": "7234bcf9-4065-4472-860d-3271e7d7d4cd", "value": "01aa59a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4655ef47-b986-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527192, "uuid": "6efd857f-965a-4598-afe1-e65dbb07b422", "comment": "Malware payload (Dridex)", "value": "3dda7725b2b593065192b5c1ec6f1699", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527192, "uuid": "b48ca653-8790-4b47-876e-afe975b5985b", "comment": "Malware payload (Dridex)", "value": "544c73c8702cbc2f1efc531ea7b64911c9231ee66d0b2d288a6175dba0dc7705", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527192, "uuid": "b32c27e5-7f21-42cd-9cdd-004aa9feb266", "comment": "Malware payload (Dridex)", "value": "3ec809838cbdbc839f4bacc8579ab0f1712cac3b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527192, "uuid": "ac0d75da-0dce-4412-b0b8-7107610fdeec", "comment": "Malware payload (Dridex)", "value": "964fc1178c7b1de8409bc77d09959d2ad3868d2c030202afa029fee19dc392fd51c713ff2f5c9b1c71503001bf1a7074", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527192, "uuid": "002e72cb-5aee-4a89-bcbe-1c7622f8912a", "value": "AD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527192, "uuid": "597bf1fe-86f4-43df-b7dd-8976b0a52359", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527192, "uuid": "d0f8af24-abd0-4d89-87b1-ba5629636932", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527192, "uuid": "3b7bc70e-d02e-4244-8cf2-c9b8d2804f02", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527192, "uuid": "4011f1a9-2b33-490a-8ad6-c113d2dd16ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527192, "uuid": "e982a63a-6627-49b8-b66a-030f529d5b4b", "value": "3dda7725_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0764afa4-b999-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535247, "uuid": "de6c8aa3-6dd5-494d-a64e-198290bcd5f2", "comment": "Malware payload (Dridex)", "value": "e8e0e2e1606aba7926ad61a91412e831", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535247, "uuid": "37875076-e1b8-4829-9e11-b3eb8f96864c", "comment": "Malware payload (Dridex)", "value": "5456f8deeeaedb82f196fcb122c0f6f3df8cdb4b6b35c1dc64f51c8e7b895376", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535247, "uuid": "83c86895-3634-452f-a97c-9b80be841618", "comment": "Malware payload (Dridex)", "value": "3f3d45111153aee4e161b09e23ca036696a94c0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535247, "uuid": "b7bbc0d1-ab94-4396-8a3c-f69b502ea710", "comment": "Malware payload (Dridex)", "value": "30eed503e4ab4d5730b9859a4d6c26d3f2bc2f6d3b92e63f69b3ba9a498f7a55afa49b088a794a73a2f81415bbbd11a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535247, "uuid": "70762f01-c2f5-4a12-9de5-19a97e3f2347", "value": "3304B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535247, "uuid": "9be811c0-330e-4d7a-b825-bd48796dd35a", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535247, "uuid": "01b82861-918d-42cf-b8cc-1c61441ff3c7", "value": "3072:xWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:xWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535247, "uuid": "82ca44e4-2b4f-441e-a481-ffa1648aa848", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535247, "uuid": "30f69c1f-fe79-4e7f-88a2-8a616a45c3f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535247, "uuid": "b57eae2c-918a-4955-b812-b998f2d64861", "value": "e8e0e2e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a06298b-b98f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531198, "uuid": "a7228e3d-12aa-4cd3-89f6-053c0ed580dc", "comment": "Malware payload (Dridex)", "value": "b210a848759f4fefe860da4b00b05e8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531198, "uuid": "6d10385c-7c32-4f59-999b-b106073640cd", "comment": "Malware payload (Dridex)", "value": "5457e40d04f129d6bc2e0fbdb4fa4c952b8613770d2a8c27532b345fe8025b1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531198, "uuid": "c5451323-ae6f-4dad-bd8d-77f8d36337c8", "comment": "Malware payload (Dridex)", "value": "0f7e9bc2d1560722d8f72ff4795de52309642510", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531198, "uuid": "65eb12b4-2e9f-4a10-baef-06e8a307cb15", "comment": "Malware payload (Dridex)", "value": "efbe1323307d2262242bb795cea2d49c59a293ddbec524b1ea00691fbc9a45d1f6ce914eaea3021de91e1e8998a92d37", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531198, "uuid": "7fbd0964-c3cf-418d-aff1-04696c76a56c", "value": "7404E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531198, "uuid": "878596fa-5478-462f-9bf1-af873f8b435b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531198, "uuid": "12d2a7d6-5f57-45aa-9167-ba972e698250", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531198, "uuid": "3d131daa-eca2-42bd-89df-95e0cdfb07cf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531198, "uuid": "0f937e05-0dfb-4543-af98-fa60941e3b43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531198, "uuid": "d14dd79c-0f1a-4477-b70c-ec34be46178c", "value": "b210a848_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e31128-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "1e898a16-7fcf-4c58-9a3a-f7ec1868c4fa", "comment": "Malware payload", "value": "cfdea11f9ab8674c7f02a9a40844a5b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "c466872f-28c9-424e-83bc-672c6935cb9e", "comment": "Malware payload", "value": "5481748d12bd28df4072a18c1dca627e01b1b554eb71d8cd32cefe8bb752430c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "9767603f-1a15-4e46-8641-58bee79a10c0", "comment": "Malware payload", "value": "b17ecb99a480b97f60a286a3674a4b76dc92980e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541012, "uuid": "2059cd47-d185-4e3e-b359-c99e11fa8bc6", "comment": "Malware payload", "value": "177ed7475d1cc0180ca2fbee80470d512d2d88d176638144aab41f9fdcd4c68b117459bc39bb7b9f5f99ec87dbaea428", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "987de1fd-4d2d-46be-94e9-e585ae59b5b7", "value": "E204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "c5ae1627-2bf7-443b-b5e9-09c2e7206286", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "88179d6a-a22f-49cd-8e68-f9116b8651be", "value": "3072:vi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:vH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541012, "uuid": "a370f6da-46bb-4129-97b2-c3c89fbfd9da", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541012, "uuid": "0c686214-1753-412d-926c-ba4983a9bbcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541012, "uuid": "5e711f3d-908c-46bd-a494-1dcc860f4410", "value": "cfdea11f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63f47d5-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539889, "uuid": "1819839c-bb91-4c30-aa88-ad9c4135615e", "comment": "Malware payload", "value": "c2987afce1609d0d3138c7109b849c0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539889, "uuid": "ed81c335-3378-4c91-810b-b762a845aefc", "comment": "Malware payload", "value": "548a5cd8d6ece79194e9c4ba8f6ee8dce6c057b77c58c79f2425d8740d1d7529", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539889, "uuid": "a149a95a-2731-49ed-85c3-d5d47416d0ac", "comment": "Malware payload", "value": "d55b1abc99ce0317f2235b2c993f4950513ed06e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539889, "uuid": "edffcb16-b86a-48cf-894d-33142b7346c7", "comment": "Malware payload", "value": "cdc83eaba8ae79b5013b1447fd7fe25fd19b647c112c10c91f53f87c46bf677a0f2fb92c5dcd7262d94e8916a1bf07f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539889, "uuid": "be1ed4e7-b06d-4e2d-92e2-2e90c473f2de", "value": "A404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539889, "uuid": "1a5527f8-ebb1-4b1a-b1b8-7a269eca41d7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539889, "uuid": "893c3e46-59d0-4277-8b18-aef5609b925a", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539889, "uuid": "5d327f1b-e831-4c2c-b8d3-25fdecea6134", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539889, "uuid": "c87932fa-1add-4a86-a639-201c5a42000a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539889, "uuid": "e108e13f-fa84-47a2-923b-96cc502ddc7c", "value": "c2987afc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fe9a5b-b9ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544478, "uuid": "074b2db1-6ae0-4eec-9f0e-ef7d5f3ef7fd", "comment": "Malware payload", "value": "6ae6e27a8fa6eea683be819cc28926f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544478, "uuid": "002234f4-c56f-4cb5-b578-004d1b7cbe1d", "comment": "Malware payload", "value": "54d1ca7e410bfcc2e49920a031be6b8084e0b7ff5cfde1977c52765cd1727d16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544478, "uuid": "fe54ffa3-acb7-4437-ae4b-d39aefcebbe2", "comment": "Malware payload", "value": "cd6c9ebdabbae33caeba53f28d29aee61f2d477a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544478, "uuid": "533db88a-4b47-4258-b196-a03fdcbc99f7", "comment": "Malware payload", "value": "4c9184d18ec4589e92c850169722d4629e58693a8e4672861c222b941bbc449350dfe258298902da38d89c58f056a0e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544478, "uuid": "3c39dde2-1e22-46c3-bf1c-dbf4cea38b3e", "value": "7404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544478, "uuid": "9bf34fa4-7cc6-492c-a5ad-0540d7453f07", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544478, "uuid": "7c10d326-65a4-4fa5-8b1f-1bee084099c7", "value": "3072:9V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:9V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544478, "uuid": "09419603-5ec3-4fd6-a83f-14bb9fcc35ec", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544478, "uuid": "b408be48-7c39-40c4-97f1-576174d9a92a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544478, "uuid": "901f1fdc-e1cb-4bc4-8baf-69f5e6e8c65c", "value": "6ae6e27a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dee6bb5-b9a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542156, "uuid": "13fdc8a1-2dfb-472d-87e2-1f757c3bd185", "comment": "Malware payload", "value": "023963bab1004036861c41fd4c26bae8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542156, "uuid": "78a5497f-9de4-4925-b448-3a85225aaa2d", "comment": "Malware payload", "value": "54d1e98bd018d14be58e6a9a9bb8cb07a1be2cd5df3a528dfbe7b980b70c22d4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542156, "uuid": "b095bf55-3165-4e1f-9eca-c9226f5e733c", "comment": "Malware payload", "value": "653718ee5b55fcab4f5b839405c5e31f8ab3e974", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542156, "uuid": "231fb706-5658-4098-bef4-002da75f7b4c", "comment": "Malware payload", "value": "a50e26c38e5b4bfed422b8f67a4a4533c1e7f7a1dadba3fb1aa4bf021b7c3a1711cee109a4e72e76c0b121733a82174c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542156, "uuid": "60da9e1f-b764-42ef-ab3f-16d862268a82", "value": "B392E09F6563EB3B025EEAA484EF4DB18BF57834B3D24011DFA808542239DDDADC0A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542156, "uuid": "efb2c9b5-793a-41c4-b014-b17167d0abd2", "value": "384:P3KxEkTFkFZK9+N0Ia2ombAiPOGg6iui2HenFhoT13R:P3EhhkrK9u018fWFZ2HenuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542156, "uuid": "28873730-ff1e-4df7-adb7-37af76920606", "value": 21141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542156, "uuid": "d358e171-a87d-444e-a8e1-4b80d71897cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542156, "uuid": "f25445fc-7608-45e7-bff3-0c43910dd6d2", "value": "023963ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39063b4-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534703, "uuid": "b9f2e652-d0c4-4453-8ebe-29a6c4598bab", "comment": "Malware payload (Dridex)", "value": "742e28577acd5d0f2020153b9ac82354", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534703, "uuid": "99822237-8424-4111-9c43-ae36d73681bd", "comment": "Malware payload (Dridex)", "value": "550376823addca140e6d92c81d6fe2aaab067d69bd7e00e39b55e8d1b49f3e88", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534703, "uuid": "25c9e5b0-da60-41d6-8263-5c69cd4546c8", "comment": "Malware payload (Dridex)", "value": "5191580a9b7a7f4d86773d695753b1360ca32727", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534703, "uuid": "dcb3a75e-7206-45b7-8a56-3adf646996d0", "comment": "Malware payload (Dridex)", "value": "2fe47e86cdeaea0010f3adce6008e29ff1b948950c97848bf7aa446f13ef383f149b6e9f9e673f824464cc370511ed42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534703, "uuid": "948ae193-e951-48d4-9311-21f29b0958ff", "value": "3404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534703, "uuid": "a82639de-cbf7-46d3-9ca5-5f9a30c3069a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534703, "uuid": "92f9d61a-9aba-41bc-afd3-16762d174512", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534703, "uuid": "271aaf82-ffb6-4be2-a598-5276d08522f0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534703, "uuid": "885456c0-7622-4fdf-8412-a5f389be686d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534703, "uuid": "69ddcb15-c857-488a-b80f-ce16103a0ef3", "value": "742e2857_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad31dfb5-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528653, "uuid": "3e3d9d59-646b-4e65-912b-c8815235779c", "comment": "Malware payload (Dridex)", "value": "2bac5efe37a143ac1f3b7c2f75cd9843", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528653, "uuid": "e7911013-922f-4cd7-b463-50a1adf9e11c", "comment": "Malware payload (Dridex)", "value": "5514ddcc0a6bb2bc76cd4b80e37071c4048e875d79eea424a25a7d907c0c74d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528653, "uuid": "902e5064-f1d6-40e5-b692-9ff7b65bb345", "comment": "Malware payload (Dridex)", "value": "a04d184c737542a97ac22383cf3c66b3382c12ea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528653, "uuid": "4896c182-d803-4cda-b428-9cbe5aaae016", "comment": "Malware payload (Dridex)", "value": "817a2129fe65f4d6bfce525c90785c1130a124c31129a135dee552defa85b6f4be70df0a4acc5ca77dfcdf5be6860ef6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528653, "uuid": "ae3c198a-e9fe-45b3-a885-f2ecddb300c3", "value": "FE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528653, "uuid": "61782023-7971-4bc3-99a6-2d2a34fed6ea", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528653, "uuid": "c0bea8f2-ddfe-4167-b9cd-b2c75dfd685c", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528653, "uuid": "0f4fa11e-bd5e-42b4-b2aa-c927bac96a9a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528653, "uuid": "59116398-a623-4d8d-937a-2f1577384da5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528653, "uuid": "132ce986-f1a4-461f-bcb8-273d5d17c1fc", "value": "2bac5efe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ec9534-b983-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526060, "uuid": "8c4301de-e20f-4bdc-bb11-593fe73038f2", "comment": "Malware payload (Dridex)", "value": "29762af2faed3ac6f1fda5bdf033e604", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526060, "uuid": "24831f11-7c8a-445a-8f18-863103fb2643", "comment": "Malware payload (Dridex)", "value": "55239f29cc060249458723854f42a240aa94993e10cc9f0d192a8cf2292d10cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526060, "uuid": "b92c25f0-fbd6-4b2e-b9d4-3a913d259846", "comment": "Malware payload (Dridex)", "value": "ed82ed77706361e79f1a27e78b7e51fe716de390", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526060, "uuid": "45b8c171-8d5b-4f5b-8bdb-cf1cd54a9d08", "comment": "Malware payload (Dridex)", "value": "43cd87255ab65f213f0fe556f9ce6e84cf975750ed71ad46d6218dcf387ff9d3d0eb350c5d0887300525a03e01228a7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526060, "uuid": "724d9cce-e21d-49dd-9215-200a0fc03eda", "value": "F804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526060, "uuid": "127f8f9b-97f3-4abf-80b5-b9759303fd53", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526060, "uuid": "3a3c0fef-82cd-4704-8437-29f3e7f52a80", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526060, "uuid": "3707bb3d-9667-4a18-a5ca-dc182b09431c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526060, "uuid": "f0e0ba64-8c39-4751-8dbd-50c0bdb8d14c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526060, "uuid": "c1b5e9f8-75c1-4ceb-bbab-59de0ef8bd16", "value": "29762af2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744cece1-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "55037d9f-5852-4cb5-9f3e-0533969ba6d1", "comment": "Malware payload (Dridex)", "value": "ca6908c642f76c4cbbf249cd2bbefb11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "8bb96e48-318e-476c-a2de-c7638023a119", "comment": "Malware payload (Dridex)", "value": "55411527d760eda1dc966f525111565ce6644c8bc14c926c34baf7c5d5b2a0c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "9ca57bab-79d3-46e1-9fe8-76370b70b3cc", "comment": "Malware payload (Dridex)", "value": "f4a2728b22df623e748f8323c843b819b5baac6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "5a207d27-5884-40f9-a59f-38f1b479ffe4", "comment": "Malware payload (Dridex)", "value": "36e66d16137d14b4091230ba2acad7580a01b473b7c27572225d155d9f940801b3377d6ed2a9660257f5e8ad84b94a7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "b60f4df0-86c5-4d0f-a813-8cb7fc802144", "value": "BC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "7c03c98f-f50e-4639-a5a3-7582fb104fc5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "554cd582-8d0a-477f-a7f3-604dc0646971", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526839, "uuid": "5976a3bb-00ca-4217-9654-ce955620b8e8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526839, "uuid": "3c0486e1-39a6-4c81-823c-7d5166f0d01c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "cd3c6f3d-c3f4-4ae4-9bcf-02eff326e8bc", "value": "ca6908c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0128ad7f-b94e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621503024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503024, "uuid": "2da189ae-86f2-4a0c-9b91-a7e4b7638978", "comment": "Malware payload (Loki)", "value": "40caefae9655ee0c0726c76becde4743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503024, "uuid": "b9a0c632-9232-4045-8080-9344f6830f0b", "comment": "Malware payload (Loki)", "value": "555ef005b76db7d2c8bcd3364b02c0f282fbd5cf1da87524e2f2160a6ff7d642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503024, "uuid": "c6384027-c548-4196-b84d-33c037cdb01b", "comment": "Malware payload (Loki)", "value": "1ec75b1ba3a8112b48ec7bf48cbab527b695f5a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503024, "uuid": "3c0fc4e9-360b-43c7-82d0-1bcfb017d575", "comment": "Malware payload (Loki)", "value": "693a255b5dfda605adfa450c09d195b3b49f517ccde379ef989ac5adcf017616ac5f7014cd18bc81b99a15a6231bdb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503024, "uuid": "00128539-6864-4ba4-8c71-fad0852f3f6a", "value": "1F14DF05963C59E1FA9D4CB6A1CAD31443A1DF814833CA1BE49B73C0EA373E7E9162D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503024, "uuid": "736851d5-e7ba-4ed8-bb99-9990e89f9373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503024, "uuid": "0ff8950e-2c5e-4f79-92d5-9cf0be0e975f", "value": "3072:UBj6K0QdseKpNK3N6zuVHCTrEETmqayLp/ChdWKEsth6xChK:FSuKOuurKE2NEi6x0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621503024, "uuid": "d816ee7e-f248-4fec-8639-3addaf0633d3", "value": 197928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621503024, "uuid": "48d87b8b-7d2a-4e5f-8a37-a48705870945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503024, "uuid": "71c38469-d9b9-4107-8847-c6b66cce4309", "value": "IMG105677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d212ea9f-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523561, "uuid": "a0b17554-7374-40c8-9a48-17be7127f3ee", "comment": "Malware payload (Dridex)", "value": "1b2d842baf225e3408b30614d1db9978", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523561, "uuid": "5fe1c950-feac-40a6-820d-97003bc7aba7", "comment": "Malware payload (Dridex)", "value": "55722a9b0e08e483398cc0560129937fc32773cdb77c01721e67a7e9176bb6f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523561, "uuid": "2c70a568-7f18-4ccf-8f02-5f8b1caa062a", "comment": "Malware payload (Dridex)", "value": "e97e75e92b8048138a7b6023da1d5ab5797ea501", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523561, "uuid": "6d68ef12-44e6-437c-ab66-f83d83e3f489", "comment": "Malware payload (Dridex)", "value": "7ece9c6ba30b1ce74549310c4f9a11d8c3ad687d6ac946c3bb3f8b829de1db9d780fc2cda21a910b5cfff3b3e1e17a33", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523561, "uuid": "7198aebd-9bfb-4aea-9bdc-b938d68aa4c4", "value": "F404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523561, "uuid": "7bceb5d7-54d7-49d8-98f6-e405d2d8ccf3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523561, "uuid": "3947fe84-7dce-46e9-a40d-93d91eb240ce", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523561, "uuid": "9b2cab9a-f859-4005-8ec2-1d1607eb52db", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523561, "uuid": "c2162b4b-386d-4c40-b222-c562a3760c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523561, "uuid": "7c3168d2-1f3b-46fa-822f-6051ebc53eeb", "value": "1b2d842b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2444564-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538942, "uuid": "10c834dd-3914-4b6b-a616-401719bed64f", "comment": "Malware payload", "value": "8c893771a31c7a7b19ebac830903b8cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538942, "uuid": "c0e3edef-d016-46bf-b7cf-29197b4241a6", "comment": "Malware payload", "value": "55aab23904551a3636bdd0b1ffd938493adc25b68ef2e9ad1b9d464c2122db87", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538942, "uuid": "80b915af-dced-4eea-b94f-ef389cbfc150", "comment": "Malware payload", "value": "90a986b9cf0035c7b5ecd3610082a841d1fc145e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538942, "uuid": "8b240d7f-9b92-45f0-8e2f-15915c592b94", "comment": "Malware payload", "value": "f1005ed8300167c9f0ddb601a8ff52f71b0b118f3c8c1c3c0db3279ccb93e2c1c4fb459c405acf1d88b06cae3a1f2cff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538942, "uuid": "1672d96d-c3a7-4a17-b53a-5ab0ceb63322", "value": "2704B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538942, "uuid": "aa228683-6c35-4f13-8e95-262264cc68d4", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538942, "uuid": "d06239fd-e10e-47a6-9482-cdd15fd9cf77", "value": "3072:RWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:RWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538942, "uuid": "47653c7c-6c56-4e5e-a2d3-3f724aae9b05", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538942, "uuid": "40a1d3d0-815c-4993-8ee0-1c358f554005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538942, "uuid": "289fef35-1642-448a-a57a-c158b2101e52", "value": "8c893771_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e206e979-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Neurevt)", "timestamp": 1621472477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472477, "uuid": "9de24a6c-6d27-4304-a323-75b6bd7d88e0", "comment": "Malware payload (Neurevt)", "value": "a3a799eb1435896baea3a8e079c8dd02", "object_relation": "md5", "Tag": [ { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472477, "uuid": "8b2be550-640e-41b9-905b-99ab492dfa62", "comment": "Malware payload (Neurevt)", "value": "55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469", "object_relation": "sha256", "Tag": [ { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472477, "uuid": "bc4d82e3-ef82-4d3f-94b3-b09f72cf139b", "comment": "Malware payload (Neurevt)", "value": "cb0ce4c57cd8e4561a88ce20e80888d097b00900", "object_relation": "sha1", "Tag": [ { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472477, "uuid": "3c7b34cc-4c89-4df3-a1c4-10615eed539f", "comment": "Malware payload (Neurevt)", "value": "331a2967aa075424f6cf569ab948e77044c99c65bfa4db61eac5bbd867461f8d6b76ff2b6da8fbf619e8b2fe4362d357", "object_relation": "sha3-384", "Tag": [ { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472477, "uuid": "adce0e1b-d2f2-4c00-a8ad-44e659e7d9ee", "value": "4305AC337562A033D866007C9B45C7E4EB7FAB338756778232F852194AFC199BB2B521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472477, "uuid": "1a164757-0b0a-405f-8125-16c61831a63b", "value": "2fad60b344639525342c5481e8bc593c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472477, "uuid": "caa58a91-fee2-4813-a00d-0298436a5512", "value": "6144:QI0nq+96uJuMMIVwXicRrh7aSdQpiubK7SLW0kh7V46RHyVwrnoiSP2Re8J26r:QI8YuJul/XicVh7aAQpfbOSar7V46bka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472477, "uuid": "7ef4c929-fe7f-40ba-8882-f6f6297f7ac7", "value": 821468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472477, "uuid": "8be2e536-9e95-496f-885d-7e09d4cb4469", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472477, "uuid": "da185c1e-2d0d-4170-a6ae-730c7a01e792", "value": "a3a799eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899a093a-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546202, "uuid": "d2bfa826-b4f0-4626-b8eb-476ba66e416d", "comment": "Malware payload", "value": "03c7e2bb20e593f84c9c123e92a5f2da", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546202, "uuid": "e745caae-b94d-4a4d-967f-794f5b30fee6", "comment": "Malware payload", "value": "55cfc4bb604f7495d1a6f7c4ae48d962cb94705d897919ffd2f4a0e224344458", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546202, "uuid": "329e5047-7fad-4ab7-8528-60b031aebb99", "comment": "Malware payload", "value": "b0c77d4f7156556b8f9096cdb9a2c2bfa13f03f1", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546202, "uuid": "f2fd4dde-8725-451d-98a2-d6a8ace39136", "comment": "Malware payload", "value": "a0230384f3cf97eaa139c82205c7ed3e4ca75df7244e8be136101c678a455e3714bbeac200bf7f20238ef77191861c13", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546202, "uuid": "0cd85ee3-8ac8-4cbe-977d-f685b33ab152", "value": "A0A3022115EF5ADACB418D32F4BD216FD42A155F4AAB874B3C78F640222BF83457E293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546202, "uuid": "0ca4cd61-69c0-4afd-aea6-9adc1d14cdee", "value": "3072:wKGd02XklfIzQf0FfitRE6xXOpJd/Wr929:l2XcIcf0FfitREiXO1ur4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546202, "uuid": "6c374e16-5380-4792-b365-ef4bc74186ab", "value": 103740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546202, "uuid": "d98d34cd-954c-4fc5-ba95-01f85b6a6824", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546202, "uuid": "516b37f7-7f80-4537-9a1f-77b5b88afc4f", "value": "my_attach_02651.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f6353c-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530278, "uuid": "03640748-d3f7-4699-814f-513df747bff8", "comment": "Malware payload (Dridex)", "value": "6d514fd66c0e210009581ded7a2b8f97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530278, "uuid": "b34ffa3d-4e4e-4a43-ab2d-e1b79a321b88", "comment": "Malware payload (Dridex)", "value": "561a43c0319dc9ccdfa115aefad184c86659d723efb429bb6a3055a809f73918", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530278, "uuid": "1174eacd-448c-4ce8-b606-a0d9d43b7e83", "comment": "Malware payload (Dridex)", "value": "37c1cb9dd369668a25d7402f9954199344726c3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530278, "uuid": "66e9503d-e518-4216-afd6-2bca9e8bce83", "comment": "Malware payload (Dridex)", "value": "85940dd9847a17c9ca22b96d3b456e9a3932fa69b012b7035729d17c0f8f4b4e622f77aa3799b930ca86b4e2890eb6cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530278, "uuid": "d596b3ca-5a8c-40ef-a789-dd603b425b39", "value": "F104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530278, "uuid": "5be0e710-b484-4c91-8153-c5658e5dfe8b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530278, "uuid": "2bf25832-a60a-4247-a58a-85a2b86189b7", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530278, "uuid": "3232f3c0-e1e6-4ac9-b6bb-e0e5d43178f8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530278, "uuid": "7786169c-88a8-441f-84ae-f4eb075b9fbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530278, "uuid": "58429cd1-f53e-44e2-ab7c-734a8741cc19", "value": "6d514fd6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617faa5e-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537545, "uuid": "e5bfb304-4ca9-4761-8583-7d896dbb7ba2", "comment": "Malware payload (Dridex)", "value": "eee7635500745f172e510074e6a30a58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537545, "uuid": "b03cc501-9699-41fd-9d90-a4a7aaa2f391", "comment": "Malware payload (Dridex)", "value": "562f42b0409fed02072f1ed4d4b5cdd844810bfacfa0346aa0fe4a61671765e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537545, "uuid": "5d0902ad-b33c-438f-9439-5b6029eda267", "comment": "Malware payload (Dridex)", "value": "5270923aade1b344a95a7c70a7d0f05c820b1afa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537545, "uuid": "85d82678-cb18-4a75-b829-9befe3699bfd", "comment": "Malware payload (Dridex)", "value": "1f22f15dec56376bfa637ac2fc10dfc608c1c8edbf0a41e834f6c0b610d86e7e03cb6ae62ddb0fa9dafeb12c76cc57ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537545, "uuid": "9cff7019-bb50-42fa-b3ce-b442e6d253fb", "value": "B304BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537545, "uuid": "4c7e42d6-879f-48c0-a75b-a47b08fe29ad", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537545, "uuid": "dcfd9a69-4fde-43e6-9d46-d7d9d66e8894", "value": "3072:Xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:XH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537545, "uuid": "d0056f30-200a-4ca2-b651-6eade5e15a7a", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537545, "uuid": "ce04de11-a07f-4d37-9d9a-cfc4882002b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537545, "uuid": "28390ad5-dc19-4a33-b9cd-5bb2308b9d95", "value": "eee76355_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a3acfc-b9b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621548592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548592, "uuid": "99aa9a62-f2df-494a-a058-70f5b78514c3", "comment": "Malware payload", "value": "6ba6f2d4eab07d19c29caad88ceeaf51", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548592, "uuid": "311662f2-c17e-4cb4-9525-1e46c3c616f6", "comment": "Malware payload", "value": "5632ece13df6dc302e788da86ccdd65cf4f0131ebfbda09fbb74d7c49225924f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548592, "uuid": "0f8a0854-8e06-4db2-935f-553c53194e91", "comment": "Malware payload", "value": "4fb93dbf2c57393fc57034a2ae64cea0db81cd10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621548592, "uuid": "94120c0a-df6c-4410-82c5-dfec7a01f42b", "comment": "Malware payload", "value": "98eb954d1ba163f775edce091d13983e082ccf127dff422c00e501be89a05fc45262f287bd815ea26661df1664292a77", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548592, "uuid": "8bdfd028-ff68-4bab-8458-651ef1723453", "value": "E604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548592, "uuid": "954497df-0bd2-42ae-85c5-a63020d5da68", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548592, "uuid": "a9be7551-b64d-4a59-b47a-7fc936db5b83", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621548592, "uuid": "c463bae4-e8db-46eb-84dc-e827136e5e8f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621548592, "uuid": "bf8a24c2-9028-45b1-8eb4-15fec9ab81f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621548592, "uuid": "c31ddf7a-40ee-4b2e-8948-7cb9df1b7dde", "value": "6ba6f2d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67af8d53-b983-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525959, "uuid": "bacbae08-74e3-4a91-a906-d7d80af8b385", "comment": "Malware payload (Dridex)", "value": "8887e1732f2833c018aa788725b42e38", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525959, "uuid": "733aaf0d-2675-4d14-9778-f2c5f2264518", "comment": "Malware payload (Dridex)", "value": "5671bcdb9c3a3c9f17b96fd46a3637ed1a055464ab206e85d81466fe1f6d798d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525959, "uuid": "c351bfc3-1b67-45f6-a5bf-0a61efc51bda", "comment": "Malware payload (Dridex)", "value": "34504e625a8f813e79ab69844a6fc8b21c5aa33e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525959, "uuid": "dd01f049-5f0c-4e7d-bb3f-9fb7d80a37f5", "comment": "Malware payload (Dridex)", "value": "584bd7c2e8915cdb6a1d6ab7a591debb055a525d7c297b9fb97093287c3eafaaa4712728ad8f996874ef66a81e76b343", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525959, "uuid": "7de0b483-9862-4064-a671-646182a1a12f", "value": "0C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525959, "uuid": "80f3f35a-816b-4f7b-a462-4ca6770d9f62", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525959, "uuid": "19b556ab-c529-4e8f-9c06-3ec3ce080070", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525959, "uuid": "240c0e91-7e28-410c-a2f7-b10cac60d6bd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525959, "uuid": "86f63c5d-a2e9-49b7-9d91-e9494a4e9989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525959, "uuid": "f85ac33b-6940-44d9-96d4-25e50bbba3e3", "value": "8887e173_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4c7f86-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472469, "uuid": "8f7d2313-bd98-4603-a633-d4c6e765703d", "comment": "Malware payload (Dridex)", "value": "36f7b0b116a8dbff17d59122eb7c800f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472469, "uuid": "1a8a2b59-e001-46aa-bd30-2eda3be531ca", "comment": "Malware payload (Dridex)", "value": "5676f7c36457439fb75d2b4462b0f7cbeea89a058e33e5c125869bdf2c5cc2ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472469, "uuid": "9e6ba5ec-b8e6-453d-9bb7-d4d204350bdc", "comment": "Malware payload (Dridex)", "value": "209cbd4ead44cc1d68793941b3032ad5cf23beea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472469, "uuid": "89273f70-5795-4992-aa4c-33810241b970", "comment": "Malware payload (Dridex)", "value": "8609362a1a48a65bcf1d38e44473126d3b4946c2bc96a9f0ba4cf6c037d99af7fae926735d8f83ef639c7361ddd139be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472469, "uuid": "864c2dfc-7041-424f-bb26-9749338541dd", "value": "04F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472469, "uuid": "6b3eb3cb-1928-4ca3-837c-ae7e08ba340f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472469, "uuid": "44c71af4-f3b3-42ed-8abb-3327450cd91c", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472469, "uuid": "648ccd14-684a-4a02-b0be-e26266ee23aa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472469, "uuid": "f709f4de-fac9-4e87-be2d-40967072a0ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472469, "uuid": "cb959711-57dc-4e1d-a182-63681d746315", "value": "36f7b0b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7ab6ed-b998-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534903, "uuid": "54135a73-12c9-4096-9cf4-f1ed96089237", "comment": "Malware payload (Dridex)", "value": "8b8920253772226d118abba12e12bdc6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534903, "uuid": "9de05d9e-dc50-42c2-8f16-bf1a0744a597", "comment": "Malware payload (Dridex)", "value": "569eb4f8133c3cdef66b55fd8d19466db11a4400d54bed7aac897e7779df29d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534903, "uuid": "9874e7f6-046a-4c29-9b22-4ee621db7899", "comment": "Malware payload (Dridex)", "value": "5429615a19a1c04ce878407b8bde3f6024a97dc6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534903, "uuid": "bc859d6b-d673-4afe-ac6f-8434a991699a", "comment": "Malware payload (Dridex)", "value": "490978b1a0d6104c6222f36092e00521ebb5cd0dfc1f5c54f73e8557a9e1c67d25907b2a028133640ae97aef96271e8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534903, "uuid": "97d6db81-17b0-4b49-bcdb-f3ad66279fcd", "value": "BE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534903, "uuid": "328abde9-a0e2-4e49-b337-5579c546f6c1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534903, "uuid": "d4db10ad-916c-4fbc-8d7b-2c82ba0814ef", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534903, "uuid": "6aa9f229-ae0f-4ac7-8cb3-928e4e6c0073", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534903, "uuid": "8af62148-5957-4d97-a623-b7e29ccfc4a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534903, "uuid": "458947a9-4f25-4cfb-be29-93669c9d03b8", "value": "8b892025_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7152e7-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544949, "uuid": "231d0d6e-9372-4fbd-878a-080b7313b06b", "comment": "Malware payload", "value": "d50e1b50c2a9af2022f6ff8334168c14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544949, "uuid": "e3bed21e-fed9-4078-b992-93c9d847fd39", "comment": "Malware payload", "value": "56b4c0874c881db9aa9316c056a6c94539726d47c364ce4fd6a63db0a792296f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544949, "uuid": "a8585fca-b54d-4d49-8107-c2c5e2d32bed", "comment": "Malware payload", "value": "b8cb5a76806d5f59b6dd7bdcf01d56be7213c346", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544949, "uuid": "e548815d-0f03-4728-9f65-7826f5a82f01", "comment": "Malware payload", "value": "7698ef7848c37396cab926b0fd8b0724fc485a1340988b012515ee65b324154c0cd72228891c888fc1795e39dcbaa66b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544949, "uuid": "dc2069a4-efa3-4458-be5d-20a67d5e7dc6", "value": "DE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544949, "uuid": "099d317a-ef02-44c1-9b61-d76211626b6a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544949, "uuid": "3fa68554-17fd-4c5c-b761-b65d0405c786", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544949, "uuid": "11fbb442-20d3-48d1-9221-fd927a62e953", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544949, "uuid": "75ac8a6b-8ac5-4e2f-8d38-134321fd629f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544949, "uuid": "6b2d906d-d016-4528-9620-b0856fd50c14", "value": "d50e1b50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ace7ca-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520257, "uuid": "0a6a2ade-beaf-4775-9f0f-ae9fe16b8f16", "comment": "Malware payload (Dridex)", "value": "5186a21d30bbf28909683c4767597481", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520257, "uuid": "9ed2c438-6d76-4ff9-be40-a020257c2c50", "comment": "Malware payload (Dridex)", "value": "57301e8fe9f386d64b44ddefe1c7124be0aba07cde84cba72d2c2aa9c1402b5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520257, "uuid": "fadb562d-5fe8-466b-8c81-56235d4a019b", "comment": "Malware payload (Dridex)", "value": "fc9fced326d8db3c8171b8aebb52581a80b9e455", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520257, "uuid": "63d5c915-6dfa-4458-b18e-c42468b799ff", "comment": "Malware payload (Dridex)", "value": "87011d10ee9a8613d53d045b26947dc6488b25ae0e33b642ba735bd88b91da80864e1945937438db8554e62cda25526c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520257, "uuid": "c90ffceb-b9be-48f5-bd8a-11b52bc6f61c", "value": "66053A55B694CB26D6670E310CAF8ADF6339AD40CE7183076E9FB31E2E3674C9852721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520257, "uuid": "eaa571fc-8664-412c-a4cb-f1757c2fe83b", "value": "6144:fk3hOdsylKlgryzc4bNhZF+E+W2knALkzjDpvs:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520257, "uuid": "491d3188-742f-4dd5-b2af-0c91582a700e", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520257, "uuid": "ef58d976-833d-4af0-9617-fbe9cafbaeca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520257, "uuid": "dce9b346-5d44-4f38-83e6-c9e042771907", "value": "5186a21d30bbf28909683c4767597481.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497db25d-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621523331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523331, "uuid": "6ed47288-b41e-4ef8-9b2d-520f951f02ac", "comment": "Malware payload (AgentTesla)", "value": "e1d4cf3e5040c6f163d18828628b5f1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523331, "uuid": "bd807039-42ab-4f28-acd8-337995deffdd", "comment": "Malware payload (AgentTesla)", "value": "576bd2675f162947f527b72c50c9fd29c27bb507aba8ab7ea9a09d179024207c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523331, "uuid": "521c0dc6-ecfe-4abf-91d5-c4171528903f", "comment": "Malware payload (AgentTesla)", "value": "8a6368af77a8266c691a3371d8d7af9fca0a0e06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523331, "uuid": "69f43ba9-195e-4f8a-b85f-59c011b2c439", "comment": "Malware payload (AgentTesla)", "value": "934de220ab20791668a4d63f8144f5713270914aa22a34d9588556d27dd2347aa0d3cbaed62539615f567af9a02736c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523331, "uuid": "6b0b31e2-fb78-4f0f-bad8-e5eaaca1a710", "value": "D3B412BE53485E2BC9BEB4B84CC510A9D2F9E0157265F7D9FF8280B4EAC9B710B50B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523331, "uuid": "d79c15b5-bc07-414c-84d8-4b77c332323b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523331, "uuid": "cfe0945a-cc7f-486c-89d5-1f78697f0e9d", "value": "12288:0fWSKzMGx8KgjBwvOBbIxYrQwiiw3dAWC3hU/D8a+t2mCH:0czRSftBBbwwnGmWCxUL85t25H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523331, "uuid": "57f4a9d7-b4ca-4032-9e5e-4abd9ad9660c", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523331, "uuid": "64a8de04-3768-4e5c-90a8-2f481d8ad703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523331, "uuid": "24347ea4-c678-468f-8b4f-04cecc51793d", "value": "Doc_Quote 20.5.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ac6571-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530403, "uuid": "b626ff0d-2e24-4746-a504-7d18176f7695", "comment": "Malware payload (Dridex)", "value": "5111e9ecdb1a9c82eb78cb6811b94087", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530403, "uuid": "8c5c0316-fcfd-46ec-a52f-5d5c063cd5e1", "comment": "Malware payload (Dridex)", "value": "577ae5b258f60f63fae8776b6a5774a6e6b9c58dabc14f6db55a6735821d0584", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530403, "uuid": "d92a380a-ad13-4b28-8f0e-3ac1cbf324e1", "comment": "Malware payload (Dridex)", "value": "3f4d599ef4b884c7a79947c24683f99d0f0b7b4a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530403, "uuid": "3fe45002-c684-4030-bfab-a236fbad5191", "comment": "Malware payload (Dridex)", "value": "e0a26675e49866bfb33f57c426fe123b640e8aee4ef2b1209a8ca3e04acff7c9b6defe57ced63fccbca534c2fe0f495f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530403, "uuid": "8e93b2b0-5331-4010-886b-a0834e2ae156", "value": "6304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530403, "uuid": "25fc2036-93ee-4446-9dbb-94a48e474bb7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530403, "uuid": "76f25528-9858-4fae-9f74-1a6567247f30", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530403, "uuid": "d9ce773d-845f-406c-bcde-5b7c96568861", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530403, "uuid": "f60dcd55-0bb1-443a-9308-2132a367d804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530403, "uuid": "16e8138d-e5c0-45db-9ca5-b58624524dd0", "value": "5111e9ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dce6c6-b95d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621509800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509800, "uuid": "d0298bfd-1ac9-4b7f-959c-ce7efb3c8f77", "comment": "Malware payload (Dridex)", "value": "b3a336b79984b1b61a3f5c1fe44b2fda", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509800, "uuid": "08bd9c1d-8ebb-4098-9423-20e1139bf13c", "comment": "Malware payload (Dridex)", "value": "5790b063c02c08c96e59fe8d1001e75e09f462800096e05b101590ef6c3ef684", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509800, "uuid": "1b1ec3af-a1ce-4d39-87a0-3e964c202457", "comment": "Malware payload (Dridex)", "value": "b5c17d13c3fb030c385bc105706775e0e0ce7c89", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509800, "uuid": "178212c4-6c04-4ae9-969e-b3a0aaa883a9", "comment": "Malware payload (Dridex)", "value": "f34b73397107502f9568bc627686d76bd1d08579c70c3fac177a95446449594d0a9d88d5821e5460f233353335faac63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509800, "uuid": "080382a3-6ee2-46d1-bc86-e39c565f4724", "value": "BDF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509800, "uuid": "3141039e-ca26-4030-869a-049701e9f3d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509800, "uuid": "da218dca-8fac-4c85-a299-f7369d738591", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621509800, "uuid": "b5359526-4553-489a-8195-c452be2d71dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621509800, "uuid": "47334a60-36d0-46a8-a67d-8613451d14c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509800, "uuid": "08f1b7c6-5117-430d-a9bf-00d3f9b735ef", "value": "b3a336b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fbf701-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "aa4b5823-a1cc-4664-b570-9fe2c087bdae", "comment": "Malware payload (Dridex)", "value": "c4e70035d05e4e12eb9bdfc609d70662", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "24532330-ba46-4d3c-8712-b2540291c948", "comment": "Malware payload (Dridex)", "value": "5795661afa69b3f4bafd005a02d6a8093764d41cd5b7a412f8969c58fc542f6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "4f49bc2c-b016-4116-81e3-78d87107796a", "comment": "Malware payload (Dridex)", "value": "d6dd731a7c4d39ba2c0602a6329f347a79e35645", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526839, "uuid": "de68542e-23a5-4b6e-8f65-e46c88cc7794", "comment": "Malware payload (Dridex)", "value": "3f58d111ac53fb9d1486b09b301018192dabea5dc533c19faa186c72f3daf9294a3082234c5bf557d49f2e56321f89d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "dca297c3-1613-4cf7-a6d1-8470ee4393fe", "value": "D204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "b85496be-03f0-4733-abc9-accf49ee1c07", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "221225fa-7275-4406-b2d7-86f3fd48c1bc", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526839, "uuid": "438dae4e-16ef-48ec-a968-2a1bb8b17500", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526839, "uuid": "1d76710f-7409-403b-93e9-756b69e6476c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526839, "uuid": "b6ac04d3-0c36-4526-8a84-3de870ca9ae7", "value": "c4e70035_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3abdc0-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479667, "uuid": "1cf32d2e-f9a6-40f4-9410-a9afb896d0e0", "comment": "Malware payload (Dridex)", "value": "8a2827df50866a1411011e8689a47926", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479667, "uuid": "2b4fc320-00d2-4aaa-98df-8b98202f0f10", "comment": "Malware payload (Dridex)", "value": "57dbd7fbc9fd2cfc03e8c27aff20d17b87e05ba7ecfc0fadaf117a654ccccdfa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479667, "uuid": "d9579edb-b47a-48d6-9e3d-60373350ca23", "comment": "Malware payload (Dridex)", "value": "7eb053cefe654024b91d9402d11203f7c72ca052", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479667, "uuid": "e3671ef5-6ff1-46bb-8575-4026bc53260c", "comment": "Malware payload (Dridex)", "value": "83dd8c1124670e437f4c4d7d59cd5b1c2f70ae69e51d17e546002bc8235f59472dbf27bb599a715be981f977b7d75a7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479667, "uuid": "0f2feeb2-2725-4d0a-b9fd-754bd570b66d", "value": "79F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479667, "uuid": "42999f2a-eef9-4200-95f1-ef2aa4897b94", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479667, "uuid": "8b71aee0-9a72-431e-b442-9f93ca1379c8", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479667, "uuid": "ad9df2e1-35a8-4955-ae25-35082a01a0df", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479667, "uuid": "26264460-10c0-43f1-b0ae-1b929553574f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479667, "uuid": "f02cc680-714a-4020-9b63-a5d129ade0d0", "value": "8a2827df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e536cf-b93b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621495170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495170, "uuid": "a1a73c88-20ce-4092-b456-ea184f4a74d3", "comment": "Malware payload (Dridex)", "value": "ede7c3fa5cd7005f1fc8e3aed6993ea9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495170, "uuid": "46552fa3-dad6-46b6-8f9e-50a01896208e", "comment": "Malware payload (Dridex)", "value": "57f7cf511556fd30a1eefa214b22643ca9c7b5e475e0a1a5d133fb39bfe0ce96", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495170, "uuid": "13da40f4-11f0-4069-8bdf-963136969297", "comment": "Malware payload (Dridex)", "value": "f708c0ca32fae46979a727f49806e06c25ecb32a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621495170, "uuid": "52d93a8f-9e8e-46ab-b731-0ead6213176b", "comment": "Malware payload (Dridex)", "value": "6fa7b4082fbcc0c6ba19923af53cae30a6902296de86729b3afe8a65685281bf23de70c652252e042c5f5fc41d44c9fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495170, "uuid": "5dee2a35-9864-4c9b-8019-d933fd6ddc99", "value": "10F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495170, "uuid": "56581028-2a82-483a-971a-8e060270aaba", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495170, "uuid": "54c409da-640c-4ea8-ad84-a38adf495f04", "value": "3072:yIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621495170, "uuid": "fd0b16f1-0af4-4961-9147-664696566120", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621495170, "uuid": "690f8af4-eba0-462a-9819-4eb8bdf69b33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621495170, "uuid": "e08f5caa-e584-4d5f-91c4-d1d10f002d81", "value": "ede7c3fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f235a90-b954-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621505624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505624, "uuid": "72d41539-b4f9-4cf3-bf76-57f6866c1aec", "comment": "Malware payload (Dridex)", "value": "7efa1439bd29f852d95bfb3f1d460510", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505624, "uuid": "215e5b6c-3a70-4550-aa71-5e870999c552", "comment": "Malware payload (Dridex)", "value": "585773a24c6da806ae9376267b054d846b9a6ba7c75ab3cc4cebf2228fa4c558", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505624, "uuid": "310866d1-72bb-4f30-b8c2-2604c35504f2", "comment": "Malware payload (Dridex)", "value": "1cf3588eca0fc6fd68095c5d1853c3ebc9355908", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505624, "uuid": "030fdaf0-df50-4372-b168-dc726d0906f5", "comment": "Malware payload (Dridex)", "value": "df3a385c1b82c11ca6bfc52551bb0825353d1d585ce6db15204d16a168c9501cb680f696d616e8e0c4d47952f3709d20", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505624, "uuid": "4a0651f6-ba11-4593-8ebf-0f43eb7b7584", "value": "2604B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505624, "uuid": "80daf934-b8f9-42da-a5e4-8786541f2e26", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505624, "uuid": "fd92ef6e-59dd-4868-895a-c6fe63d8cadb", "value": "3072:CWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:CWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621505624, "uuid": "41914fcf-c315-4e64-8cfa-59d4e7b2113b", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621505624, "uuid": "b2dfb58e-ff98-4bd4-8a3d-93e2c17f4ef5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505624, "uuid": "4a4ce02b-6f5b-45dc-a330-c4a49f62712e", "value": "7efa1439_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659ac52f-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523808, "uuid": "ac2ea0ae-f301-4c9c-86ec-03d07a33b664", "comment": "Malware payload (Dridex)", "value": "f3811d45137c925749af91ea054289da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523808, "uuid": "61e1917d-c6fe-4a4f-9962-b5ca03ba4a7c", "comment": "Malware payload (Dridex)", "value": "58ba1e31686e1cc894e2f929e1270180889e2b394a3be8eaf23352cb1dce7123", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523808, "uuid": "2b9a2149-e125-429d-bc61-6ea014fcc050", "comment": "Malware payload (Dridex)", "value": "ba8ce198164f3be1080e03fbc9bba21b7505ffe9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523808, "uuid": "8cb84a3f-b55e-48ec-9ff1-93c69d47728d", "comment": "Malware payload (Dridex)", "value": "5a2d5c3d6d046d32ea93f914c358d19c70ded4297ec66aa5e96442c73d75dd20965a805a1ed4e7509f254508e12ddfa2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523808, "uuid": "6920fdd0-7d68-4160-a745-48a0952dbdc0", "value": "C504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523808, "uuid": "9f5e86a3-6868-40bb-9019-06b6d5f292e7", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523808, "uuid": "907a4455-1cdf-44ee-9807-03e24de20cb2", "value": "3072:mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:mH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523808, "uuid": "63596020-aaa7-49d9-9481-b1bc4a4f25a6", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523808, "uuid": "4cacb25d-d960-4702-bf97-3c96c8f4852c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523808, "uuid": "202e6b91-7540-4704-ab30-abcda62e5a9c", "value": "f3811d45_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c49439d-b966-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621513350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513350, "uuid": "3405d943-f9a6-4c38-8e26-c28f2bec585a", "comment": "Malware payload (Dridex)", "value": "6e17d8ce29a8d63f455eb108922783d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513350, "uuid": "c346511d-9413-4b13-8841-ce0701bd15ff", "comment": "Malware payload (Dridex)", "value": "58db682d327c4c367958f44343859ef75a5000ce8a4152921623af566882a20f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513350, "uuid": "39fabbd1-f233-4997-b83f-7ab67d9182a2", "comment": "Malware payload (Dridex)", "value": "a346e783660b9511be9cd3d0d9c1f6c9433fa75a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621513350, "uuid": "457b04f8-0557-4f43-bfa6-77868b123157", "comment": "Malware payload (Dridex)", "value": "ecbb22c03ae9223f018faa0b7e1e1122be2aa1123ee79ee26858ec588376124ae0b76008f1f2d9536cd2e1f8dd4b1805", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513350, "uuid": "ff8a70f3-aaac-4015-8026-11d89d1c0bc8", "value": "FCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513350, "uuid": "5fdba383-4776-48aa-842c-7969127af167", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513350, "uuid": "c5c97c8c-b78c-4622-98a0-6c35664b34f6", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621513350, "uuid": "b4aab070-561d-4cde-a442-a1bb8e47d955", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621513350, "uuid": "14745f96-ffc1-431f-a278-03b94a24e5c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621513350, "uuid": "584e783c-59d3-42aa-8817-56e589e9282c", "value": "6e17d8ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdf591b-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "83fbe1c0-2055-4573-a893-33c33c742545", "comment": "Malware payload (Dridex)", "value": "4a8250cac821ce4752a5ec0ddecd41f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "fc9fbef6-6888-4f5d-9f68-b9110d3f75a1", "comment": "Malware payload (Dridex)", "value": "590a2279419ed7a957aa41939e21d0580f6e1545e3e9c35d4bf385a4b233e783", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "0ac59a46-f496-434b-ab5c-b397ed514f20", "comment": "Malware payload (Dridex)", "value": "b26d8fca004e13d8a5cddeb053d2fb773bf47fb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530719, "uuid": "48697bad-894d-4f8c-ab01-a26a0950584a", "comment": "Malware payload (Dridex)", "value": "a54d51707332bd0e31332e7480c4b1ef70de2ebd9ac6793426b58445a0479736b2fe76dd4e7a5d4300970de93a0526f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "6fee5518-8ad9-4745-aa5f-daa1a7bc05f7", "value": "8204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "1a43b509-9c6c-41aa-a74a-7e9bae3ffebe", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "a4e17e66-99eb-4ae0-b70c-c4133113aeb2", "value": "3072:Ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:JH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530719, "uuid": "5f777598-ef48-4508-9e4c-2bbd07631f9b", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530719, "uuid": "1645501f-9919-4679-b045-a9f9cb27381d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530719, "uuid": "d3b9f13a-ea56-42e7-a20d-34fbaee0e410", "value": "4a8250ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f342b1b-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527529, "uuid": "e325c0d5-b3aa-456b-9b80-ce214ce0177c", "comment": "Malware payload (Dridex)", "value": "368cb8bf9e0f5a0e585fa67b2be05ecf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527529, "uuid": "af5fa3a2-9978-4667-b62d-2e4a211068aa", "comment": "Malware payload (Dridex)", "value": "594c04426b512b6a2c0ef1099100e6519a4b376ac45d8468e24eb55e3c385a78", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527529, "uuid": "4eafd57b-fe95-4e8c-b0f3-5bc2b6a03abb", "comment": "Malware payload (Dridex)", "value": "802dd8e094a6af182c941bbe35c51ce225e1f221", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527529, "uuid": "1262e41c-db22-4acf-a46e-802be19d4847", "comment": "Malware payload (Dridex)", "value": "cb44667eb3fc309a3e0adc8720b1997bed0e719480d16c5805cf43083209b06df9ecb1aaf5fb6f67a2edc8281d56972f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527529, "uuid": "b191ee70-5374-4e4b-a4ef-abb57b9c50c8", "value": "9304BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527529, "uuid": "72543855-f196-4140-ae29-c3898743012f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527529, "uuid": "105140cb-86a3-4b54-9ed0-ff894b4bf15a", "value": "3072:+i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:+H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527529, "uuid": "f7a8854f-17fe-411f-b8dd-80d7d34dea65", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527529, "uuid": "fbddaa3e-e463-47f5-80a2-36a6044fa905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527529, "uuid": "05f55fd3-a81d-4344-bf54-5a480544c6f4", "value": "368cb8bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bc9bab-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545016, "uuid": "e1071269-d8df-4ca1-a5c5-9cc43fd5a739", "comment": "Malware payload", "value": "2a72b5fce6030b4c340ddca7154784da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545016, "uuid": "fe0b0b68-8a24-4e7b-9179-4585330be1c4", "comment": "Malware payload", "value": "59669ad529e38a84a8ed9e730cf02e19e6a186e78ee2db0ebfccb675c9a727b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545016, "uuid": "1b43e41f-9cc6-40b9-8d4e-bc78e3a27ab2", "comment": "Malware payload", "value": "25ac1c4f7d673dae840429183ca25af2a72adde6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545016, "uuid": "e443eaf5-c79d-4d3c-b881-85aa9ed80bf9", "comment": "Malware payload", "value": "6ec7d8aea865a7105ef81b0720e897b7693e67bbf1634b4da95660ffd815898b8dc9e8481b1a03a8e52244ad57f23a28", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545016, "uuid": "2972ec6e-9933-4ad8-b453-6cfd8d6fe908", "value": "7CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545016, "uuid": "2fbf825c-aefa-4a9d-967a-349edbc6f9a2", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545016, "uuid": "84c45acb-fe78-49ac-a4dd-76b3a91760b5", "value": "3072:9A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:93J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545016, "uuid": "1f50739f-1b0c-4df1-bb78-28b8e98fb04f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545016, "uuid": "794ce71d-ec20-402a-b3d1-d97fabceff98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545016, "uuid": "a0271db5-9bd9-484c-a57e-1748739c192f", "value": "2a72b5fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c629ab6f-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536426, "uuid": "ec1191ab-8215-43d7-a619-9b0d1a6a27d5", "comment": "Malware payload (Dridex)", "value": "5c46f37b740763380fdc83132d94fe4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536426, "uuid": "118d21ef-8a50-46b3-8bea-8a3235ed57c5", "comment": "Malware payload (Dridex)", "value": "596750194122218b8deae7f523ae52de96ebb10b74b654aad09c44ff88e73f65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536426, "uuid": "4b27870d-6ba5-48ca-aa4d-26995d3d52d0", "comment": "Malware payload (Dridex)", "value": "690f2ddb2f3e94111ad6b146ff0aeca50d427f1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536426, "uuid": "273edda0-ebe7-4209-a5c0-3de225608104", "comment": "Malware payload (Dridex)", "value": "030bef0fda29dee34932a87f032226d7a5a019045236187a3d463469f8f35e71f841cf80b4d220204f7c91ba1d2432a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536426, "uuid": "59923c5f-79c5-4649-876e-d8c1c3be83f2", "value": "CA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536426, "uuid": "d022c24f-73ed-4298-821f-ba19a564a0d7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536426, "uuid": "8a7dede7-bd49-4b2b-a9ec-f4795e92ace6", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536426, "uuid": "419fb987-9b9e-465b-8ce1-b03fa8fb9471", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536426, "uuid": "91d5ac75-015f-475e-8b92-ae17680bf6d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536426, "uuid": "ffc80a16-b34e-42d1-bab1-7d5c36a72322", "value": "5c46f37b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946ed023-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541926, "uuid": "33852312-5d8b-4045-a9db-ed246dcfe295", "comment": "Malware payload", "value": "6484941c4e99ef52a1ec9870a981ca95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541926, "uuid": "185e208c-a513-469c-aebe-4115a99fc035", "comment": "Malware payload", "value": "596828e4c501aa5de66445fdf05c4519d1481d1dd01c75e18d022d86157c4176", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541926, "uuid": "6ed368fe-6c6d-4138-90a7-e18a76f09547", "comment": "Malware payload", "value": "0873c437f67e1b3a95d149eb88773390d210c8aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541926, "uuid": "7f5a90c9-56ba-45a9-976b-8e52cca6b64c", "comment": "Malware payload", "value": "3515e903c6a8777360c996b1d0b6a776906aa508970a215f599799894160b81ca9126d33eb6b164d53c725890cd11bc5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541926, "uuid": "1381d09f-23b1-4573-946c-e30fa062f39d", "value": "2F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541926, "uuid": "444b97bf-89e3-4bcf-b0cd-2b531a6d57e1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541926, "uuid": "94b44c10-a486-400c-96d4-9360b358531c", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541926, "uuid": "2ba01752-8e1b-4ca4-8ef8-1dd872209c69", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541926, "uuid": "faac0b68-b398-4bc8-9c33-fee3a1e1feb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541926, "uuid": "c177f247-b338-4fc2-a9c7-26e412fe4cd2", "value": "6484941c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347f6d6f-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530598, "uuid": "e528f22b-be86-4363-a3c5-423607c068c5", "comment": "Malware payload (Dridex)", "value": "a6f1ef66c3cfa3e7f0e1cf449c6bc9af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530598, "uuid": "da923d4b-1c74-43ee-b3da-55ec688f9b71", "comment": "Malware payload (Dridex)", "value": "5977e46591cd48bca3f34f8573844f47283c989ec9607fdd460edb6471e18023", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530598, "uuid": "91cf2019-cfd9-476e-bc2a-2a7bad9965ef", "comment": "Malware payload (Dridex)", "value": "b0aca35fbad3574465ea322e7b15f4ab5d04a502", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530598, "uuid": "2a019b6d-44fa-4897-8f82-1c108a3be657", "comment": "Malware payload (Dridex)", "value": "4e016c18604fe98c4e2d4f6828f8bde105edc2ac5528fdaa573e0046b6df22f88dec641e9b142faafc3891e2599e0647", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530598, "uuid": "c968429b-57f0-4fd9-b882-5ccc8085bca9", "value": "7F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530598, "uuid": "ea0dea1f-6d5c-4bb7-82f9-397a3cf8df71", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530598, "uuid": "0e661cc3-2e45-481a-b717-1fdcc387cdcc", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530598, "uuid": "6faed34e-a5c8-48d9-88f6-d25e874c59ba", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530598, "uuid": "63b115c4-daae-4b5a-b67d-c215c20c8436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530598, "uuid": "2dedf65b-fc6e-41de-9f0d-933719a23e5b", "value": "a6f1ef66_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f47b7e-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527815, "uuid": "de37e560-bd27-44d9-a100-fbc62dd83c11", "comment": "Malware payload (Dridex)", "value": "b89ac115044eac09ae3863c5957574e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527815, "uuid": "71f9219a-9757-437d-9b48-37cc04fb0509", "comment": "Malware payload (Dridex)", "value": "59887d1bf1466c03fe9173be6090ae019a64a6a5ea4f7aa1b1cdaa786d74cc76", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527815, "uuid": "e2e2918c-3f77-4c36-9637-a0424a29174a", "comment": "Malware payload (Dridex)", "value": "4a25f4b9efc72bb6044b81856435e05718fe7e00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527815, "uuid": "ddbdccaa-c517-45bf-b036-4f0569f03f67", "comment": "Malware payload (Dridex)", "value": "d753f39815155b18689934927a0ccc1ce49844227ffd26031a3b9b6f8651cd16daecf76f4595b6ce055dfd9f99bc84ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527815, "uuid": "7e14d09c-a91b-4c7a-b953-afc9bb2cf002", "value": "1504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527815, "uuid": "6ac72eb5-b25d-49ce-a932-99d40c2d69b5", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527815, "uuid": "d84c687e-2177-4878-8bb3-7e05a932b44c", "value": "3072:Si49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:SH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527815, "uuid": "c223314a-9a06-4406-8d74-cf39c3b08cf3", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527815, "uuid": "46050df2-62bd-4912-bb4f-663880121521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527815, "uuid": "5def9489-d8f6-4376-a5de-e06eae6934ef", "value": "b89ac115_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a052be3a-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534215, "uuid": "746df3d5-5d7a-40f0-92b9-3052177756f6", "comment": "Malware payload (Dridex)", "value": "154cd8193c6d0ced5a84bd350809dfe9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534215, "uuid": "50b7c481-49e7-44aa-a7f7-f437df30ef43", "comment": "Malware payload (Dridex)", "value": "5a0feacc4d1a77ae117c93f312bf6d994174884e74bbba0eac7ddf21cc818781", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534215, "uuid": "e7102790-9a96-4a77-8fdc-313ac1e1c90e", "comment": "Malware payload (Dridex)", "value": "a1e0c96297105cebc3623976d31dfe93bf0bddf2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534215, "uuid": "37f72ccd-d055-4bc3-bffc-3691006d1ad5", "comment": "Malware payload (Dridex)", "value": "1306ff0da243210474d6c9de5657a763f3ae95d6ac6a06fb9d860c3ec6772264c184c9b80c8c6679d3d448acdb75b934", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534215, "uuid": "2c55d6e1-84cb-4b18-9b32-9bedc91a3e3c", "value": "5F04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534215, "uuid": "45e1b262-9818-4212-b40b-6f07692decbd", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534215, "uuid": "0b29aca6-6065-4847-b70e-8df7a1e80669", "value": "3072:Ti49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:TH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534215, "uuid": "f8baf4d6-fc00-4af6-929b-60b405829078", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534215, "uuid": "35c6af76-7811-4f2a-9465-9acb5d8e3662", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534215, "uuid": "47f73572-e7f2-4025-9fbe-8c809f2e3b1e", "value": "154cd819_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe2a0fd-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621533053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533053, "uuid": "6827bb96-5707-45a7-9d49-8cf5164b5ddd", "comment": "Malware payload", "value": "b5824cb31584b1685a151c77b5969099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533053, "uuid": "d3882935-25c2-4b24-8ff9-68a3071bcbec", "comment": "Malware payload", "value": "5a14c1cd811ccbc4cb76b833ea0dce25bedd6779799a277f4aae1716481545a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533053, "uuid": "071f79e8-da27-4e54-8889-d2bacc037eef", "comment": "Malware payload", "value": "b4d411d4d6ce2a35f43cc232c2fc8dddb36a080b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533053, "uuid": "9f3b6a7d-4988-42b0-85d9-b30ef0c5ca78", "comment": "Malware payload", "value": "4fd18acd9e19b95aee25fa9f8c13ab87655288410f8d52eec9b2c78926c477e1b60928abe9634703004048c8649ff051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533053, "uuid": "faa11554-1e97-4f24-a2c6-7bf097c35818", "value": "95D262243AFE502AF173AF755EE475969A6EF7633A07A86E1041034B4B13A40CED163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533053, "uuid": "3ad85a6d-0af5-437d-bdf2-eeccf011b563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533053, "uuid": "e9cc73dd-86e0-40c4-9e8e-ad49d47ef547", "value": "768:DYt84bFPd0snKsOOAOnDoowgm+CT0ySj44Ij9S:U84bNd02KADoAZCTXuniw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533053, "uuid": "6713356b-a766-4cb6-b011-8fe35c56f35e", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533053, "uuid": "5c0a9228-1e3b-48d3-8ca2-158280ad11db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533053, "uuid": "3535ea81-8217-4dae-8fd9-d2191f550e65", "value": "2TT0900000090000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89ae22b-b981-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525316, "uuid": "537982e8-7974-4965-ba29-66c517a1a7b8", "comment": "Malware payload (Dridex)", "value": "95b3d751186c73743968d8106cdb9155", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525316, "uuid": "bcf13bf9-4945-48b2-a3c0-16cdea87b951", "comment": "Malware payload (Dridex)", "value": "5a27753494350eb751d9af06faee8b51106f388540f4865752b2fa458fa5feb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525316, "uuid": "65327841-ba0d-4793-acc3-4368013e5503", "comment": "Malware payload (Dridex)", "value": "c35dd7a7d31d9559e786072d58c83a0a7f6eb594", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525316, "uuid": "0fe507dd-c371-45ba-8775-56456d739603", "comment": "Malware payload (Dridex)", "value": "5d914d77b1b65f54b4568025ab3abfb26e77e0db5b67c8cf5d79112f0b66cf11f7eeb97e05e93cf42a2ed43f63ef94fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525316, "uuid": "7e46f3e3-2309-4e04-810c-29449898a1dd", "value": "A004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525316, "uuid": "c9e33dfa-5b49-4bed-b68a-e7c97eadf055", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525316, "uuid": "d4504229-750b-4d62-8e72-1ad8591da605", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525316, "uuid": "9188ab31-dc39-4f00-80a1-996638b776db", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525316, "uuid": "b074e312-455a-4f1c-a999-3be38d17c1ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525316, "uuid": "a17d2105-889f-4e13-ab92-03603c499b20", "value": "95b3d751_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b743e9b-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530583, "uuid": "34d2f72b-8681-41cf-b289-a04be1ce168a", "comment": "Malware payload (Dridex)", "value": "b4a2940696e7169afaca567e7893caff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530583, "uuid": "825f0bc1-a129-498e-8100-2967fc8f2744", "comment": "Malware payload (Dridex)", "value": "5a4c82b8755cd515f20f634f4e2ef7b1b61fac4aabf08ef2d73d842f6eabf062", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530583, "uuid": "e5caf6cc-fe90-443e-ab7b-fd763c91c759", "comment": "Malware payload (Dridex)", "value": "1bcd4a546ed105ce94827777b00a135aebb41230", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530583, "uuid": "dd02c4b2-1309-42b8-bd4e-9b2cdc219fbb", "comment": "Malware payload (Dridex)", "value": "316912a7b828dabed9f01c1de9b064aa6ce59abc9bb1e712ae3844964ffacc2a533b49782400aefdc3ad3364a60f38fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530583, "uuid": "9846c934-a8d6-4d9d-a3a0-307588896fee", "value": "AD04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530583, "uuid": "bfec0ecc-c8e5-4fa9-ae58-64633cf35d62", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530583, "uuid": "d5929172-3188-406b-b4db-0d845a0b330d", "value": "3072:8i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:8H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530583, "uuid": "214d7635-b8ec-4780-b876-f4553cb30f34", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530583, "uuid": "4d5e2ff7-4fc3-4b28-83ef-3f0331ca9d4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530583, "uuid": "b6e6a88a-b7e2-42dd-9a3d-63fbaabd14d6", "value": "b4a29406_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b973cfae-b980-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621524808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524808, "uuid": "d1f3e57e-cf48-4052-892b-ece7aec33723", "comment": "Malware payload (Quakbot)", "value": "2ba0bbf7e43052b5129243c8f09f06cb", "object_relation": "md5", "Tag": [ { "name": "clinton21", "colour": "#C4B3AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524808, "uuid": "b818f002-8c8d-451c-854e-cd26d26d9de1", "comment": "Malware payload (Quakbot)", "value": "5a51457b8015e4f9db5a7f257d664dafcbbd8fcc278f9da68c94e2daf425b3a3", "object_relation": "sha256", "Tag": [ { "name": "clinton21", "colour": "#C4B3AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524808, "uuid": "aa45fd73-0620-4296-afc5-994eee3e254e", "comment": "Malware payload (Quakbot)", "value": "b3c3a45299c4050b7f0e5e9ee80a968ffb5cdd7f", "object_relation": "sha1", "Tag": [ { "name": "clinton21", "colour": "#C4B3AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524808, "uuid": "488c9bb4-881f-47eb-9054-62d2e4915fb7", "comment": "Malware payload (Quakbot)", "value": "94014d461a117f9c6586bf2310c42a04eaf4eec96aa90c3be6609957ff704b19fcd925f64d8bcdb1ac8788327d6df7e9", "object_relation": "sha3-384", "Tag": [ { "name": "clinton21", "colour": "#C4B3AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524808, "uuid": "905b288e-8f7e-46fd-92d4-0eed8d826444", "value": "3845BEA43586F132E46510318F95D9FC0728BD14AF5A0AEB37F02F9F6D6CAD26631722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524808, "uuid": "cc5b2e76-8658-46f4-9355-34dd9d21de90", "value": "235afd40c5ee9abc074022775b07e058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524808, "uuid": "6b0992ab-c189-4b7b-a048-24a5a3ec2e70", "value": "24576:gpglnVHGGPP48cedo46suFzpSBz63UUlL:gyVHGGNldotZpSA3UAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524808, "uuid": "73ac7594-9dfc-4e61-9dce-3726839009b9", "value": 1247232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524808, "uuid": "526fec4e-a5ee-4d98-bfad-6f0dd77fbbc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524808, "uuid": "8b0970bd-92d8-46e5-ac69-3805a5f79748", "value": "hikos.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d043a4-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545661, "uuid": "2148eaff-26dd-496e-9c13-8f5c467418a1", "comment": "Malware payload", "value": "68fb31403d73a77df3d466a315f3865a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545661, "uuid": "39736a32-0d58-4f61-a8e7-1eddc57bde7c", "comment": "Malware payload", "value": "5a8b51db0867cd9711f1d0f5968d45ffd6d82c9a29a61b1d3e4f0f380f25ecc8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545661, "uuid": "53507d2f-bc93-47d2-ad36-d1aa7ab4a6c6", "comment": "Malware payload", "value": "334423d0c347a4a0acb2c921fe3c8d036df6270d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545661, "uuid": "273c01f1-f74e-4f6e-8aef-f16497bcadd2", "comment": "Malware payload", "value": "bd5878c4112859a9337d52a84c5eb46012279e3bbf8eca8f5f9e27bc6f2d44a485b5293046131ed476e57cf128864709", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545661, "uuid": "bde9046d-dc4d-4b21-a90f-23fbb831b776", "value": "41F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545661, "uuid": "a83e0ac7-c965-4cf5-86b1-31dada5744a1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545661, "uuid": "2259252a-79e3-49bc-bcd8-b944630d44f8", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545661, "uuid": "da5e0f2d-f398-4085-8632-85a5fc54bf62", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545661, "uuid": "ef88870c-34c4-4d9b-b574-69163d1cbaa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545661, "uuid": "6ab6fbec-40f2-4aff-88c7-0fbeff053e7e", "value": "68fb3140_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb14429-b9c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554341, "uuid": "20c71226-bd13-4368-9d30-99879294b102", "comment": "Malware payload", "value": "f781c47d5be09af65e8a790c73044535", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554341, "uuid": "e78abbc1-fa69-4aac-aeb6-721f228da1c0", "comment": "Malware payload", "value": "5ad5503d2b5cfb702275a913e79db2eab9ac93a4bc0818bce58b15201dce6611", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554341, "uuid": "083a4172-6574-4f6c-86dc-ded6358be6cf", "comment": "Malware payload", "value": "d0611e06d2648e33545be4007ce3fdff927aa2ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554341, "uuid": "f1d6d6d2-feed-4b91-9dc0-3464409adaff", "comment": "Malware payload", "value": "da8d2ea04c41c9173da6e31d3bae0e6730c070db73ab2cb06d5663d7b9eac3aa3a469afc7cb5f472e132e259ba8d2249", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554341, "uuid": "6aeff9ec-c50f-46c3-bfea-d96254374baa", "value": "8004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554341, "uuid": "10c43a3e-446e-4734-bb82-e232465970af", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554341, "uuid": "9c4ed3dc-5735-4769-8382-18f92f963cc1", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554341, "uuid": "f626321d-ad6d-49c9-8029-a12ea445e0ca", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554341, "uuid": "d51c2856-80dc-47cf-b8ed-1a058a3d3bd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554341, "uuid": "983f5b1f-114a-4bbe-b527-2c6e92a5f3a7", "value": "f781c47d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b3d4d5-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523884, "uuid": "ba45ef99-2840-4e81-a328-651b99dd0bee", "comment": "Malware payload (Dridex)", "value": "cce6b046e3cd586e10603b0ffbe1e9c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523884, "uuid": "344e4f29-e04e-4663-8b51-fc96afafaa44", "comment": "Malware payload (Dridex)", "value": "5b0cb411f443e8c137a46ff5916f3d9305e4f7d6624f12c5439ed803f5fd7b58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523884, "uuid": "0da4f119-b369-4e8b-8492-185a1f37354f", "comment": "Malware payload (Dridex)", "value": "6fd209edba8ebaa60f4f6c9adabfba43c56a9477", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523884, "uuid": "a0b25ff1-6b67-41fe-8b07-a862be2e8596", "comment": "Malware payload (Dridex)", "value": "d87647df66baf3996b7b331d882940b3d228c6ad5f978c6fc1a364416dcbcd4a7bd8fb08234cb364a0f35ddf4a4bc0f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523884, "uuid": "99cef5e4-a4f6-4eb4-8827-f20aff134638", "value": "0D04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523884, "uuid": "dfd18005-3006-4071-9135-2b501e438187", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523884, "uuid": "b2ae8136-1098-4c39-a7af-5fe89d28aa51", "value": "3072:qi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:qH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523884, "uuid": "0a6effc9-9ed4-4ec2-8214-ad7193979a2c", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523884, "uuid": "90265024-633f-4f32-a3af-077ef138e356", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523884, "uuid": "ec14d8c4-753d-4234-8743-e5560210530f", "value": "cce6b046_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70a7bbc-b959-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621508107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508107, "uuid": "8e56513a-9e8d-411a-b01b-2a73a15b85c0", "comment": "Malware payload (AgentTesla)", "value": "c6ac9a7ca2016ee14fcd5c846d314aab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508107, "uuid": "a4da51da-bfab-47f5-91a0-1098ba13240a", "comment": "Malware payload (AgentTesla)", "value": "5b2c9f25ec69fc887f9d68e2bf16a2451d814c28336eaec4e52d976723e068c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508107, "uuid": "4e981d3e-8632-4db1-84be-1faef715b70e", "comment": "Malware payload (AgentTesla)", "value": "99b697b1ba6482b6f428c16d9619431bc9eaf7ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508107, "uuid": "81f76476-06a0-45e0-a583-35d39b49acb1", "comment": "Malware payload (AgentTesla)", "value": "c4b288dae4f158c28a00d5f94c2a749fc84625e8bcf1b67213636e0c9a6df70832bb982a6073892ad4413c345bede9fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508107, "uuid": "3b0ba363-ccc0-49e8-9852-29949d3720b6", "value": "36B412152328A79CED7E677CA134D11003F4E626E712E7587D4A50EE0DAAF8BC2E1B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508107, "uuid": "5b9e7d4a-8a40-49a2-8a4c-74a78df73c75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508107, "uuid": "0abf9007-aacb-44f8-aad2-7bbe51fb10a2", "value": "12288:KT71KzSP1UwEZJh9PVo8ovt3ewrmK4gd401xciFZTvbixr+:m7AzSdHEZJhXsVRCKkIccnit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621508107, "uuid": "186caf95-5887-492b-b877-91e9a22fdcff", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621508107, "uuid": "662fe1d5-ec39-4134-966c-a00267c37670", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508107, "uuid": "60c463af-47cc-499d-84bb-a78d3b0bb6ec", "value": "F\u0130YAT TEKL\u0130F\u0130 VE \u015eARTNAME TALEB\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c80412-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529974, "uuid": "1a24577a-2546-4306-ace4-16a3708175ac", "comment": "Malware payload (Dridex)", "value": "e41b7ee1e69576568c37f423a635caee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529974, "uuid": "bec09796-6dc5-4c83-9286-324c2da5d0ca", "comment": "Malware payload (Dridex)", "value": "5b46f37e9953f12335366192a3d697ecd82b814b999e385685dc283303921a7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529974, "uuid": "12e2cff0-0d9a-4067-8ab8-ff597d819a37", "comment": "Malware payload (Dridex)", "value": "ca01f9b6f7b41e63bd44504e0cd592cb935dda6f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529974, "uuid": "e5fd5e0b-c14a-472a-97c8-2bab177556f4", "comment": "Malware payload (Dridex)", "value": "1ef733ffef595e6e0712ea154fabcd6d2ca772739adb1e0dd6bb77f666bb7675a78a62064b559d483653821c003ae595", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529974, "uuid": "59403511-bd46-40f8-b9f4-65053d9f5044", "value": "8C04E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529974, "uuid": "0200b5e9-a4ad-4338-b16b-63266c3f35aa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529974, "uuid": "7a158074-1c9b-4449-a70e-145471a41b76", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529974, "uuid": "67e27697-0294-4413-90aa-f88504d941f2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529974, "uuid": "4d7f30d4-7fc1-4c01-92d5-907ffd2acb3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529974, "uuid": "6014bbab-85fd-4207-8f07-a6b1d2320857", "value": "e41b7ee1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7855371-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541958, "uuid": "f1868cf2-5861-4722-a435-6009b021df63", "comment": "Malware payload", "value": "074e5c253616a6c9cceb05783a9f5028", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541958, "uuid": "f9867657-eaf4-4578-b004-758a4b29d2e5", "comment": "Malware payload", "value": "5b5045dfbe5a315086bcd4aabc8b473edd28bacd8e75248c6b7652959f36b9b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541958, "uuid": "d3a0e41f-cac5-45cf-ba42-d2cd5fb15f07", "comment": "Malware payload", "value": "0fb99e22cc2a068b5c6ad542e4ff6547c3d23a59", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541958, "uuid": "1983db62-b6ca-47d6-9d89-2a69c4c4a849", "comment": "Malware payload", "value": "70fa2f27d8461a08ba9aa8f4ffcdf6bf887bf9f0e05484e4ac55a11467d74c91ac51a8ac73d9f65475c5f483010dbc5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541958, "uuid": "eb75a239-90f9-4762-9f76-52686b8a1a40", "value": "3404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541958, "uuid": "62436440-a4af-4ff1-a6ec-02ace7364950", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541958, "uuid": "e23f8f1e-cd1e-4633-9bef-4e973a535c50", "value": "3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541958, "uuid": "336b603a-49b9-4985-9808-72c4c1d01ce6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541958, "uuid": "376a4d81-9df5-4d44-b861-d12401e357fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541958, "uuid": "41f05539-4ea1-45b5-8804-32e3e294385c", "value": "074e5c25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c896831-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479635, "uuid": "39c7c6ff-6883-47b5-8091-8683d70789fb", "comment": "Malware payload (Dridex)", "value": "c91765b9f39eadf68ffc5662c4e1d770", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479635, "uuid": "acabbbef-c368-4548-8c02-72693c0825b4", "comment": "Malware payload (Dridex)", "value": "5b54c32597af7c7d6f12f42884317fd0b2d25bb754dfd6827c189ae6b3e2ae4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479635, "uuid": "deacc3ea-98ee-4b48-9eac-67ea95e0e188", "comment": "Malware payload (Dridex)", "value": "86a15e9eba6198584da32a31c16bc289abd4007c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479635, "uuid": "7841d432-8550-47a9-9dc0-0c48d89ed5da", "comment": "Malware payload (Dridex)", "value": "02ba49551ff34d8a14a5edfba5f00474ccefdbcb6df9fcacf4add3c2a8c10fb54a597f639323e6ac0b99bee833729681", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479635, "uuid": "31fe6abc-dd0f-47a8-a4f6-641248444c2a", "value": "EAF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479635, "uuid": "e2f85e16-b6dd-4c71-afd9-84c18b18ef45", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479635, "uuid": "5c0c9750-1806-4927-8ea6-7071a0206097", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479635, "uuid": "9c5ae64d-9279-4844-8012-ea99410631af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479635, "uuid": "c9e4d209-f333-4724-88c4-4722d8419ccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479635, "uuid": "bc5520c2-97af-4b4a-947f-70d5fd732f0c", "value": "c91765b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2419f14c-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528852, "uuid": "b7fb49ae-4efe-448b-babe-91481c07e0e2", "comment": "Malware payload (Dridex)", "value": "a254a04fddf4c6b94d69575e184d2948", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528852, "uuid": "37b9282a-16fa-4406-9570-22ad62b61ea6", "comment": "Malware payload (Dridex)", "value": "5ba66dda03acb14e858260ce4236af173f7cf6a4b608c11176f88167932193bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528852, "uuid": "cca6f546-681b-4d31-a89e-af6ed4c17568", "comment": "Malware payload (Dridex)", "value": "6e1ebb619838d67a6f73ce20da7da56ddff51f8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528852, "uuid": "2a0af968-c002-4d46-9347-a0cf8cf898c4", "comment": "Malware payload (Dridex)", "value": "93ebd3b94dd654e0ed63aa77df8398fc9fa362cbb3f23223f7ab6b1161e08af7ad288585c802e4c89ef4368600c7f867", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528852, "uuid": "61fef0c5-1fde-40f2-aa83-3ce85031f407", "value": "3204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528852, "uuid": "70c25821-005f-479e-abb1-31de9a4d84b5", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528852, "uuid": "37c8c5e4-3090-4288-85e2-d4623ee50511", "value": "3072:ai49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:aH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528852, "uuid": "89c4d45c-fdc4-4cbe-b5f9-2da02ca10264", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528852, "uuid": "a2ff08ec-0e94-4e8e-bd08-10b1bf3ed4f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528852, "uuid": "0c951bf4-2602-49d4-b7a6-d282175bc3f7", "value": "a254a04f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7175b1-b97e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523848, "uuid": "53a06958-17aa-4b5d-89e2-f3d66e0fdab6", "comment": "Malware payload (Dridex)", "value": "5b89e6a957edad2de693ffb5c1efd549", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523848, "uuid": "2e1adc30-8dd3-4bc5-a413-99194aac9722", "comment": "Malware payload (Dridex)", "value": "5bd3e4e38e0cc3b952ea63eb3c4d7900d9c3ef0442b2e4655c6676e880a66a41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523848, "uuid": "62358fee-333b-4117-814d-fd262dddc634", "comment": "Malware payload (Dridex)", "value": "cdf32aac6f914477bea474b4fd045b477ca8d171", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523848, "uuid": "64ec17b0-7f64-4fdd-a2f3-50fd1acd39de", "comment": "Malware payload (Dridex)", "value": "78386642e9bbf83629297609e6041f7d52ce864589e1a15b639ec28d29ed2955873ab96a888de39d9dece47042c89197", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523848, "uuid": "15572536-1fad-4a30-a614-9d49bceceb78", "value": "BC04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523848, "uuid": "13b06dab-639d-40b6-af1e-a07f3d8f1c81", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523848, "uuid": "28a34031-fe87-46f4-bcfb-3d8f7eb74e57", "value": "3072:ni49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:nH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523848, "uuid": "abfaf896-826e-40f9-aad6-3d58e6bf2716", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523848, "uuid": "f938b5b7-4f3f-486d-aaae-18cbfba2a989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523848, "uuid": "3a684aae-09af-4a2e-8923-a1943b62f6ac", "value": "5b89e6a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f4000a-b978-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1621521158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521158, "uuid": "31c47c79-d226-4c0a-a481-05fe935a5b34", "comment": "Malware payload (NanoCore)", "value": "6c92e49ac1316c25830ae5d1ece9789c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521158, "uuid": "b8bdebd2-f6db-4b21-90b9-142adf993518", "comment": "Malware payload (NanoCore)", "value": "5c144aa27509052b62efc670730feea369429f0dc60ee69f85cbdd7842c0d3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521158, "uuid": "9ac365e5-c0a7-4239-84ea-56d564bef4cf", "comment": "Malware payload (NanoCore)", "value": "2b111b61af39d45f9aa207c53c4142665b3bc8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521158, "uuid": "9066252e-8c0b-4009-bcd8-0e92059c559d", "comment": "Malware payload (NanoCore)", "value": "a21225a95ac838822b38802f0616068c94df44e44f9e5180d354e695b911108b0bc50a9211a0cd85af545d227501ff8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521158, "uuid": "97bb12e9-048c-401b-ad76-303814932056", "value": "FD15227C56DC4EA7C6DE923886D5214146FCC03D3A87FBB1ECE2A4BE6B42372151A0D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521158, "uuid": "f130e19f-8392-4885-8fb8-70b71d69d4c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521158, "uuid": "512b236f-0811-4004-b3cd-65b970bafedb", "value": "24576:H+mLBsJf4kFcsXCQls66K7pHL9s7KYAtnTiirzHSzind1S:lLOJf4kB0RK7J5CKYgJjSzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621521158, "uuid": "27dadd66-3b8f-495e-af3d-23dcc53bf0f5", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621521158, "uuid": "dd262849-3630-4676-b1d3-ef16d37988c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521158, "uuid": "9524d7cc-83db-468d-a9e8-4660f892f501", "value": "6c92e49ac1316c25830ae5d1ece9789c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0fd7ee-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536915, "uuid": "985b86f4-d83d-48cc-bcb1-03d2059c336f", "comment": "Malware payload (Dridex)", "value": "0e287207786d7055deb9c073c635126a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536915, "uuid": "5ef4acfb-bf6b-4537-a3f9-93b092f3f1da", "comment": "Malware payload (Dridex)", "value": "5c149b662607b10a1827dc16f83a10de8bdcbdad770f826dcf7cfdcea5450b48", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536915, "uuid": "ac0a3f74-8e78-45f7-901f-a5cd578e192d", "comment": "Malware payload (Dridex)", "value": "688cfae15ebed735e58b4670c61fba8994d79ce6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536915, "uuid": "d54393f6-46c3-4897-b721-fcb359a77a83", "comment": "Malware payload (Dridex)", "value": "09ea5eed2c743cb47367d13a948a0339687e3fc52ff4b52193269c8dc2620b431e69695385468f279e6ee159f9e89901", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536915, "uuid": "f1642ffb-b3da-494e-aa60-6f17a4be2f0b", "value": "7804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536915, "uuid": "be2e9c9e-9f9d-45b5-8820-9a34c8f4acf2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536915, "uuid": "de79110c-5e4d-45fc-ab8e-bf8d69ce0a4e", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536915, "uuid": "78cc0d74-338c-400f-a8bc-2ee1ca844e77", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536915, "uuid": "08c76046-bf7e-4138-8d50-b11051b9ca78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536915, "uuid": "2e7915c3-f26d-445b-9df6-35901a2f0ac6", "value": "0e287207_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c920afb6-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483602, "uuid": "b222730c-7ee4-442c-980a-7fb042e163cc", "comment": "Malware payload (Dridex)", "value": "1723cc374e523f1925cf4acc3c5afd25", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483602, "uuid": "b989da91-6361-424a-8933-1629997aa9dc", "comment": "Malware payload (Dridex)", "value": "5c362eb2a5cc1314757163aa31fcd8a5ad1094d38148a183db7cfc0ad6454609", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483602, "uuid": "8e22cd0b-9884-461a-9b8c-468c2ae61798", "comment": "Malware payload (Dridex)", "value": "2e82d625c55a1985f2a177ceb53d5e0b33e81369", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483602, "uuid": "beb0aa9f-fc64-44fb-a5a3-7fb79afde958", "comment": "Malware payload (Dridex)", "value": "2d8c3d89390b26e6427242fe451f6f5642950bfa2a15631c1f8bbaae5a883d11e7f507c6b0ece09525b4e59d895ac707", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483602, "uuid": "2825a041-fb28-47df-9eb8-58102d33a33b", "value": "1BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483602, "uuid": "cb76a895-a4f4-4356-af44-4ba78b642eb2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483602, "uuid": "0da04047-7f09-4b27-a247-779022cffee9", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483602, "uuid": "08d3ab61-bd45-472b-b67a-ffbcbc6ff712", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483602, "uuid": "a8518d77-4e90-4874-9e20-ca25b6fbe4c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483602, "uuid": "a434c7eb-0993-4341-854c-9c6741edb26b", "value": "1723cc37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b745c3e-b96a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621515121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515121, "uuid": "5c70434b-00c3-4cae-a979-8f35e82998ca", "comment": "Malware payload (AgentTesla)", "value": "1aeb4a3096a3bb07468160d0110c7e5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515121, "uuid": "d8deea75-cf7c-4085-aa00-75abf264a976", "comment": "Malware payload (AgentTesla)", "value": "5c552c070f43c3ee4c3d278163d4082aebd1697261a8209396efe32673ed0f64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515121, "uuid": "9e7a2e87-90be-4359-9e18-69d5ed08d415", "comment": "Malware payload (AgentTesla)", "value": "19e1932547fe32c423c5f57adf7cd36df96b3b2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621515121, "uuid": "90738b56-1beb-494d-9dcb-d69714de9793", "comment": "Malware payload (AgentTesla)", "value": "aa1b3dfa897f9a326904a9720de443f1d0303786f2a95da145d67ff020ddefc8e908cb5b25791bcc258248ab6d8262ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515121, "uuid": "a2f0a05e-e771-4e15-8041-1f6a80bd232c", "value": "5405C06E715EAA04E4FC973684D9C03062BB9C979261D63F38E5355F0BB27ED019AB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515121, "uuid": "082ddead-952a-43f4-b7b7-b4df0928c39b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515121, "uuid": "79319e80-080e-447e-b069-304713e28dcd", "value": "24576:BP9QnFDArigD2VoaSD5K1GjFiRUIJ8jYZ:t9QnIDGI5KgxxIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621515121, "uuid": "6a41f1f3-27b7-429d-b073-cc36a99c413e", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621515121, "uuid": "d016cde2-eb3b-49d4-831d-405a07d43f14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621515121, "uuid": "537623a9-b0ac-48cd-9227-0be5d13ab132", "value": "Doc_987945678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685ab573-b9b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546576, "uuid": "443a60ab-fa5a-420f-925d-9c912a0d4043", "comment": "Malware payload", "value": "8756c219f0ca5b5ecd67cc200934499f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546576, "uuid": "936245d1-58f6-422c-921d-ba6c6f8cc2e8", "comment": "Malware payload", "value": "5caa3c4159fcb3cd5562df5e78f38ad474d0f7384fc8f883791f89b8e951f81a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546576, "uuid": "42e07c92-9201-46f8-82e9-f1dbb53e1367", "comment": "Malware payload", "value": "04e51a07468c54b091e0e3da7cb937a7ab2815ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546576, "uuid": "0a9ec4ba-e3a3-4b52-b609-2a9f32654d4c", "comment": "Malware payload", "value": "bd61e2f90a151efcdaa747cd1f3867d016dbab0e730ed94ba0ac83999d2258fd44ab4b9d903c64d28022c2d2c2298e0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546576, "uuid": "6614522e-4cc4-4765-8142-e79ab90d22c6", "value": "0404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546576, "uuid": "1d7d69bf-4cb0-4475-8aa9-e6c0ab277c88", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546576, "uuid": "ee71e02c-bbc1-48af-b725-93dc21778266", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546576, "uuid": "c452933e-fc8b-4d5e-9e8d-106515f6dab7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546576, "uuid": "e71353aa-a894-455f-8eaf-55210097c375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546576, "uuid": "2291c382-6806-4468-b744-e1a5af900706", "value": "8756c219_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1c5e57-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529835, "uuid": "ca75566f-c70f-4153-a536-d240658f6701", "comment": "Malware payload (Dridex)", "value": "986b43b6cfbfd949804299e0252ec3f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529835, "uuid": "27080fdb-79f2-4d90-bbb5-2c0c50b0c3e0", "comment": "Malware payload (Dridex)", "value": "5ccf2aa223f46dc70b634edb72adc9d42f6e348d746912c6cd8598cef4fdf12b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529835, "uuid": "7120e57e-44f7-4ccb-86db-0bfcfe2a4e4e", "comment": "Malware payload (Dridex)", "value": "b465a295b2adcca92fe9416e238c8e3d0ba9d702", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529835, "uuid": "f50d5a0e-451d-40c1-9901-e4a98e0601c3", "comment": "Malware payload (Dridex)", "value": "106ff28917bfdcbda20db0548c489c5211c14b5293103668356ea97fe11da0287ddc24c99b65760a331e0a608cc86189", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529835, "uuid": "6166eca1-9f32-4d24-bcb0-415396413d3a", "value": "E404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529835, "uuid": "8d467523-b8ba-48b0-a069-368599344ddb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529835, "uuid": "ff03a943-c172-44de-9273-a74075464858", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529835, "uuid": "41f12492-bbd0-4ef1-be6d-aba8e83c8203", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529835, "uuid": "3da6a7c7-79bf-44d3-8db3-b4281872c78f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529835, "uuid": "a6cb3cdc-7655-4f0d-9062-a4b20a4241e9", "value": "986b43b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e317d2ff-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536904, "uuid": "269df9a9-7dcd-4bd3-b1c7-6c3f8454b3de", "comment": "Malware payload (Dridex)", "value": "f6c8bfdf688e578a6634574b239640ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536904, "uuid": "4cef0e24-94be-41c2-8566-0cf590c5d7e5", "comment": "Malware payload (Dridex)", "value": "5cd4446d6cdb74f7430ad36873440da9447a929c2fe2545e93cbdde6c2a24998", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536904, "uuid": "027301d7-4cd8-4c34-86aa-36d653eec883", "comment": "Malware payload (Dridex)", "value": "761f390476fad1d60383cc01f945fd2e0d4dca00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536904, "uuid": "cd556aa6-a137-4a40-bda5-fad08154ead1", "comment": "Malware payload (Dridex)", "value": "a6d66e5317f8da9b06ee00e3b0cb5aeea5596283446c98b436be2590bbe642593d4f589288da011ef2268ac52c6d5ed4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536904, "uuid": "20c7cfd0-7b54-4d80-a0b2-5f489a365c2f", "value": "AA04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536904, "uuid": "3f17adde-0c98-4516-932c-43418be663f6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536904, "uuid": "e2c46d69-e756-490b-9973-a9d27f5bc9c0", "value": "3072:0i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:0H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536904, "uuid": "9b27c4d8-b2b4-4626-829e-7a53662f29e5", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536904, "uuid": "0c2a3ed2-2c39-415d-a4f5-b793affcc980", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536904, "uuid": "084c56c1-7218-4ebf-9c5d-0995aa097e96", "value": "f6c8bfdf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db959f5-b974-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621519581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519581, "uuid": "fe84798f-3be1-49af-b0ae-6d9e52e87faa", "comment": "Malware payload (Dridex)", "value": "b44fc4da032f4e79599f0f5409cd5b6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519581, "uuid": "3f3d33d2-42b7-4181-b268-20d756baf21f", "comment": "Malware payload (Dridex)", "value": "5d41b4759a5f5abbb94140a27b5689a94230123c295ae5ab1c6fbeead2041217", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519581, "uuid": "fd558e4d-38f7-4c4b-8ef9-fc1096da25dc", "comment": "Malware payload (Dridex)", "value": "6b9e4877be78bbefb710daf88cf66b77281a3b72", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621519581, "uuid": "acf1ba1d-7d67-4bb4-b782-68526ca72c69", "comment": "Malware payload (Dridex)", "value": "141fa5acf1acf3ca19901edbde34689021ced74765187ed5b52a17e3d390b606c615d5873b9b68833f068346a437aea4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519581, "uuid": "5352191e-f4f9-4980-9087-0b5e9524d2fd", "value": "5704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519581, "uuid": "42938dcc-fa66-4fee-a97f-cf1b97f17fd9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519581, "uuid": "d10861b2-2951-43cb-bb93-56472ea330d1", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621519581, "uuid": "9d99aa0d-1ecf-4401-9cbd-eec29e0fbe63", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621519581, "uuid": "19843f10-9786-4605-b095-697aa54f9447", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621519581, "uuid": "6828cb44-88ec-46fa-b1cd-0c96059da14d", "value": "b44fc4da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aef79a0-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "fb2494aa-7399-43f3-b1eb-7a15323266d0", "comment": "Malware payload (Dridex)", "value": "20d8e9890a7a31527626fcd858df3694", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "9ca6c6e9-ee5f-440f-9283-5209ec118b9a", "comment": "Malware payload (Dridex)", "value": "5d5214bfaf4f0cea43db60c1ec5110772a860c5d7b3e61238bab6140e61d7411", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "a17959be-e880-4859-b8d8-8fd7d05f0baf", "comment": "Malware payload (Dridex)", "value": "40d92033cf03b61d21a682235cd4886771236879", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531870, "uuid": "7913977c-cbc0-4912-9615-d421fd8ba91f", "comment": "Malware payload (Dridex)", "value": "b8529ca1538fae520e4ef108962de1ec278b939efa769c1918820b9f794ae34e486605135c2fec93feba401812d25d52", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "aba3bf74-7afb-4821-b6de-4ebe4b16fb4c", "value": "F904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "d4c9332e-bfd1-4a95-8fe2-1eb4f44adb38", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "23eaca0b-3e20-47bc-83d1-464a2deb4e2f", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531870, "uuid": "8f1862dd-218e-4cea-a458-55ac4f2bcb1a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531870, "uuid": "eb93839b-64db-4061-bf52-d6956e59ce62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531870, "uuid": "511e94c6-3a99-4ac8-b72b-06aa1c13f030", "value": "20d8e989_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13303c61-b9be-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621551158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551158, "uuid": "36f0cfba-f290-4eae-8cce-5638cfbc88c2", "comment": "Malware payload", "value": "32d3ba9985f5406cf924967aee40b783", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551158, "uuid": "8bdeaaf6-c9e9-4077-99b6-24eb2eeb6ff6", "comment": "Malware payload", "value": "5d76bfaedba0816abb91b0f38b437110e6556a733e063ec9f86e178089a502f8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551158, "uuid": "94241689-5136-46f1-a6e3-17f72bdb17ed", "comment": "Malware payload", "value": "8ce5a276bac2a88e5b84ad668c5b781ca0956f03", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621551158, "uuid": "4e2c32cd-d8ad-45ca-92cd-06ab18c59fca", "comment": "Malware payload", "value": "2a101b19ce6b82e586f5a28e68929489949a8fad2089c1054335f5b5e8914c9f94a19a5c532902c7c5356bfd05acead9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551158, "uuid": "b58fe01f-f8c0-46b3-80f0-3d8c513fdc8a", "value": "FA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551158, "uuid": "8f8915d6-cf33-4bd7-b87e-8e45e9f7a48c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551158, "uuid": "10dc06c4-43e0-447d-b355-4318e9b0e861", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621551158, "uuid": "e0a24641-a499-46c0-911f-8a5027bafa96", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621551158, "uuid": "ef99d192-ecb3-459a-a664-e6d24c0f1858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621551158, "uuid": "57953c58-ab87-4716-97c2-a1a7ac770a9a", "value": "32d3ba99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52aecd4f-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531937, "uuid": "2beebfb8-8a7c-4ac9-a1f6-c93971f07261", "comment": "Malware payload (Dridex)", "value": "29e12e302c159eb0a867381d85607e35", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531937, "uuid": "adb3cf76-9f61-432b-bec2-4900b66ddde1", "comment": "Malware payload (Dridex)", "value": "5d9616edc48a8c7535c70edadbd66d5f63e18eac44feb4bdde56d9291f7231bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531937, "uuid": "6ae1a04b-3305-473d-8469-5bee1143ab7e", "comment": "Malware payload (Dridex)", "value": "80e92481386c15859a98271613f13139533fa19b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531937, "uuid": "ac608191-4111-44c3-a0df-7749601b219f", "comment": "Malware payload (Dridex)", "value": "27e2e307d30b3fa8da0d31f8efe03ff8906699887ec3df6fa3fd32a8d72ff527a52b6c1ba8aa8bf6fc817d44992e1d01", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531937, "uuid": "5d3e2f2b-af8c-4ed7-8497-2463f44375b7", "value": "D304BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531937, "uuid": "daa729a1-c117-42ba-a72d-11ece9229ddc", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531937, "uuid": "3bf04a81-b3ad-4b39-8af0-3a327a0e46e5", "value": "3072:3i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:3H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531937, "uuid": "bebfb3f7-31a4-4664-b1fd-79d0ff458693", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531937, "uuid": "16b9dff5-659d-4794-9ede-7b527f251c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531937, "uuid": "965cb5a0-5a8a-404a-a207-63edb119abae", "value": "29e12e30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715048c9-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528552, "uuid": "a9954fca-07ff-4f0a-890a-c557beba9d82", "comment": "Malware payload (Dridex)", "value": "9efe048db16fa4beb4b88420e2238673", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528552, "uuid": "5502231e-127b-4d51-9860-406e10357b63", "comment": "Malware payload (Dridex)", "value": "5da770b9dd09946dedbff6f2535e712165405d674ffbe726d67bb83502ae5533", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528552, "uuid": "1cca42b4-d04d-495e-a5ec-1d4798fa1727", "comment": "Malware payload (Dridex)", "value": "f61b7dc609dfd8f71aff010ea7b0df96f9050ce2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528552, "uuid": "0a824d6a-29ba-4aae-a850-67e859d4ffab", "comment": "Malware payload (Dridex)", "value": "0148e9c3c2e80baaa21acf263313f6481ecc55eb14d41ac4d5be7c2974f36d4740c7df77fe416b1393e6e106fc941dbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528552, "uuid": "507d094b-2f6a-4285-b29e-9c24517c4b9d", "value": "DE04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528552, "uuid": "f1a40af0-6530-4c93-9b93-8ac57567a0a6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528552, "uuid": "aecfb56e-fe64-4f30-a024-badbdc590a85", "value": "3072:pi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:pH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528552, "uuid": "19a845e3-0f8c-4a31-afd3-a3ee76dbd896", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528552, "uuid": "e7e0d98a-50c5-4628-9c46-e1f1bb954a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528552, "uuid": "ecb124ba-e29a-4759-a6ee-8b084502c95a", "value": "9efe048d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80175387-b97d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523423, "uuid": "095f87e9-41c7-44ed-84f1-7d2fd3938ff0", "comment": "Malware payload (Dridex)", "value": "5a2334e5e1e6d9c361f713b4a9db22b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523423, "uuid": "9d9d5de0-64b7-4039-abcb-c6cc8fa6c16d", "comment": "Malware payload (Dridex)", "value": "5dc8f98f0393b6bce62e5bce8f554c99c0fe91667902873aa95e0748a0297cba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523423, "uuid": "e4b231bc-c78b-473b-962a-322dcbabd3cf", "comment": "Malware payload (Dridex)", "value": "c0a12b608332af0ec18d99ec5c354b1632a785b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523423, "uuid": "e9160542-1e8b-4d6c-b372-eb460937d804", "comment": "Malware payload (Dridex)", "value": "a60fe153563179d9be5c40a840727b7caf8ba2b2df34ecb464cd7e7b5cd72ec16047f5445e8d916bdc95cbcd301ca1a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523423, "uuid": "cad2045d-5f7b-4fd5-a966-26ad738109d2", "value": "F504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523423, "uuid": "ba7b47b6-10b8-4db7-a182-fdb5dc45a456", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523423, "uuid": "e1923421-c328-49dd-88e8-329c655654a3", "value": "3072:Sai49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:SaH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523423, "uuid": "c07a39b1-1f57-40bf-9193-66ea7df14614", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523423, "uuid": "a4ebb969-4fec-405e-a965-241a42a75cf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523423, "uuid": "bcf2113a-492f-48ff-a87c-b0e262da2aa8", "value": "5a2334e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e3c0c4-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476155, "uuid": "55e44520-97d9-4330-8076-8406c0ec51cf", "comment": "Malware payload (Dridex)", "value": "a8c0ed8dfc674e55290c701d1c539744", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476155, "uuid": "82bbf7a5-b33c-455c-85c8-9236b24820c6", "comment": "Malware payload (Dridex)", "value": "5ddc31c5bae49f9d2731e4c7b73a62c0b6b6da868a225f89e081ff048b5c814e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476155, "uuid": "56f7a192-9c48-4b83-a420-015cce4aaa14", "comment": "Malware payload (Dridex)", "value": "38814e5c0be18b7e68525216e484c2c0d4093e5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476155, "uuid": "6a2b9e73-059e-4e83-b0fd-083d2369e0b2", "comment": "Malware payload (Dridex)", "value": "c56faa205d3023700b5f3cd2ee97786541661ec770d521b6cfb391f3df2fefad479a479d114552433140de538262de16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476155, "uuid": "cf7940e4-8f3f-4262-a543-e67311a040d2", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476155, "uuid": "92d2451a-504c-4594-8711-ee7668d014d2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476155, "uuid": "5cfbafc3-cd38-4e24-94ad-8b5bfd0bbf11", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476155, "uuid": "cd333ef8-c640-421f-9769-e9acf581d206", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476155, "uuid": "495b3c81-ab0b-4c8e-8b37-e32e5a364d0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476155, "uuid": "7e9104ed-12c0-4edc-88d3-fc8a4b76b019", "value": "a8c0ed8d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd05ed8-b9c6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554583, "uuid": "268c20c6-04e4-4748-b954-02ae019187aa", "comment": "Malware payload", "value": "f5db2ff37d8b69169d49296c720a385f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554583, "uuid": "f414a43f-53e1-4813-8867-7390d8072ec2", "comment": "Malware payload", "value": "5e11cf48044d9205c628ab903bf6b1f707d0e61d5b72effcaef1b02298938b2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554583, "uuid": "a534431d-f6e8-42c9-a9e4-f2263eff3aef", "comment": "Malware payload", "value": "548537b11b31b7590845cbdbc2734190f276ab7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554583, "uuid": "e76b7a42-6e62-49bc-93bf-c0e0f16fa42b", "comment": "Malware payload", "value": "9402511c6a073e705cb94c50fc3fb2b2094fbe90b037eaa86f1e72d01757e15d27b1d5855265960011f5f3649c2077d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554583, "uuid": "a49d64dc-e980-42f6-bdf5-d2f415abd96c", "value": "E904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554583, "uuid": "1bff6f07-150c-4612-abcf-a19f1898bdd6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554583, "uuid": "dc9a9737-9a22-43a0-b128-a6c6bb86f72b", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554583, "uuid": "cedadedd-92e1-4cca-ba25-c280a4fc729e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554583, "uuid": "f67da2a0-12a2-4931-904e-dde9f5e3b6dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554583, "uuid": "dfff9599-7863-4d2c-ae1a-597c70f1eba3", "value": "f5db2ff3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c0ac9f-b94e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621503333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503333, "uuid": "66e4b66f-8c44-487c-988b-0bad99c20568", "comment": "Malware payload (Loki)", "value": "72f923d59ab511b8f13b5585f0650174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503333, "uuid": "e841ef2e-54c5-4cbe-931e-2b808436ee7e", "comment": "Malware payload (Loki)", "value": "5e11d890cf8cbb18e1004316b33b6dc514ebf844b966b07766568e4419d48458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503333, "uuid": "5ab42ea3-ef85-4325-afb7-6cddb562949e", "comment": "Malware payload (Loki)", "value": "8aa763cdf4f4acc69cbcd4c5cd3f123ef427d284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621503333, "uuid": "7a6d54d3-13ac-404e-90c2-88dd1145e763", "comment": "Malware payload (Loki)", "value": "2588e48a08aba991d0a455cef6d95f883e67348dcd4c013a76ecb9e17f0926c30cd5de46057d1d0cf8aa2a7bfc7dc29a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503333, "uuid": "f003ef1a-bbda-43d4-a239-74ea2c9f4ac3", "value": "1AF3F196B1E084E3C45643712973CDBAE377FE084932666B9B947F661DB32C3640A90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503333, "uuid": "2803fc1b-5bb2-4978-8b02-6bdcccaaa955", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503333, "uuid": "356479e3-4e4d-47d4-a2b5-12c5688e5095", "value": "3072:MQIURTXJCYbjFMqJC24OEIvQ3gcH0Nowd1AJPeHvZQObcf7C/p1:MsiP2tvQ3T0Nowd1AJPkvZNm7Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621503333, "uuid": "dfdffbb8-8d14-43a5-83a1-ef99d5c0df46", "value": 171361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621503333, "uuid": "36fd9036-7c5a-4d9a-95c5-098c67119371", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621503333, "uuid": "4ac8cb70-16be-4627-b2a5-e4ff6bc9bedf", "value": "SwiftCopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc031c9e-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533832, "uuid": "c4789dce-9f5d-4e8c-b63b-06d914147e6d", "comment": "Malware payload (Dridex)", "value": "15b4ceadb43c3b4fd34dcec8bae045e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533832, "uuid": "09d7f592-7507-41f4-9029-92026d4fd463", "comment": "Malware payload (Dridex)", "value": "5e341ef848a623f3bbadf26135ca0af0cbf500a9a1460228daa6a8c6aa3c3b26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533832, "uuid": "ef38f749-c001-488c-9521-80b303cdcda5", "comment": "Malware payload (Dridex)", "value": "f9e90636b6a6b42eaefd528455572b18080093ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533832, "uuid": "d489c0e1-402d-4c5e-b8e3-d9778d97005c", "comment": "Malware payload (Dridex)", "value": "04109e9955d4daca9ad4c41bbc83531f4e01b8cf20d475463fe01d9ebac851cc8f61a99bc0ff1fd67254aedcb84dfe43", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533832, "uuid": "5e0ab7cf-70c5-4aeb-b2a7-9e1c06484b27", "value": "D604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533832, "uuid": "4da67204-bffa-4300-9c7e-c5fe2f96d826", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533832, "uuid": "47b1ddd6-3b82-4af1-be74-120f21622912", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533832, "uuid": "e12f5b93-65c6-4453-9956-510b83a0f6ca", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533832, "uuid": "c5e73cd1-bdae-4516-b89f-0d63799764f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533832, "uuid": "a54ff5eb-1217-4758-a642-d544523758f9", "value": "15b4cead_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f37e1e4-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483398, "uuid": "b94b3ea8-de3e-4e32-9405-ebea2413ecc6", "comment": "Malware payload (Dridex)", "value": "5eac6931bfbe69968f251b3efcb15bcd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483398, "uuid": "ff4fa94b-a5ad-4171-b7f6-fea403ddfc0e", "comment": "Malware payload (Dridex)", "value": "5e5777e5a9be4bfff65b803e761d740447bcf9a7506d158318ba76adc0d565ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483398, "uuid": "3aa37c18-8da6-4875-9c81-73d6fda9c79d", "comment": "Malware payload (Dridex)", "value": "b69ef18d575c3263cd9aa4e95492f5cf0e4f9c01", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483398, "uuid": "3b5fe654-6bef-47a2-a3d3-503c6ea2f933", "comment": "Malware payload (Dridex)", "value": "a4b37ca9e0d88a8115cb7a831f9e11947db5bf65448d5cc425bfa8f78ea211c7268e570623dd4c588294453e8588938e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483398, "uuid": "c4a889ff-f06c-49d8-aae8-58016b7bb17f", "value": "FD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483398, "uuid": "98a2a843-e3be-4f90-8a63-d9d5c34081da", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483398, "uuid": "362a8a5a-2efc-43e3-a55f-68ff449ec5d2", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483398, "uuid": "7d5ac422-d085-4ed0-b941-2b73e197021d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483398, "uuid": "e0cfcde5-6e1f-47b1-90d2-1213d754c8b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483398, "uuid": "fbf047eb-49f6-4dcc-ac22-76ba48c0017b", "value": "5eac6931_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda29847-b990-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531714, "uuid": "28a2588f-775c-47ba-8890-e51cca3ab02f", "comment": "Malware payload (Dridex)", "value": "c6250c8ca3e8f51a111089fb9d4640fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531714, "uuid": "5b49f020-4cca-4a6f-ae5c-88e33c66d647", "comment": "Malware payload (Dridex)", "value": "5e59efce7d0191629bf2c7cf9775f5bb485af06de34f8495daacad45bf4ecf28", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531714, "uuid": "3630b121-3fbd-4b66-82a0-40a83f53eb3a", "comment": "Malware payload (Dridex)", "value": "b63b0327bb95dd12f9ecd851b1c01cdacff1a02f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531714, "uuid": "ca6b379e-9ee6-4eda-a997-4ef680aa5879", "comment": "Malware payload (Dridex)", "value": "3029839dfaed4889afc53cf07a70f9a8ce1e2b1e1192e748fc0f0bd9c939c8a3562d6709412e8feac771fc000d4a0a92", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531714, "uuid": "82c57a21-46e9-44b3-ae4a-e7c6e15c6b13", "value": "A504E0D0C6C62687E4A7DA729CC17D2A57356809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531714, "uuid": "5372f88a-3b76-48c8-aafd-4e9c49c38434", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531714, "uuid": "326aec48-e14d-4e6a-8f82-b561308f86e4", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531714, "uuid": "3de3397d-0311-45d5-a396-c6b8caf55f1d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531714, "uuid": "a2d83aef-1398-472f-9312-035266e49fee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531714, "uuid": "8851b548-c2fa-4c5f-96fe-b3cc2cafd9f5", "value": "c6250c8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce396a7-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539014, "uuid": "bdb24edc-0a7c-4b23-bf5c-7f110ea7c8d1", "comment": "Malware payload", "value": "854167e3d398553d01f883cc5aae664d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539014, "uuid": "93fc0d68-cdfe-4c7d-8f43-4a29fe563947", "comment": "Malware payload", "value": "5e7d31293e2ce05544c62ae0015f5ab33574f1c5486374206561ab5eff1dcb9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539014, "uuid": "4d1edd35-d17b-4bb5-b8ce-6d9799b60fb5", "comment": "Malware payload", "value": "4d82730c230d90c8fbcfe9f58ec2b09725b7b4b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539014, "uuid": "3fab67bd-77d5-414d-87e6-4e2e0d0e6dc2", "comment": "Malware payload", "value": "d2f80c408fa4d40b60d5df1ab468b21f7466e121226baaf957cf7bd914676b9feb44866edcefff173402b147f3cf0718", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539014, "uuid": "c6c45207-2dd7-4e82-8f21-a0a9268df4b5", "value": "7A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539014, "uuid": "1e27f6a0-70f9-42fe-82c8-de6f3a0e628b", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539014, "uuid": "a0b5e463-64f8-4782-8061-1d9a30a4de17", "value": "3072:mi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:mH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539014, "uuid": "df979a94-e022-49c6-8b14-787659b3fa36", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539014, "uuid": "022af085-3ef3-4a1f-8464-25bf96993411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539014, "uuid": "232d247f-1d83-443a-acd2-c346c413ac24", "value": "854167e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016132bc-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "0af55200-8bf6-464a-9d5b-d98be3d0e5a3", "comment": "Malware payload", "value": "df9fc3fbb7f8d675967e6e23bfd8c746", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "7ff4f15c-77b1-4aa2-b913-f967ea76865d", "comment": "Malware payload", "value": "5ee82dc87f122a0ddb534e7c74e6b001fdc4d26be15576f954136b342de76dd9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "fcf6f4c1-c383-4052-b494-b219da983890", "comment": "Malware payload", "value": "cd057a24c4b64d4483eba55d0bdb4cefce80f0a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544685, "uuid": "f18904cc-ba85-4be4-a6eb-42ee056f1230", "comment": "Malware payload", "value": "a8a5233eac003d013719b3e9471f6a187102e3442811c76afd764d7d6986a034d10e089146cd25830c2723da7c705d2d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "61a9de85-99d0-4095-a2b6-3ec9c20107ba", "value": "5404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "bce9a278-ca73-4726-96ef-44246a598d29", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "109a0d85-aaa0-4d4a-9449-4a6ccb4c804e", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544685, "uuid": "8fa94d10-e935-47ae-82e2-2d1dad0874a3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544685, "uuid": "fa04a6cc-129a-430b-af86-cc58f793088f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544685, "uuid": "2d3f972e-436c-4d26-b92b-a7486274f1cc", "value": "df9fc3fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73005cdb-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533709, "uuid": "0f1ded72-91e7-4f29-8552-f474472d395f", "comment": "Malware payload (Dridex)", "value": "d4d11a71e7b5fac56fbd08f38d022ac9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533709, "uuid": "00dd04e4-ab67-4d34-9f3c-535ff6600639", "comment": "Malware payload (Dridex)", "value": "5f269564f9b137c45c74ee48ee384f20613145a09e16d11d6f457bcf2fca6865", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533709, "uuid": "faa2cf44-c215-4c80-8454-65eb4fd0fa95", "comment": "Malware payload (Dridex)", "value": "6c0a0b1d59b135316b24439bf63c335403f527c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533709, "uuid": "c1be9528-08d7-40e8-a25d-24b9343b565c", "comment": "Malware payload (Dridex)", "value": "de26508a694dfa8e4bfa9baec710c9d0d97d071fa9769d08e95d282749f10f259fc3eb2e2cedeb35da75ef034fa4d611", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533709, "uuid": "1f4cc711-4c3a-4edb-a706-427203078284", "value": "B6F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533709, "uuid": "51c5b730-b978-4b97-9bc8-917e8b9a113b", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533709, "uuid": "0cd73d12-019f-47dd-a3e9-1401b21551d6", "value": "3072:h9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:h9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533709, "uuid": "530d95e5-b9a1-43b3-ba31-99fec387beab", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533709, "uuid": "a2275f94-9fd3-4dfa-a30b-2375edbb5b20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533709, "uuid": "d2b0eb37-7f72-46f3-bb1d-e46c6186ce5c", "value": "d4d11a71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b2023f-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468883, "uuid": "752e149f-e2b0-44f2-b3e6-d95bd5eeb495", "comment": "Malware payload (Dridex)", "value": "6a1763df5dbb878b126beae65aec18f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468883, "uuid": "bcbcecea-d4d3-4f68-b3d3-bc7330ef423a", "comment": "Malware payload (Dridex)", "value": "5f9aa2ec56751aad8759d88c1219027875adcdfb4b67d43503cc251ffe0b7fc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468883, "uuid": "967b904f-918f-4486-91c2-3112227f0204", "comment": "Malware payload (Dridex)", "value": "47730760260839699ecc4c182d6f7145d373682f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468883, "uuid": "b91ef5b3-043e-4eb0-a2d3-df7258313c09", "comment": "Malware payload (Dridex)", "value": "686184a87150a4c0b05e62793e4f05bdc107657c5f7c31eb806a3e1a4d87de20cca418173a7e92898defb50cc925d5e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468883, "uuid": "23aaae20-397e-4515-a617-1085b984a05f", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468883, "uuid": "5b0b3f8c-19fe-4526-b248-6a28be423082", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468883, "uuid": "bcda954e-d62f-4f46-bf88-31111f31b4b8", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468883, "uuid": "a5b6dd69-888c-4310-b235-3317e4f40c06", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468883, "uuid": "3977e7b7-d0d6-4b39-8656-411dbdfcec08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468883, "uuid": "6bd30b4f-56ae-4805-953a-1b1601aa2685", "value": "6a1763df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddd258f-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621541592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541592, "uuid": "d5288024-9025-4a76-9c85-dcaa5b2e0efb", "comment": "Malware payload (SnakeKeylogger)", "value": "0774b2291a01abf99df0f2aa9c018380", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541592, "uuid": "59daf4cb-955e-4d21-9423-5c72f2a6a124", "comment": "Malware payload (SnakeKeylogger)", "value": "5fa450345db70a9bf8056302a5c3139e82d4f0df9035b4632d131ab132e1a4ed", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541592, "uuid": "5f154f20-3576-4f85-9629-d5f521ccf332", "comment": "Malware payload (SnakeKeylogger)", "value": "fc757116fe6c71605134ad41e7deb4bfc3de5590", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541592, "uuid": "231317e7-8753-4488-8a1d-814672303852", "comment": "Malware payload (SnakeKeylogger)", "value": "0cf0143271308393d365deeefc101a3a414e0bcb7163a4b812efeab6fd0107d58b75e501668daeec87b524724e6d9935", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541592, "uuid": "bf613e94-7581-4123-bf0b-42efbf2e9677", "value": "73B40245B2F85706E0FE0BF66A7120801772B5472522FA9D5DD961DF1632F828B28FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541592, "uuid": "064a3a19-04a2-4cb6-8cb2-c895960dab4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541592, "uuid": "1e5f0b7e-01ed-4dbd-9097-18fc9f0febde", "value": "12288:xO4sL+4M8LnBSNR5nnJDfTRVY4NENluTF+:c4stFBSdnJjNVYpuTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541592, "uuid": "f8f395e9-36fd-4433-a265-3798ade18daf", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541592, "uuid": "f7544de9-6a5c-4839-9c4c-a79555c882a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541592, "uuid": "d02dbb01-1244-4e4d-82d5-1f426fd41250", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a698082-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526662, "uuid": "5b28907e-faa8-44d3-87aa-81a5425f2bfa", "comment": "Malware payload (Dridex)", "value": "80252b3e09850bb9509d6e0ed7301791", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526662, "uuid": "bde24df1-b0e6-4868-8b94-ad42da565090", "comment": "Malware payload (Dridex)", "value": "5fa7e217fb2d50296341f9d5207001f4349288e7768e704a9014197dcac151a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526662, "uuid": "add5cd9e-31c9-4e5e-9aff-f9b3fe4a8dcb", "comment": "Malware payload (Dridex)", "value": "741e0f5d4fb80b1d5708952278854d5e7fb1a0fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526662, "uuid": "09f3cf20-1b79-40f5-8b8c-5030e297d011", "comment": "Malware payload (Dridex)", "value": "dcb8acf8dfd9ae00441609391c515f21fda4576301118c099ec968fb029232305e61c94d66146eee13a7639a1c159632", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526662, "uuid": "6d61394c-c42f-44a6-92c9-337cbd29b558", "value": "1604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526662, "uuid": "67208afc-128b-46b0-8a6f-bdc71e6f538c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526662, "uuid": "9f5c8c1d-7ffe-4a10-b0e6-41761a38b8b4", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526662, "uuid": "4a265f46-737c-4506-9cd8-a33ffab85cb9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526662, "uuid": "683591e2-4bf0-4d7a-be7a-4a1e3b2566c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526662, "uuid": "de396e80-7dc8-4517-aa1f-44bcee79900c", "value": "80252b3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b64898-b99a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536047, "uuid": "ada847dd-c1e5-4734-acc8-ab905e5c09bc", "comment": "Malware payload (Dridex)", "value": "b5f2f7bb3111cebb7a8f9b50b2564c90", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536047, "uuid": "ffb8f3e6-d8aa-4b39-b096-cd96a2f49496", "comment": "Malware payload (Dridex)", "value": "5fcf8b1d9d79aae3440fb468b42a76d04427aa49a0fb29aa8d065b28f8626c86", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536047, "uuid": "b5bd5547-ebde-41fe-b8f7-6b79592c9c43", "comment": "Malware payload (Dridex)", "value": "92213a9b84fd1bf4b8020dea1f1aa258d1828d69", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536047, "uuid": "ef19f49c-ee6d-43c2-9a5c-97425a477b08", "comment": "Malware payload (Dridex)", "value": "d155ee2c62fd6964d460c8306286736476ba8acc2a4b16e3d06fc6739341aaf2aa31073c3515c98fa0e1681f354aa477", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536047, "uuid": "aee618f6-7ad1-4d3f-853a-c69b5e912e06", "value": "5904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536047, "uuid": "72672cbf-ad02-445a-ac8d-9f69976036cd", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536047, "uuid": "3e7728e2-103a-4d8b-9d35-3aabc7723137", "value": "3072:ji49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:jH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536047, "uuid": "84015e56-5072-4ae2-b411-be9d90d2a976", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536047, "uuid": "40f97a00-5f10-480a-a10a-d3fc69bd040d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536047, "uuid": "1d6561d5-7d50-4127-913a-e2c17a963438", "value": "b5f2f7bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376802b4-b95b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621508698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508698, "uuid": "5ac0cb9c-5fe7-4043-813c-b19e789a2714", "comment": "Malware payload (Dridex)", "value": "e14964466363f471a18665bf83aa01cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508698, "uuid": "ba2f2dd9-a9b4-4261-bd5d-696173e45f1e", "comment": "Malware payload (Dridex)", "value": "5fe36477231f49b835923f177fa3d5ce74dcc9f7b72a3c07d7ce78b923625a6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508698, "uuid": "bba994d8-84a5-4d1d-80f6-2707bea61dad", "comment": "Malware payload (Dridex)", "value": "715d8249c6c697e8184a32772ba0f479f741e148", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621508698, "uuid": "c8de07d6-ee21-4929-ab83-34fe2a8b38f9", "comment": "Malware payload (Dridex)", "value": "547540c5cedfed22f88e6290b281349d89e2e6f9712b66d7e7bc5d54ecbf7007a8e9d50ff642a474cd88090a38389514", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508698, "uuid": "eb9cb16f-8528-443d-951d-07d1144871b1", "value": "5604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508698, "uuid": "2521abc8-4565-4fa6-a9da-b8afff1a0e9d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508698, "uuid": "79d22a54-b29d-4026-904b-5aa6b6ac8f25", "value": "3072:Hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:HH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621508698, "uuid": "54a58baa-1351-4ba7-9de2-78afa17000ec", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621508698, "uuid": "999f6c40-159c-4312-a40c-acdfb9530e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621508698, "uuid": "f13e9c40-2d9e-4f12-bc66-dc93f0959590", "value": "e1496446_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403d199b-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621531906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531906, "uuid": "0f202962-78eb-4cb9-916e-6539d209316e", "comment": "Malware payload (Dridex)", "value": "bd68593d515086ab9d37e0710255be4d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531906, "uuid": "eb46d458-2fee-4ce6-9c76-e77b670d1b6b", "comment": "Malware payload (Dridex)", "value": "5ffa92d50e04847f14177ee875148f692efe8e9f323c0fecc56615b19a6f4a01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531906, "uuid": "4d5468bd-6270-4044-a0a6-2c930b566ceb", "comment": "Malware payload (Dridex)", "value": "6028b0995c00612d6ab3a1bd12e7a60958b52083", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621531906, "uuid": "94e7d5e1-2957-40c8-a749-86a5633d5050", "comment": "Malware payload (Dridex)", "value": "462bd8d7fe58d517e44d223cc9c002a517d42cfd2047b611f1f8b8d653cc6a6ae01cd03998ac18fa1da42acdd03ab953", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531906, "uuid": "9b9e4bcc-8aff-44a9-a30c-9ede8a0cdc2c", "value": "EE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531906, "uuid": "6d4fadf7-b3c4-48a9-a83f-bace2be6b70a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531906, "uuid": "aa600bd3-7c33-4499-b9d1-1b9fc368ed43", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621531906, "uuid": "f4f5741d-6b7e-4aaf-bf01-a7538846cf34", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621531906, "uuid": "48ddda97-72f6-4a50-9d74-c73686574ba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621531906, "uuid": "e4e6d216-b821-46d1-ad36-b96224c43440", "value": "bd68593d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2628169b-b94d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621502656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502656, "uuid": "ed1f8e06-063d-46ef-bce2-169bab0264d8", "comment": "Malware payload (Dridex)", "value": "e5304b1284e536effd6a160631ef74b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502656, "uuid": "b10cc0cc-de22-4eb1-8ac4-58bd75936fe0", "comment": "Malware payload (Dridex)", "value": "5ffcac43e993cbd993dcac2efc4c85f1339785918d4f6f0ac4c1662a60d19232", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502656, "uuid": "fecbb497-5e26-4f66-86da-313e91fa81ea", "comment": "Malware payload (Dridex)", "value": "22b1b9188122012798a03301005bc74b749fc7ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502656, "uuid": "b7ae25c2-6f37-46ef-be24-156553e2c214", "comment": "Malware payload (Dridex)", "value": "b35fe71e6973c4ca9151098ccaa7fafad22ee11ce76eeaf3440f5f4737f5a91cfaf999de152feac972c8b44a138d943e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502656, "uuid": "a5d3b3d8-a593-4519-9369-89aa18b4dc6e", "value": "CBF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502656, "uuid": "8adefcd6-299a-446d-ba83-f48701470e94", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502656, "uuid": "3fbddcd9-7957-4047-9863-ed3b38f25979", "value": "3072:/iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:0eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621502656, "uuid": "ee6ac3fd-27df-4694-8c14-9e2c36b2961a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621502656, "uuid": "1e11baee-2fef-486e-826c-23a0e99304bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502656, "uuid": "a62924bb-906b-40ea-9cf9-87715a22b446", "value": "e5304b12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360035be-b9b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545203, "uuid": "822fe545-6918-4747-8dbf-15bef164bbf8", "comment": "Malware payload", "value": "5254a03f46c12f3a24be4e4efe576f01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545203, "uuid": "1f50b89c-84de-4183-a842-b989c97fe19b", "comment": "Malware payload", "value": "601c879ee6cfdafd07fb78e05dfa2f00653e0402f4d4ddb4bc6db9125745dfbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545203, "uuid": "f2fc7865-3b7f-446d-b1e5-dde227d873a0", "comment": "Malware payload", "value": "391f4482ecc6934d63b92f755d8d76383b8a000d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545203, "uuid": "fc4d0b0d-e61c-414b-9b9f-8057ebed068d", "comment": "Malware payload", "value": "d33852b6b268d76a2833fb3571cfc355494291047adebcb012e49e38d66d65cdef342ffe732cc3d5a625e96b41d1d7f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545203, "uuid": "219e5206-6779-4ff3-996e-484a896073e0", "value": "F604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545203, "uuid": "1972bbc7-4a25-4422-90aa-774e063ba20c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545203, "uuid": "b191e79a-034a-4008-a2f0-6bfc53217c19", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545203, "uuid": "2d5ce664-eb40-4e65-b405-fb13933db72f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545203, "uuid": "05b1a4ee-f9f7-412d-9e07-ed378cbb8095", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545203, "uuid": "c6be59bd-666b-4e3c-83af-a9922d130669", "value": "5254a03f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a65a1-b9a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541368, "uuid": "598617c7-3a25-42f2-91d9-27e7a9a95a14", "comment": "Malware payload", "value": "1445ef3af250c87faeea28ce28495493", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541368, "uuid": "4b74373e-0215-4fd8-8719-569e0f8c39b5", "comment": "Malware payload", "value": "6062ff12b84656efcf0e1884d03af5a8e69484717a62361dadb392e930e91f9c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541368, "uuid": "5a6fdef4-59d2-4ecb-aa6c-afb0fe9721c0", "comment": "Malware payload", "value": "276f578ae1b870df6f78a47940b0cd2cd32a6601", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541368, "uuid": "3b2dbaad-905b-4d50-bd80-a8c55242c62d", "comment": "Malware payload", "value": "7392d3ebd6db7af5b31fd25853764e300757ffc84fbc4428c82b196fb118b49eab661e8e05001951d2f6a98ac65e4504", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541368, "uuid": "c4ac6017-e820-4993-a7cd-f9dec3827604", "value": "5204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541368, "uuid": "d242d791-657b-4bc0-bb66-d5c033176af2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541368, "uuid": "dea5505d-4a66-43b3-9e3d-3bf5af574bb2", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541368, "uuid": "fe2820d7-bc55-4d70-b522-26969d62ab3c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541368, "uuid": "66387445-0beb-4707-90e1-b47ee84efc93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541368, "uuid": "afe280da-d43b-4811-9685-b5ae89fcb0fe", "value": "1445ef3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3380bd3-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541977, "uuid": "5320cb7a-d36c-4638-92d0-c62947450662", "comment": "Malware payload", "value": "c41bd4e15a7b6bd880d23801f29e9057", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541977, "uuid": "0770072a-8cee-40dd-9e82-4a30fab68ba5", "comment": "Malware payload", "value": "6071b4041f000a5b357949303a3df22ea11aeb1b88c1cc9a9c630fd36f00f7bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541977, "uuid": "ec031b29-575f-4d7b-9c9a-69c9d73131f9", "comment": "Malware payload", "value": "a7c12702d45364415b5a9b920cb8e54cfa8ab03e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541977, "uuid": "303ac67c-53cd-4d95-9d2b-15d5578b456c", "comment": "Malware payload", "value": "47dfc11f5adc133a2ca71c335d66049be6e4a45d3216d84e2ede83941992feb4629df832fd8a781ecdb32d0227aa46fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541977, "uuid": "434eb914-83e2-4438-bf28-25d6c2160566", "value": "F9F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541977, "uuid": "6d345a00-76e8-4ed6-9d14-d369c3467814", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541977, "uuid": "4173e2a8-dec1-46a5-b33c-c1876b327d96", "value": "3072:OIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Xc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541977, "uuid": "aa42b0ae-5bb0-4a1e-8a78-9a75874f34a1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541977, "uuid": "ea50fbcc-af14-4e21-bdec-c9e0d1fe4233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541977, "uuid": "f9a86504-2125-4cf6-a364-2cda85ecbf20", "value": "c41bd4e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c6d5da-b972-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621518542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518542, "uuid": "c39c5bcf-9a5c-44e3-964d-77e33d380820", "comment": "Malware payload (AgentTesla)", "value": "0762a682b43f95596ab49c5945517636", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518542, "uuid": "3d708259-5fac-4ea2-b26e-fe003b582bbf", "comment": "Malware payload (AgentTesla)", "value": "6087c3fc050366e4c7f5b6118679ca85e5a1ab205e994919f41e035a386f5270", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518542, "uuid": "4636a776-39a3-4e65-9826-3373567a0d5b", "comment": "Malware payload (AgentTesla)", "value": "7df69c9f9f70de1b375766a7301a0c106dab3e43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621518542, "uuid": "cc6cb297-544d-4cfd-8f68-44e89c996f55", "comment": "Malware payload (AgentTesla)", "value": "ffcd8bf12c756ae1542617846d6533a0ca52e218e3bcb2f63d51b2f1fff1b17f21236292f883662e2bb57543fbc7b92e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518542, "uuid": "fb0f0cd3-b2d8-46f3-934f-81814c95d7e1", "value": "00D4E0592368DE05D1BE57BD846A5221C3F0E1128603F71A1E9990FEADB3733CA631E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518542, "uuid": "0c32f1dd-7cb8-46cb-90af-fef5d34a992d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518542, "uuid": "4878ef8d-a1eb-44f7-9ba6-485a86f8d551", "value": "12288:pRwCjrhy3QCT0YkfYKzXyWurNHj9wmDnmmPjvvu8dzURPuO3:DwCjrhy3QCT0YczXbKlj9wIjO+zURl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621518542, "uuid": "ee093406-f588-486e-82a6-976ef2d53697", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621518542, "uuid": "580b2d2b-e45b-429d-9f2a-973a78e8f630", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621518542, "uuid": "1dd12aae-6034-41f8-8897-87716ef90d71", "value": "RFQ 26 MDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb88bb4-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533321, "uuid": "ad5e3d75-bf87-4100-bd2e-6a2018b74426", "comment": "Malware payload (Dridex)", "value": "a667313bbe15582061da09a6fca335fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533321, "uuid": "a8d26c2b-69ec-4dde-8530-5d64f84de440", "comment": "Malware payload (Dridex)", "value": "60bf46c4bd8f780982889296483032ad2092ea847d5011fe83e7c110eae46563", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533321, "uuid": "565f91a9-7627-4608-8977-1a9e78fe46fd", "comment": "Malware payload (Dridex)", "value": "376c5d2ac866f4f28325ada15242e3a50075ec0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533321, "uuid": "c9737d51-ba59-4d95-99a9-75d267f01a34", "comment": "Malware payload (Dridex)", "value": "23d0d750550813c61325231d58120bcbe4cc7597b9186692f6a8e3f292d9ad600fe6fa5aa82c510a759d710f8acf6b46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533321, "uuid": "f7e18385-82a6-4d0b-a909-6047453cab6c", "value": "A104B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533321, "uuid": "d145d883-15e6-4989-8c6d-768a0144483c", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533321, "uuid": "c59252b2-f621-4ddc-9952-943db5461a6c", "value": "3072:4WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:4WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533321, "uuid": "8e47a252-608e-40bc-b290-4c99b392e52f", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533321, "uuid": "8b49e78b-d312-47b2-becc-eaba5cf9d15e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533321, "uuid": "34431431-a3d0-42e6-933f-d57f239ee409", "value": "a667313b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96ca59c-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483549, "uuid": "d7e8898a-8057-4de7-89e6-f30c98d01854", "comment": "Malware payload (Dridex)", "value": "0a62075a91503495caefdf9a4683161c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483549, "uuid": "d77fa98c-8fc3-4503-9d3e-73f37ad7e6f8", "comment": "Malware payload (Dridex)", "value": "60c8be9f5640f16f6d2a3acf5d03a0bb43f22739f7c02401944d2097c9151e96", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483549, "uuid": "e9d55ef3-dc79-4877-877e-bc9c9e686424", "comment": "Malware payload (Dridex)", "value": "1a80ec77312222dc20b5606f40e9cd62fdc26130", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483549, "uuid": "5ba27cce-6f3a-4553-9d49-b236d51d479b", "comment": "Malware payload (Dridex)", "value": "2d46ea068f1aee40c51374f9b5bf7c467c78a9e190085ca1d39164c9dedb839372cd16179dd59c0689d9a2203a5ea873", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483549, "uuid": "3315faf6-120d-4571-bda7-55ddad5b1129", "value": "8904B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483549, "uuid": "3ea8669c-2db6-45e7-a701-8b5cd0f7f42f", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483549, "uuid": "5998865f-750f-4ba6-83ba-0cd4349935bd", "value": "3072:JWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:JWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483549, "uuid": "a42d4a3a-7885-49e4-a248-d85171658d85", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483549, "uuid": "e428703f-2dc8-4d8d-ba7e-3d17b2e9814b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483549, "uuid": "d039ace0-c030-417e-acc5-79b1c5665ada", "value": "0a62075a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442d968f-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536207, "uuid": "32cc0fdf-609f-4f97-87ff-4f3554c75b58", "comment": "Malware payload (Dridex)", "value": "fd9fd49ba489d14f6f6fa230514088cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536207, "uuid": "9372c163-c072-499d-b95c-11d8a1c1edb4", "comment": "Malware payload (Dridex)", "value": "60cd8aa054930d81a1eef8d6cf6e06ba000b15564ac5d325dc758a3f3a7eb363", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536207, "uuid": "2c875cec-fb22-4916-b5c5-c84a7f3681a3", "comment": "Malware payload (Dridex)", "value": "6dda597b7bbf9fa49ad562b85d275010d11c99b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536207, "uuid": "5acf1927-5663-4dfc-b095-9581eb9d3db1", "comment": "Malware payload (Dridex)", "value": "de5f22978d07105923340c13c1acc48a94757f3fe810d49b7ec1e8f7d1dd9bf65465c40660d4fed86c752b67b6cc3387", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536207, "uuid": "a8e8c751-9f65-4836-8249-a3adbda988e0", "value": "9804BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536207, "uuid": "f11564d8-7776-49df-b445-80a69f39c6ff", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536207, "uuid": "f57cb1aa-c8f0-452e-ac48-a3f546d6b7a2", "value": "3072:ni49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:nH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536207, "uuid": "d337b068-4e24-430a-9822-41c0d7ec2f0d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536207, "uuid": "9ee59b1c-6a7c-49cb-941f-f9b75aa79c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536207, "uuid": "f2b7a4b0-af7e-4b08-aff3-03c5e353c969", "value": "fd9fd49b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d137f77e-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526995, "uuid": "b40811d2-6a57-4569-8a21-27927a275ead", "comment": "Malware payload (Dridex)", "value": "805d50fc3a126910ce6dada856f82bcd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526995, "uuid": "8c31900b-affa-4c3b-8021-bc95a92522df", "comment": "Malware payload (Dridex)", "value": "60d548030e1709d7cd6dfbab35dee874bdbe7e562de9fdac371548d4b90636e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526995, "uuid": "78e89db5-18ea-4da0-ac0a-e26ed9f26ce8", "comment": "Malware payload (Dridex)", "value": "b43d8e48d7ec4790b09627c24a5ebbfd2e22dadb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526995, "uuid": "f44b471e-1f1e-449a-841a-380209de70a7", "comment": "Malware payload (Dridex)", "value": "f6e0d575232e0c700fe3a01915650bb95aa7d1038de01843e06fbef4ab0ccae4926e6abd9c85dcd9a74eb14171916dd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526995, "uuid": "3f23b4e2-b147-4f4b-bd7b-7984fe38ec77", "value": "9004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526995, "uuid": "319ab35c-be7a-46f6-bd30-a17e34975e92", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526995, "uuid": "cd7452f8-a91a-4e8f-9da1-b86f70d589b7", "value": "3072:Ei49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:EH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526995, "uuid": "3d3a4fef-e6a7-4196-aa7d-63b2b1eee9f1", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526995, "uuid": "8c87643e-3bf1-49e6-b8a8-8d07c9de0e7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526995, "uuid": "bf08389f-7c73-4e80-8fd8-a47a5516b7f3", "value": "805d50fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35640100-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530170, "uuid": "cbf74265-faec-412b-aafb-9b68266ef452", "comment": "Malware payload (Dridex)", "value": "594a34fa01e3a138e3844b4f8d43f186", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530170, "uuid": "186a26e3-5783-4138-a07c-6b41886b607f", "comment": "Malware payload (Dridex)", "value": "60d5639a436e025c5328cf893ac004f17237d3f68b42eb5228273a95f5c4b2dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530170, "uuid": "009ab582-96d4-498d-a2d7-78aab3520fba", "comment": "Malware payload (Dridex)", "value": "703adf791e5c652aeb16c3ad2c5c8ef4523e8b31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530170, "uuid": "40135bda-e0ae-4fcd-bb6d-fa4fb7b169d7", "comment": "Malware payload (Dridex)", "value": "f70985f46ecdef367a9e3f9a1a984685616a0fd2451a9c0bdd647ead04fd9c2f31ca9b26bd2591867e0d9078229be7d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530170, "uuid": "2add7fc4-79f8-4f8d-a9ec-edbf18acc562", "value": "F9F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530170, "uuid": "f640c78d-3433-44f4-b812-79a36bf54eb5", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530170, "uuid": "bf1d57eb-c891-4712-804b-bd6c0c3a686f", "value": "3072:l9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:l9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530170, "uuid": "c1f445db-d582-4860-b743-7db2fa9de318", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530170, "uuid": "253e1dd7-f1a9-41fc-b02e-378a74a8f534", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530170, "uuid": "f9e087dd-e2bc-487f-a986-c529f817b654", "value": "594a34fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ba4c51-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1621527055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527055, "uuid": "0718b246-8bc3-4bb9-b285-eaa8f35f85de", "comment": "Malware payload (NetWire)", "value": "b1c0fbadcaae5f8b6d8142755d3c51d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527055, "uuid": "cb6454a2-7ff6-4fe5-af20-db53cca3dba4", "comment": "Malware payload (NetWire)", "value": "6134f11689014932270756991a01dd966d985ea038bbb9131432223c1d14d33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527055, "uuid": "4847bea8-b98e-4854-bd51-a0f5ea21fb2e", "comment": "Malware payload (NetWire)", "value": "5dfc09f761cc54c75a084a7657ba17bd29d08049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527055, "uuid": "dc5e57d4-b219-4ed9-9a67-55994b28dcb3", "comment": "Malware payload (NetWire)", "value": "4eb71f8ff37ccec8c8c78321d2c4c582a1b1301c9cd5029792cafa8245732f3d4d9a8510c2eb38dd0f017b41b5b52de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527055, "uuid": "5f2d4286-a29f-49e1-aada-01f68dab869c", "value": "B7B4126513549BD4FC7EAB7CB460C01403F1E916CB21EB1D6E14A2AE45E338FCBA5963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527055, "uuid": "4509cac7-e575-4796-b9f4-52458ef58c15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527055, "uuid": "26a83898-e659-43fd-8362-8f03b5bf5069", "value": "12288:FqWKzITzNVkQncQVOLDv4GO53M1sXu2T:kvzIdDcSkz4GH1l2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527055, "uuid": "efbb8859-d875-41ea-8b4b-629debeeda8b", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527055, "uuid": "4022acf0-6085-4c3c-97c0-cd0e910837c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527055, "uuid": "d389b302-23bd-41db-93be-a932cadc6c0f", "value": "b1c0fbadcaae5f8b6d8142755d3c51d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2f422e-b96f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621517214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517214, "uuid": "9210bbad-7515-48a2-9020-9807c9cd0df9", "comment": "Malware payload (RedLineStealer)", "value": "2f05d516f60d3f4e4a7c8e04b2947e2f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517214, "uuid": "68f2778f-4bfd-4214-a83f-9c75d279b6ed", "comment": "Malware payload (RedLineStealer)", "value": "61553b57fceefacd2df16f2d6376521a3e79367a13663c51adb0d46848d0b82d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517214, "uuid": "47e302cd-a62f-400a-aa19-b34d4bf8fd8c", "comment": "Malware payload (RedLineStealer)", "value": "3c7ea590c559e6f7b3571f603f046bb3fac0519b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621517214, "uuid": "563de4d0-fc32-4e84-9a55-78bc8b5186d0", "comment": "Malware payload (RedLineStealer)", "value": "f2a74884672d25a58011da65062a26612b6a34246cbb3cf649303d0cfdad70b20fba7320685fe9667597bdf96f277b3b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517214, "uuid": "c026f03d-6cc0-42b3-b452-64f6dde1a695", "value": "82B423F843A5D311539C55BEB061C835B6E17530424E2BAFCB2404AD9A88BF37AC927F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517214, "uuid": "74e764d1-e79b-4bdd-af89-134277bafb6c", "value": "12288:3h9NGckwqM14oGC842YnEm38+fcaSTV97F0MHD0hOwCB1+Kr:3h9NFkwqMWbC2YnEm38L7RNI8w1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621517214, "uuid": "9dc08c59-c204-4b79-a327-8f1c007c5576", "value": 530508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621517214, "uuid": "ba67c2b0-cc2c-42a8-86be-b721d49a8a30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621517214, "uuid": "32386749-d9c1-4c7e-9541-0412f4be351a", "value": "2f05d516_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1373539-b98e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530780, "uuid": "cce485cf-018a-4436-b4b5-dbf3673415ca", "comment": "Malware payload (Dridex)", "value": "da2ce211010c808f30012d8b5e9ba281", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530780, "uuid": "ee799740-1d1d-4f9e-9a96-9bdec9754a43", "comment": "Malware payload (Dridex)", "value": "6159d42fd29b638cdb6798472fca8a0751a00af2734b42d2fda4703b3c1b40e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530780, "uuid": "cb81069a-39b4-47f2-b094-d71a171d1e40", "comment": "Malware payload (Dridex)", "value": "34d0e448e5004e3b05a02a55eebfd97c6e4267d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530780, "uuid": "51a176b6-6700-4716-a8d2-76e2a9d7c25b", "comment": "Malware payload (Dridex)", "value": "1a83903ee5a7f9c33bc10d1d0e711e152880db4ef771ea71dd5acf41a7f125dde9a9a6b8ecc1e7a219ea581546ce570b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530780, "uuid": "87bf3ff9-c5de-45e3-aca6-5f6c0ed38265", "value": "C504E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530780, "uuid": "daef6223-8bef-4036-a5ea-40127389854a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530780, "uuid": "880de55d-bb24-456a-9aae-dac097e865c7", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530780, "uuid": "d7dbfebb-7531-4300-919a-9124bd9303ec", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530780, "uuid": "57cfeb35-1626-4b2c-8a5d-d0f32b39b882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530780, "uuid": "5b060a32-73b3-48b1-9a4f-472e84c33a4b", "value": "da2ce211_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3db79a-b978-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621521110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521110, "uuid": "618ea19c-08b6-41e9-8805-4fd8d75d2c06", "comment": "Malware payload (AsyncRAT)", "value": "3594d1622fb7015d78c2f0ae364c2eba", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521110, "uuid": "4824c31b-676a-458b-a54a-f65089fffcca", "comment": "Malware payload (AsyncRAT)", "value": "61824b191d00e5bfa96a2bfb0da8c98e5fbfa5670da92abbc49d247e7e8e3650", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521110, "uuid": "4ff21ce4-f5b4-4041-9ec4-5f95670fc197", "comment": "Malware payload (AsyncRAT)", "value": "2bc3f155c826bf22e1a7b6dac08580fa623f4e48", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621521110, "uuid": "7a5760d5-4422-4c57-8940-e23225240d0c", "comment": "Malware payload (AsyncRAT)", "value": "e7e2d0cd842f8c8e2ceec398bd5397fd36b3fe461cbea94dec6bcfd7cf25eeb28ea420e3082363235f5ed33f05cf5164", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521110, "uuid": "48c96cd5-d2e8-47d4-9c90-17766ccc9993", "value": "F5335E003BE98136F1BE8BB4ADF2E5454679E2676A03C6592CC411DA1F13FC59A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521110, "uuid": "71afb974-48a8-4d05-82d8-6e3c9bfa01e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521110, "uuid": "d423b429-6e22-4476-9757-b1789a21806d", "value": "768:drzf/IL9UXn+xiCtelDSN+iV08Ybygem38nUYe13GUk5EgK/JGZVc6KN:drbpCtKDs4zb1d3sBU3GUk5kJGZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621521110, "uuid": "60359772-5786-4196-b348-507fe3cc80c6", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621521110, "uuid": "16de9d19-c2a9-49af-9db7-813129f90156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621521110, "uuid": "1e3e6453-b1d0-4206-901e-8f1a196abf7e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eaa116b-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476096, "uuid": "0f615ec8-ac38-4b8e-98b2-02dbcccd9860", "comment": "Malware payload (Dridex)", "value": "1f83f80c20517ea1f97e479bbe31b0cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476096, "uuid": "0439dd83-8633-4dad-b8e9-d2d6a9fa4a92", "comment": "Malware payload (Dridex)", "value": "6198cdd365ceafacc924b60885aa956b804d1c7af1f833b43816ff989e7d041a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476096, "uuid": "abdad5f1-78f5-4943-84a1-f1bef7af6188", "comment": "Malware payload (Dridex)", "value": "14fd9a37353e7e8834cd5813aa4210032f8b29cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476096, "uuid": "3b494441-a04d-44ef-909d-2aa6e5293dd2", "comment": "Malware payload (Dridex)", "value": "376655fec084662893066e6e6a4de620371074b3a5a1acec4ea3efc8958c42ad5bf6379322b9a681d8087c5746efef16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476096, "uuid": "7652ca3f-ab6a-4a9d-9852-3d22666559f3", "value": "2C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476096, "uuid": "64065f21-802b-4bde-9d8a-e685839929b1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476096, "uuid": "8d653eb0-738b-401c-a08a-791058088357", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476096, "uuid": "e3f3f382-8387-4a38-9579-c45e5e9108da", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476096, "uuid": "a837cdef-11ac-42da-898f-edc7c9e06a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476096, "uuid": "cbb192b3-4bb5-405d-88a1-f99ea2e3ecf6", "value": "1f83f80c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0718a1d-b94a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621501573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501573, "uuid": "55e7fc32-fad4-4b19-abf0-2cf226ad1f07", "comment": "Malware payload (Dridex)", "value": "15eb71e6ee06bb209e4cd72aeb9e597b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501573, "uuid": "c7a46485-3a6a-464f-9e03-856c0730b838", "comment": "Malware payload (Dridex)", "value": "61a257ea204f16fdba6db768f6d5dcbac52ab134260b5e7ef519ef77a2c8dd75", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501573, "uuid": "87ffde4e-2eed-49ca-95b9-27019a1032af", "comment": "Malware payload (Dridex)", "value": "82bdca4592c4fd9d88e8b77a9301e99b05c3de0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501573, "uuid": "e071da29-8594-4703-b5b9-995a802a7397", "comment": "Malware payload (Dridex)", "value": "b8dc0ad51026c79945bfd3c46ec835d8f4508f337ea48f2ddf6844622fc18c99d18b7fc480b8b0548de22ef59bc85f67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501573, "uuid": "33dd71b3-15fa-4cfe-8046-26170090fee4", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501573, "uuid": "5d7378e4-73d7-456e-9e24-b39e756fd09f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501573, "uuid": "65cae8fc-16ac-4337-80b6-e5b27cc65cd3", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501573, "uuid": "9130e77d-8194-4298-a220-206d8fa5f7da", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501573, "uuid": "4cad463c-2e10-4782-9cee-53f21a4e5008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501573, "uuid": "70c7c8d3-f787-4147-bd1d-6b41e1e91e86", "value": "15eb71e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df130cb-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532681, "uuid": "82368d12-0643-4fa7-934a-f43fdf2e555a", "comment": "Malware payload (Dridex)", "value": "db731a92b78c8700917288e25eaf455b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532681, "uuid": "5885475d-0ae1-4224-814d-a3816001534b", "comment": "Malware payload (Dridex)", "value": "61a2c19baf24e12b99b5f768ac1177920493295b8ad81e5eafefade82d447d35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532681, "uuid": "46566cab-d5d2-49ae-805a-9938c59f22fa", "comment": "Malware payload (Dridex)", "value": "147304a50b13d745f49e1d2b0f17b8b6a6a6afb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532681, "uuid": "af863b16-3a70-43e4-8e31-38cf4cfeefea", "comment": "Malware payload (Dridex)", "value": "3c56f0fe1f0d90af426a17b95311de192035a2e2b0408787411f8693077f313969724c0ed949d4cec17343fb6b38ea44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532681, "uuid": "fba7b849-8268-4803-bac7-221b9dfa5a23", "value": "4604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532681, "uuid": "d1fb3888-1c3c-4060-af8b-73047ed80452", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532681, "uuid": "9e19c847-1b80-4400-897c-23a28ee0987c", "value": "3072:/i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:/H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532681, "uuid": "352aead1-08ed-4a50-bba4-f1a930ec61f8", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532681, "uuid": "222032fd-7950-4aa4-bca3-fc6a44b65644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532681, "uuid": "72a80234-84c9-42c6-b96e-57b89d96e5d7", "value": "db731a92_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e78e94-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536286, "uuid": "3209cc39-7763-4a45-8a08-49c55a18aad3", "comment": "Malware payload (Dridex)", "value": "cf86651a9b30d4bf1dada26e6a9a4785", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536286, "uuid": "ed406eb1-b536-4c4b-81fe-eb0608478e63", "comment": "Malware payload (Dridex)", "value": "61aa49c51c3fa419b70aba24eef38c2434b616a815d82dcf28b040be26eb9eab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536286, "uuid": "b9678b05-67e4-4602-9285-2670b87c56bc", "comment": "Malware payload (Dridex)", "value": "e3192d0c124a2e3d9d2a70cb7a52ebd5e83f9ecb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536286, "uuid": "1da8509b-50dc-45a4-a675-fa2698c2db82", "comment": "Malware payload (Dridex)", "value": "895764d4447e6c3cffe3c6bdb5db4a4338c3d167b35671e9ef5f8345faa2d04cf6e49c72e41aa53ac7d3be3323323c28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536286, "uuid": "85f4a78d-1ca6-4787-a5a2-6ec9ced197f5", "value": "FF04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536286, "uuid": "31ef025a-67a6-4b56-a2f5-ed2104a48c48", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536286, "uuid": "b3df5aa0-0122-4a5a-aa24-ac963731f5d2", "value": "3072:Ri49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:RH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536286, "uuid": "e23fdd55-fef1-4ebb-a862-1c78d873d71e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536286, "uuid": "a7e87f03-f376-4ef4-91d9-8e14360de201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536286, "uuid": "15c696f8-58ec-4412-b60f-0f767fbafeaf", "value": "cf86651a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a498c2-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536988, "uuid": "e5e92577-b697-4c9d-bc69-e62618a6cd4a", "comment": "Malware payload (Dridex)", "value": "7ea9f364dd909d6e624765644304ccd3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536988, "uuid": "78ad1cc9-1faa-427d-b180-1aed39ad5b62", "comment": "Malware payload (Dridex)", "value": "6207c32acbf252908883ef9cb5aff9313f9d17da22f28ec16d180bbf0ed6364b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536988, "uuid": "2617d64e-a822-41f6-a5ef-b86ff799bf2c", "comment": "Malware payload (Dridex)", "value": "652c89c24f969be2b6d318fde19de32976bbcbf7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536988, "uuid": "1ed42b37-598e-4a07-9069-9af25ced2d35", "comment": "Malware payload (Dridex)", "value": "cdd004739165f5bc86a34ddcdf062cb04c78260399d7938f80b9e4567064db34382fcb8f2f621ea90f48e5c52b60b013", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536988, "uuid": "70a75db5-5eb8-49a9-9119-a2571eadade9", "value": "6904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536988, "uuid": "e8cda1c2-95ab-4824-9516-6568199d39bd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536988, "uuid": "69cce238-c881-48aa-8292-1cb126c2b1f1", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536988, "uuid": "20accba3-7868-4fd9-af18-ddc935d7baf0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536988, "uuid": "4ad274ab-498f-49ee-8f1b-72b2292e0a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536988, "uuid": "cfe11466-2726-42e7-8e8a-21df9c98801c", "value": "7ea9f364_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cf2a01-b931-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621490764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490764, "uuid": "0e03fe0c-d2be-4706-af19-8c9096d1e39e", "comment": "Malware payload", "value": "92992482ce924b4122ceb658336396a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490764, "uuid": "1aae0d61-654d-48e4-b0ae-c757777af7a4", "comment": "Malware payload", "value": "6284749beb1d6773e265524485d68268c9c90a385b82c229c16123f9839d087f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490764, "uuid": "a5ee965f-9e59-41b3-b7de-914244b2a773", "comment": "Malware payload", "value": "2f2789e45c5152745feb69a36e18aec7ddecfdb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621490764, "uuid": "0edd573b-a5ca-4b16-b8f1-c57bd83ee6c5", "comment": "Malware payload", "value": "06273a438ecdcb756d78ee0b1aaa52dd3704560b218b12b192dffa8117b9f590dd06f9bf7b54d950d2448bac1127b232", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490764, "uuid": "ee9ac4ce-b14b-407e-9d14-758931d20c47", "value": "6C25334FA104A83331344B248B03B6D8C95498779D8F97E8440AAD737F2BA2759F15FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490764, "uuid": "ae4c5c23-f8ae-41a8-adbf-72a8464cc1d3", "value": "24576:0CCgscTg2H0PmcEvEWZ49ZNsXrndXxlmvV2l0j:ocTg2H9hEKUZNsbdBlmQ0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621490764, "uuid": "148fe4d8-8e65-44fa-ac4a-4e4e978de23d", "value": 986696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621490764, "uuid": "ce14dfa2-2ef3-4384-9e6c-09de27d9c681", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621490764, "uuid": "28d6d557-97a0-4171-b419-c5f464aa8627", "value": "92992482_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a484a1db-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479676, "uuid": "b836d57c-ee52-4ec1-91a2-aa917230f79c", "comment": "Malware payload (Dridex)", "value": "5385397cd4e998ff3b7ddf49d8ca75a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479676, "uuid": "44fbbc5b-8cdc-493c-8d43-533c2a1c050c", "comment": "Malware payload (Dridex)", "value": "629671a76c03b7be5f2aaffcedece0cf83be8d8f2c89fe3da80bb377b3a5ed94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479676, "uuid": "ee4bc7fe-c72d-4fb4-ae1f-f231fc3da402", "comment": "Malware payload (Dridex)", "value": "7ad2bc49cfea17fedbbd279ec202848666f34380", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479676, "uuid": "df50cb95-ae1e-434d-8591-322e4bd95852", "comment": "Malware payload (Dridex)", "value": "72aed408c98288b80ec0bcc0b9668fe498b13cdada5e5c7cf3d562e50205c4be5dfd655b604a111d58616da3015e4733", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479676, "uuid": "bc8cf9d0-2931-4c18-9864-6c46251d2bb2", "value": "7F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479676, "uuid": "958aa35b-2eb9-4e0c-8a99-8bad49893e79", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479676, "uuid": "630dc43f-db0e-4f62-ac30-76050094bfb4", "value": "3072:VV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:VV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479676, "uuid": "62c86685-92f7-41bb-bca4-eea9a9378c34", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479676, "uuid": "470cb18f-4f5c-43a0-b56e-081e975ec6ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479676, "uuid": "0396502b-e13e-4f5b-b3b3-275b66e22bae", "value": "5385397c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a17977-b920-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1621483575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483575, "uuid": "448f2cb5-2635-4fc2-af38-4b2a300736e5", "comment": "Malware payload (SilentBuilder)", "value": "43e8eb56a12afe919bb67704db4fdebb", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483575, "uuid": "53d1c220-843f-4ef3-ac10-515dbdea72bc", "comment": "Malware payload (SilentBuilder)", "value": "6312e0af4f7c1ea32b013fd034a4531883124c98de8f370b3cbcd0c298b7e5e4", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483575, "uuid": "4250814e-8a72-4f55-92f2-80c25f482b49", "comment": "Malware payload (SilentBuilder)", "value": "9345642918744ef61f96bf79d4c227c841571b1d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483575, "uuid": "fb22ec62-6b29-4ef6-88f2-31c9ba03a48f", "comment": "Malware payload (SilentBuilder)", "value": "bd872619077eb2e12798098ab1c67d02e7cf6b0e7fcca3d75d9b0dd770beca8bb2702d0413c86e5c0ea9a5df8bc56d27", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483575, "uuid": "b6a3b811-93be-486e-b592-28fe6c1861d9", "value": "B0B4D246A309C8A9C3614E3AE5154AE8446BED52860EBB93374BBF2CDFF4280F75C355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483575, "uuid": "c400655b-6210-4ad5-91fa-8f1fb605bcbc", "value": "1536:HPkZN19acWypVFEEgpCzz946rum6ytvpBFNBOkIeVuCm91I7t69ZRGg:H8ZN191lpVFEH+vpBFNskrVdm91Igeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483575, "uuid": "b6816e55-6a1b-49f2-b3d6-b174cb436c87", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483575, "uuid": "322f1283-dba1-4c1a-96f5-f280c2d37127", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483575, "uuid": "0639ca60-e750-4845-89ad-f3b80cff42f8", "value": "43e8eb56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3e226e-b99c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536869, "uuid": "3a32114a-34de-4ebc-bddd-b4e9a8d03982", "comment": "Malware payload (Dridex)", "value": "f5a9aa9daf418cbad2236fa461eeee93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536869, "uuid": "379e2cb6-5b9d-466e-9588-0994adf1c459", "comment": "Malware payload (Dridex)", "value": "632e937ac08d79802954f84e7716df8c35fc7820e1e5c6b41e9380f73a3874e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536869, "uuid": "89934de5-e4eb-4eb3-9f2f-1548b7beaf65", "comment": "Malware payload (Dridex)", "value": "807de80a9d3b3fe9cc331392d37e704d74fbe551", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536869, "uuid": "984e148a-9b95-410f-9c68-8d3b2051ac37", "comment": "Malware payload (Dridex)", "value": "490c8fe5cf3b7ea0c4b92ab3eab5f923fb1b6a4313c87ae32219d12a199b22fadfb14b364d55e8c473880f8755304896", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536869, "uuid": "baae2c17-f902-4869-9a21-baa0bf07dce6", "value": "B8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536869, "uuid": "3b6dfcb3-6c27-410b-b30b-eacbb5298c61", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536869, "uuid": "5075d86a-fbfe-48fd-882c-81329ae7b05e", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536869, "uuid": "a4ad8772-0e63-4327-ab53-e1533faf4c18", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536869, "uuid": "ccb107ad-07e0-4442-94da-6d3b9385c25f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536869, "uuid": "83d7b90f-d096-4e50-923c-eaed33c34fab", "value": "f5a9aa9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737e8856-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539293, "uuid": "bca950ba-6bbe-46f0-93a8-ffc355ab13cb", "comment": "Malware payload", "value": "05c383794828b52537b5375c37846cbb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539293, "uuid": "d4a2ea9a-7c56-47a3-8a33-288b25276806", "comment": "Malware payload", "value": "63661fbdf27d730950155587b35989c3f578cb4a1915cda500c906706c1820c6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539293, "uuid": "4cbbeefd-bc9e-4a78-a749-7342c2371ce3", "comment": "Malware payload", "value": "d4b2d5d6d1a506b82f32ac45b2fee8b614208b70", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539293, "uuid": "56ab2c9a-70ba-49bc-8a08-6047ee45209d", "comment": "Malware payload", "value": "89a1d597b5550b12a29357783ab6bd72147302b5a4f452cbb75346046c1a731c4f49b40b9375ccccc2e409ae442c2c60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539293, "uuid": "40354470-c28c-4544-9c07-8fc0f420310f", "value": "9804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539293, "uuid": "c62b1cc0-734a-44c3-8a51-ed86b5ca561b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539293, "uuid": "10e4b171-6401-4ab7-8122-6ca78271d35e", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539293, "uuid": "4ffde25e-3ece-42e3-9dd4-4790b9211d37", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539293, "uuid": "f1f084f9-926c-48c3-b704-3b893c09cfa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539293, "uuid": "a18c06a8-5b43-4e9a-be46-e06cfe23748a", "value": "05c38379_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308d47d4-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539181, "uuid": "4bf62e25-c828-4474-b072-c9b116cdb4cd", "comment": "Malware payload", "value": "d46f3d3fe3d3f40a17a4e2e14cc9e09f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539181, "uuid": "4ccf4e73-fcab-4663-bdfe-1f108aaf3df4", "comment": "Malware payload", "value": "6367842c62412b4b8957ce338b8adfbe0f1ccaac6d69b664f37b6bd52dc82a6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539181, "uuid": "9ffb91ce-3c85-4d7a-bb20-1ca2e691beb1", "comment": "Malware payload", "value": "af961c8bc96586dd5175e75e23aa4998474bccf4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539181, "uuid": "23a330d1-cabf-4d3b-a858-328686957438", "comment": "Malware payload", "value": "ba0bd5685ac0f0ab220b6e8dc6ab2baed66e3a727e71055c8a9da26223f778f7cd8a7881810a6d0d223361faa3d03476", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539181, "uuid": "aafb2dd5-cb68-4720-85f7-43c5f22ce111", "value": "0804B032C6569C82F84D263031ACF39A7A32BD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539181, "uuid": "536b3177-e442-4c6a-957b-cda40c505847", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539181, "uuid": "53acc137-9f48-40f2-bc02-46e9765af070", "value": "3072:6WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:6WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539181, "uuid": "62d9cc04-8dd0-4071-b226-780b989bd964", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539181, "uuid": "39d5a3db-20e7-4fdb-9aac-f7d0a2068200", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539181, "uuid": "5b5473ca-66ea-4d25-8233-1bd25418ba3b", "value": "d46f3d3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94969877-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528611, "uuid": "8577553a-9120-4377-88a5-930031863a0e", "comment": "Malware payload (Dridex)", "value": "7051718de006627765ecdda1dcdcb95c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528611, "uuid": "a4aa0aab-6d41-46d8-b50f-f9e85177ee60", "comment": "Malware payload (Dridex)", "value": "637994f934925a7b9bf0b8d00571b9ada35a0df80f4ad455e07a6f0059019c37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528611, "uuid": "8cda51d1-c6bc-4576-a68f-eca61e5ea5b6", "comment": "Malware payload (Dridex)", "value": "7a2517a250d6674d0388ff504aa2c4a846f18966", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528611, "uuid": "a64d5dee-0474-45e1-a771-90ae1ad02b1e", "comment": "Malware payload (Dridex)", "value": "c5965ebfebe5ac3c2f512467aed600d229fffc540ba97ead0bb3348ba6ffe4ee55b904337051df4cb07b59d7b9535ddc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528611, "uuid": "79c595f4-a60e-47c9-9ec7-d80ae933bf8c", "value": "3B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528611, "uuid": "99528c10-3b97-42ca-a885-f494eb39bfb0", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528611, "uuid": "d15a44e7-0b6b-4a01-b789-1bcad3664403", "value": "3072:Ni49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:NH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528611, "uuid": "b9e6f3af-8d0b-49df-b8b5-7f4625ddca29", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528611, "uuid": "a8e50330-59bc-424f-ad62-c643d0b94bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528611, "uuid": "218c4c72-8dc2-47d0-a5cf-6b435daeeb9b", "value": "7051718d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c37e9d6-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526477, "uuid": "919a5779-10cd-4528-ad73-5213e97e780d", "comment": "Malware payload (Dridex)", "value": "3c27debf79e31168a9503ce467b9422b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526477, "uuid": "74c1ab0f-84e3-4ee0-9240-33606c0be266", "comment": "Malware payload (Dridex)", "value": "63d45e88d2db791415be410766080b89f9eeef7a58c6b32fbf94f564379577fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526477, "uuid": "d6653db9-7333-47b7-acbf-a8c0a591da6b", "comment": "Malware payload (Dridex)", "value": "97dc6a72119bc61f10e26048922166bada352b6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526477, "uuid": "d638cf60-1513-47b7-86fd-3433c7586175", "comment": "Malware payload (Dridex)", "value": "eaeaabea25661b388ef80726c3e11d331d6e3c9ff56e0b074b7e0feb529cab34dde8ef412df66050bdc0bab5a708ca61", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526477, "uuid": "4a8a0228-040b-4873-ac6f-49d5d4d43458", "value": "0604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526477, "uuid": "74ddadbe-edd3-41cf-9e57-3d0515a3327d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526477, "uuid": "9ba95bbf-60fd-4129-8073-0585e84b0350", "value": "3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526477, "uuid": "57074213-692c-4cea-9298-f91ff1b81a02", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526477, "uuid": "7ee0993a-643c-4484-a16c-d88f7991b753", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526477, "uuid": "73f69d28-e880-483e-8943-092007add32b", "value": "3c27debf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8787c7bb-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524295, "uuid": "386a8bd7-a6ce-438c-85d4-6e0e9b1eeebb", "comment": "Malware payload (Dridex)", "value": "14bb66a2cdaf5ab009673d12a5b3b7b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524295, "uuid": "2bd803a8-773e-430a-90c1-f3d7b618dc59", "comment": "Malware payload (Dridex)", "value": "63fb480a86f594085ff50a2bf64f9a922707b7a4f301d74d60fcc52dcfaf0ca0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524295, "uuid": "c8108886-061c-4a2b-a8f6-5639e6fc457c", "comment": "Malware payload (Dridex)", "value": "8c01abf0bbf9e47ec2a7dd41702a6ba12fcd2dbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524295, "uuid": "00903ed4-c58c-429f-9b0f-59ed5ffb532d", "comment": "Malware payload (Dridex)", "value": "7a3097fbcbe05af8bc4753b46bd740aa271fc9591f027e03afb300bfba06cacd015fdcfb52d0a8b222acb1ccbb73eef2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524295, "uuid": "decf8506-8a00-4b43-a223-948f79c464b4", "value": "AB04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524295, "uuid": "4895a5ff-b9b1-4487-8bee-47961a898d36", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524295, "uuid": "4b7d4b93-b8c5-419e-b26e-74a62609e69f", "value": "3072:DWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:DWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524295, "uuid": "4bad23d3-a260-4c86-975b-46d4bbaba15c", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524295, "uuid": "0bc70a04-41b9-43aa-b7e5-58caf7465182", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524295, "uuid": "79295559-e9cc-4675-9b40-7f2b50075c1a", "value": "14bb66a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7393877b-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1621528127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528127, "uuid": "b2daf0d9-54f1-4f4c-8024-3e9b906f6cfa", "comment": "Malware payload (DanaBot)", "value": "b2f96f0c8b7cc1899a27cb1c4b88a849", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528127, "uuid": "0d7ad6e6-a327-4b2e-b803-3cb7ea5759a4", "comment": "Malware payload (DanaBot)", "value": "640924cab9ff4e24cbb725eaca8c59de5f6e52378e45d2681ff3ef51cd6ff90f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528127, "uuid": "ba30e67c-c18c-45b4-b211-5a6f27fc5aab", "comment": "Malware payload (DanaBot)", "value": "d7f11e2957531215a7bb130022a2dadeff0003d8", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528127, "uuid": "138b1434-deb4-48a7-9654-e3c6b5b5798d", "comment": "Malware payload (DanaBot)", "value": "6f7083267230f05279308345efdc583f94e1dba0ab4fc45803ad9e8628ffa8aad2454a79c1387895a77334252219e7c5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528127, "uuid": "f8459744-7132-476a-b1d1-a86e7dd9e51b", "value": "C556333076E28035F6EF91BAC2B5D23E582639A0572064FF02DA7B9D56386F49C3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528127, "uuid": "40fc378f-87d3-44ae-b979-d21b6858629a", "value": "6b55f630541fdcd5757b3e440357a9c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528127, "uuid": "59d4b50c-d41a-433e-b0f2-64ce2d5ad728", "value": "196608:Tp4OU5IYtN888loXxAnyH+rcTIk0Kpmh0j8d:TFIZtN8RloXxvlxHpmh0j8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528127, "uuid": "e22d17b5-1492-4cea-a6a4-1907e24f0a91", "value": 6348800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528127, "uuid": "e456cfa0-0bdd-42e9-9166-ed98c93f50db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528127, "uuid": "4c4a5452-a9c2-4205-97b0-565763105d1a", "value": "SecuriteInfo.com.Mal.GandCrypt-B.8513.24756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858c381c-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539753, "uuid": "3be626e2-dd06-4915-bd43-dd99737d2b09", "comment": "Malware payload", "value": "dff4e5e1f97543eee7fef255275011d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539753, "uuid": "17bf596a-8e30-4c09-aef1-d64432fbd57d", "comment": "Malware payload", "value": "640b7779c5b0c415944552ca7b9ed52984fc44fe421cd72c29ca369ab43b7cc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539753, "uuid": "5319b112-f60c-450f-aa01-e80d7bcef135", "comment": "Malware payload", "value": "b1bda597a7891639dac4709352469fd4db788922", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539753, "uuid": "1af6a7ca-456d-43ab-8539-b500c47421dc", "comment": "Malware payload", "value": "690bfb4ba396462157e1148fefed4e6c0decdbe38974a157530c7c85f27f1be8b9343408472c9dcd3f3028ffd0dbd809", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539753, "uuid": "eddbb89e-9448-4ab5-b8fa-6b83141b1bbd", "value": "1404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539753, "uuid": "1c26a14a-688a-401b-ab33-50179477b9e6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539753, "uuid": "7ee1abeb-ac5c-4722-9b69-a3236524adb2", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539753, "uuid": "13622e8b-38d4-47fe-84f9-69b6dcd9ee6a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539753, "uuid": "ae406e3a-113d-4ff5-885d-61c41125e138", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539753, "uuid": "f6e34488-7963-4278-8e10-9a5d132eb0f7", "value": "dff4e5e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c590489c-b96d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621516668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516668, "uuid": "431c6690-ff61-48aa-a270-649d0a396849", "comment": "Malware payload (Dridex)", "value": "8206fe4ea6498b02b813d2d29f409d5d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516668, "uuid": "15bfbc06-c869-44e0-9c1d-112b5ca0a618", "comment": "Malware payload (Dridex)", "value": "640f80bb94be850855105938f0a8d321f4aa1b4966cb3a12f2252a7c60077430", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516668, "uuid": "9ce6c361-9047-4ffb-a046-8ce75c1d80c6", "comment": "Malware payload (Dridex)", "value": "b33723829164248ce4c3f712bec7a7fe71326be4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516668, "uuid": "09747ae2-dc96-402c-a89a-cb6c3a7edde1", "comment": "Malware payload (Dridex)", "value": "c283c2d47f43682861bbf279b3f6c57ccc56fedf528a8dabfb8a861d019077eba906ef1d831f9b17d15a1a64644a3dc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516668, "uuid": "59ff14db-677e-4885-bd4a-9a6c7f66c5a5", "value": "5BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516668, "uuid": "6d891574-3fa6-4093-b0fb-07341276add9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516668, "uuid": "48a3a9fc-e2ad-4b23-88d5-197d5a0f9653", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516668, "uuid": "3c35620e-992e-4bb4-8f3e-479ae0c88ef5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516668, "uuid": "55311f2e-ad1c-4a54-aba0-110b54bc4593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516668, "uuid": "1a747376-5c97-4fa4-aea4-045954eef5eb", "value": "8206fe4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b98321-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529437, "uuid": "50172230-7133-4b6d-85a7-9635ea69a1c2", "comment": "Malware payload (Dridex)", "value": "275f0bad85addb4032df85726bf6956e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529437, "uuid": "c05760c5-518a-41bf-8734-70ba68d78ad0", "comment": "Malware payload (Dridex)", "value": "643676116daa31c0134f28ce283c83feea917b62d70c9b2f696c999d4341879f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529437, "uuid": "77e48ef9-1298-4785-9f1a-7b2f6b7f599c", "comment": "Malware payload (Dridex)", "value": "2e1d1468de26ccd8ae360386fb3ffecee5b64c1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529437, "uuid": "7e6b81ef-1de3-448b-a08f-6b277216a93a", "comment": "Malware payload (Dridex)", "value": "306cf12da59aef6c9da882dbfba6d1dce35516b07850fd936e8dae9d72891ccc14f18e4d6a492ad86dc023bb3d8a4c56", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529437, "uuid": "a95e514d-4bc4-40e4-af3a-21f35ee0a6e7", "value": "4F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529437, "uuid": "388d7de6-5acd-4409-8aee-493972e94120", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529437, "uuid": "ff7ee4ec-22af-4a17-bdb0-040f106a8eeb", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529437, "uuid": "9745def0-40c0-4b18-ba03-5a583c41ac0d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529437, "uuid": "df7e5d68-bd64-4a1a-8306-83ed6a82703b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529437, "uuid": "bff5563c-b7bf-4c6b-b5d0-1e372c6e5fa9", "value": "275f0bad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da9ba3f-b954-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621505702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505702, "uuid": "a03cbbc2-1dc7-414d-98e7-5404ef85147c", "comment": "Malware payload (Dridex)", "value": "7a481bf6c37672bee34c591fece11887", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505702, "uuid": "7289284f-d4e9-4caf-a59d-117209531b6f", "comment": "Malware payload (Dridex)", "value": "6463e7a159968a1405d1ebefc252489e97950c861b7ad9c4aa3b8e4dc59710cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505702, "uuid": "d873155d-9125-4b2c-b457-5bf37a3ae3b0", "comment": "Malware payload (Dridex)", "value": "53ad1a3d8a4cdb1a2176fb4293c3a87c61288167", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505702, "uuid": "db45b4e3-f6db-433d-bb39-d292fcbbfb13", "comment": "Malware payload (Dridex)", "value": "9108f8a55575f71e0aa1497f6892c4cbed014dd36a9c024ad9d05e51df9fde6280547f5ecc33a7f6c906ff599129bd29", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505702, "uuid": "1d5729ac-523d-46e2-9672-40f052337d7f", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505702, "uuid": "b76d5baa-a758-4fe1-856b-78143225f541", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505702, "uuid": "bae02014-43a6-4e2b-beda-cfc4c88d85b2", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621505702, "uuid": "aeee107a-db5f-4ec2-892e-8f86cb23f03a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621505702, "uuid": "7873ea64-5f11-49a4-9437-d1c0f6ff988f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505702, "uuid": "69ff78ec-3ce0-439b-8a81-288a4599a44d", "value": "7a481bf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1d5d6e-b94a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621501589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501589, "uuid": "c7e0d086-8acd-4b62-914e-d050b5d64a83", "comment": "Malware payload (Quakbot)", "value": "a6536b4f7df6ef170a3f9e3a5336bc33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ts Trade ApS", "colour": "#2BED26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501589, "uuid": "5164e0d6-e7bb-4683-9f23-16c1035aa0e3", "comment": "Malware payload (Quakbot)", "value": "648d4042a1f5ab88223d4e41098daf90b9af4aaa9a179557b893491e3a7f0d46", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ts Trade ApS", "colour": "#2BED26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501589, "uuid": "7ad22b05-c1ec-49b0-abd8-a47e22360862", "comment": "Malware payload (Quakbot)", "value": "4bc8dd6b33598ad8df165c1f6974eeae2cfc2973", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ts Trade ApS", "colour": "#2BED26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501589, "uuid": "6b43a9a6-fd77-4596-a637-1089210ed374", "comment": "Malware payload (Quakbot)", "value": "1bedcb4ead732dc33523405483bd0c4af7d14fdb28dfff6269b7132ade5579db5e947c762d6246784705f96ba05b8f53", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ts Trade ApS", "colour": "#2BED26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501589, "uuid": "d14c4d56-271f-453f-89bc-34dcd14ff759", "value": "E6758C366359CD02F72A0B7561D38A247871EF9F3221871BC5E1FA18F839BB56C8D264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501589, "uuid": "e1a2f605-0f1c-43f3-bc16-be4e7be85848", "value": "478743f1d3d70c2a8c9bb38305173291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501589, "uuid": "50f813be-2a19-4667-8854-42dda435e990", "value": "49152:os3kMuO7Tb8fii23vtlJhOmaywo8Ubz3vtlJhOmaywoUUbz3vtlJhOmaywo8U7T0:otou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501589, "uuid": "1af54139-8780-4281-9322-e6190931b299", "value": 1663464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501589, "uuid": "d71cfeec-f14b-4833-b0e8-24496c5b268c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501589, "uuid": "322fedae-05c5-46bb-a869-ff77db0bc054", "value": "648d4042a1f5ab88223d4e41098daf90b9af4aaa9a179557b893491e3a7f0d46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39714abf-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530177, "uuid": "66c5230d-58e7-49cc-998d-b86fbb205b42", "comment": "Malware payload (Dridex)", "value": "d3a18d9509baad22044bd04b2c45624c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530177, "uuid": "fb111bd1-3ba4-43b2-bf84-9a59f5337cc9", "comment": "Malware payload (Dridex)", "value": "64a16478f694fce60dc0935b66717152675362efaca42415c76cca722bc86005", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530177, "uuid": "d7241c1c-bba6-4d18-95a2-105c9b706b61", "comment": "Malware payload (Dridex)", "value": "9cdddb47340146815bda5e9006adcf8ed6d3637c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530177, "uuid": "c594202c-3e9d-4f0b-bb15-9dd4801d95ef", "comment": "Malware payload (Dridex)", "value": "87fac5b59354ae953123f22a5a7da3e652b599fd1d0414aab822e2feed1b3a1c3c77ef784c1d714c02ce1cd60c27e69a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530177, "uuid": "c701c80b-ec80-4286-b182-73b610526e20", "value": "BA04E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530177, "uuid": "287007b1-3702-4817-98f2-249d8ff74205", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530177, "uuid": "7c2788a3-a12f-41d1-bbc7-9838052efb7c", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530177, "uuid": "30d3003d-5c8a-43c6-8c5d-cd89c8516f51", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530177, "uuid": "d5b055cc-549a-4bc9-b0e9-7ff223b72574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530177, "uuid": "bdeb13ed-f286-4d98-b037-bef5ade050ee", "value": "d3a18d95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c117ab7-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533134, "uuid": "e0445a91-154e-42e4-bca7-865004b72edc", "comment": "Malware payload (Dridex)", "value": "ac3cce807579d18790ba15766a269891", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533134, "uuid": "a94f9d20-e384-4c48-8f5a-54ca629469f4", "comment": "Malware payload (Dridex)", "value": "65012d2e894e023e2553a00f475b16de49e24f9c13e9b7a0dbc13cea340a98d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533134, "uuid": "fdbace68-3863-497b-ba92-92d50baaf070", "comment": "Malware payload (Dridex)", "value": "b3adb2e855a7998ae4b062dc6ed6c946cb2cfd94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533134, "uuid": "82ba10e4-8070-4850-8b50-da9a387044f0", "comment": "Malware payload (Dridex)", "value": "7ecd01daaf20953db1885720f8e223dfa8fe925f232e82bdf662de5916155812f58ecd9ab0be791ad20a3b46552d10da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533134, "uuid": "67068d79-89c0-4ac1-a12e-938e16878fbf", "value": "2104B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533134, "uuid": "e6fb8387-7dfa-41a1-88dd-9fe84f44e056", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533134, "uuid": "d858409d-4e61-400e-9745-877f6bd9ea96", "value": "3072:gWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:gWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533134, "uuid": "bbddd56b-1e4e-41f5-a37b-842bac32ae10", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533134, "uuid": "ec8ebc81-afad-414c-924b-4dd9350897b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533134, "uuid": "71f95cd0-017f-45d1-b65f-839efbc8afe1", "value": "ac3cce80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40501cc-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472454, "uuid": "e5ad4ed7-0a10-4296-ba81-5f479d8c461e", "comment": "Malware payload (Dridex)", "value": "a8d8b4f303dd27357a9def18ae227d80", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472454, "uuid": "4d62bb08-da53-48e9-aecd-7bb3ef6ca4e6", "comment": "Malware payload (Dridex)", "value": "6512ec39c81c77686d8d8ee0ee6f9a8b90e0548d13d588191270285b15ed94ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472454, "uuid": "97285e34-a7b1-4aea-9f51-49239049fcd4", "comment": "Malware payload (Dridex)", "value": "0eabc5228554f636999d64972ac1b7e76ca4cad4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472454, "uuid": "5e970864-fc20-41e6-990f-0585d2410938", "comment": "Malware payload (Dridex)", "value": "9e174ae1c25f8374bd98495c9108da15017df4a53b51e39b9f41830d47c2fd81215e3cf0c2848fe156b62db3b9f4405c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472454, "uuid": "6872db4c-5db3-40a9-afbb-4554eaac2d76", "value": "D304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472454, "uuid": "15ffaf13-2a9b-412d-b549-e7921e2f7d22", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472454, "uuid": "5cd370ec-f579-4ef9-a067-a8341015b79e", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472454, "uuid": "8444e270-82d2-4706-a897-70abbd5e428f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472454, "uuid": "2f74405b-5b94-4e0a-aafe-ff93ed214198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472454, "uuid": "cf9a710e-57db-4fa2-8f79-ad33f7bcc669", "value": "a8d8b4f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3168def-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530058, "uuid": "231939d1-ffae-4ad6-942d-2cb0a8a241b8", "comment": "Malware payload (Dridex)", "value": "d582a7cc2587dcabfb5b27efaf07b44b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530058, "uuid": "4a025026-9f41-460d-91c0-acc7225318d2", "comment": "Malware payload (Dridex)", "value": "65621e6c22e1a7c0417e7f5680ade0775abb12f86f0493ecf8c0ae019799c42d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530058, "uuid": "fbe98c55-7987-4ed0-b0ed-66d6ef91155b", "comment": "Malware payload (Dridex)", "value": "8c3ac71fe030f5f48b844b94ae4612df6cf463d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530058, "uuid": "833b1c31-b08b-4b2f-8fb5-0ffe5823d670", "comment": "Malware payload (Dridex)", "value": "f9145b89b6c47d2375fb8ab56d98af7fbc63432d319736f2a80d393fef4e8f4047ef8cc0bcb1b7125fbd3795c79b2ae8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530058, "uuid": "66d08be6-5d0a-4e29-be7f-bb64270cc005", "value": "3D04E0D0C6C62687E4A7DA369CC17D2E5735680ADD29CB329FB6CD13D0A272F1993063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530058, "uuid": "8162f6e3-4f7a-49d5-87b8-9b26e135bf95", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530058, "uuid": "8d066c5b-b5a4-4e16-a593-81a1e2de6f2a", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S57NZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75iByn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530058, "uuid": "857170f7-2d43-4015-8028-923e2483f839", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530058, "uuid": "82effbfa-20e6-4ddb-a32e-2303742b34ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530058, "uuid": "4e3cbcb0-72ab-486e-8cd8-2859efb22154", "value": "d582a7cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1b13cc-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476115, "uuid": "6c19480c-4343-4c15-878e-c725799bbea6", "comment": "Malware payload (Dridex)", "value": "3ec62be524847c205926a30050220b1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476115, "uuid": "185e4b1e-f950-48c1-a24c-b0e59e9dc2ab", "comment": "Malware payload (Dridex)", "value": "656e8afc710420dd38772a43908f91fdd67d927a4b847abf9e4544b961dfa257", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476115, "uuid": "db1d22e1-1dda-4558-acae-36e460781d4a", "comment": "Malware payload (Dridex)", "value": "5e6fe2957024362dbe14d8ce0a9838c580b0e733", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476115, "uuid": "8b627b03-aaec-4401-a666-b972ce8d6046", "comment": "Malware payload (Dridex)", "value": "638d632299eaa8c3a2cc76eea3603fcfc37250dc45a16cd3c138c380d725ef1064d8eee9766da65a2ad80850341a46bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476115, "uuid": "07f82e58-05ef-43df-aa9a-ebc21230af1f", "value": "B9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476115, "uuid": "53646a90-5b75-4cca-bef5-ce4bd8da2351", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476115, "uuid": "c5bafd7e-adb3-4040-95c8-a3a74d8504fa", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476115, "uuid": "f7a62df0-a663-451e-bf08-591240fd6674", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476115, "uuid": "0873394f-4d04-42ba-b1ff-6512ff858ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476115, "uuid": "0888edf0-752c-4a14-9c0b-6327c318262e", "value": "3ec62be5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5847eebb-b94d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621502740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502740, "uuid": "6cf82cfb-9f13-4bd9-815b-1951fce420b0", "comment": "Malware payload (Dridex)", "value": "a60d0bc649a77c9d1c6b9284b6405364", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502740, "uuid": "bc0e4553-b2bc-4947-9760-e8314473479e", "comment": "Malware payload (Dridex)", "value": "6577402ce6c2b6636f69cd69216be4a1a2d4a360d253239e682ac5fc12f12da8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502740, "uuid": "d49a99e6-8dfd-46fd-998f-97948db80de6", "comment": "Malware payload (Dridex)", "value": "f9620a815a5f2128b9d0cf0bbabcc32bd088e420", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621502740, "uuid": "88f73c29-8b7f-468d-9a74-cb2157ce54a1", "comment": "Malware payload (Dridex)", "value": "67419d1f9599710e8ea0cbb8052103b4e27d7fe54e56121d930036fe828ab675bab1cba83e433ae4de4f038a0022a272", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502740, "uuid": "f1e233b1-7de6-4422-8dd5-b39b10c56835", "value": "5FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502740, "uuid": "813ffc7d-1fa7-4786-8f5d-64bf1261c1e3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502740, "uuid": "bca82052-f42b-475a-ba21-0e9422717d88", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621502740, "uuid": "7207886b-2b9c-4d98-bd57-71882f01b8a4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621502740, "uuid": "2b86eb4b-9771-43f3-9870-cb41e971b1e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621502740, "uuid": "a90e28a4-ff79-4e6b-855c-87c1464b9ca8", "value": "a60d0bc6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71492ac-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540373, "uuid": "eba52828-c387-494c-ac63-b8f9eb26e254", "comment": "Malware payload", "value": "14f2dd4969edc41bc77183a01ec2d3e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540373, "uuid": "6b1f3b2e-5b93-44b6-99c0-48a583172643", "comment": "Malware payload", "value": "65d5900b34979600d145196e84a589d394350a7fe019f1ffd38b3bf7be73ec63", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540373, "uuid": "4ef23a68-410d-4ace-be25-f2f1365a8b1e", "comment": "Malware payload", "value": "388ea7927363f7b9882e0d097384f0d445791ac7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540373, "uuid": "61116462-e36e-4dc0-9d5c-b2e943ca8c2c", "comment": "Malware payload", "value": "6f0b4b47b90299ec7b3aa96c2bbbfa611d6b8fc8a0cf642b63b2818b70c51b7b05803e5eee92494f6073aec270ab40f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540373, "uuid": "5ab6939c-baf8-4504-812f-872158faaa17", "value": "7504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540373, "uuid": "947f66b9-9a6d-44a3-89bd-ff1dd27e0918", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540373, "uuid": "5d2f4208-d5b8-4aad-96f9-4a8f80bee522", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540373, "uuid": "03ea892e-c5ed-41dc-83cf-08408b545fa1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540373, "uuid": "578d9187-8010-4575-9ca4-ce94787b6fc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540373, "uuid": "55dac0bc-b92d-4379-9996-aac75fd606cc", "value": "14f2dd49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c740432f-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527837, "uuid": "c9791e8f-93e5-40fe-b015-ed070b437557", "comment": "Malware payload (Dridex)", "value": "c1c49a689aa74500ce0f1a50e0409005", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527837, "uuid": "d3588cc4-d26f-4965-b041-4ccfaf37985f", "comment": "Malware payload (Dridex)", "value": "662e3da44ed3575958dd8b077cd35a585f7635a0ec36377f88353097c2951ddc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527837, "uuid": "99985ed3-c111-48bc-a195-3d4f43f01469", "comment": "Malware payload (Dridex)", "value": "ff0f2ef3604782836bd8786c7114de95dca9c554", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527837, "uuid": "87010a6f-9391-433b-94cc-bef1366fe97a", "comment": "Malware payload (Dridex)", "value": "0f5c73c814b00e052efd16b76e58f030267682f920d37b4921a8c661b74ae89d3261112b2d3cf23dd37de40accc3ec0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527837, "uuid": "d3118b46-8c78-404e-a2a7-16f2fa843672", "value": "B704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527837, "uuid": "3b10f0fa-06d5-46ce-a600-ebf3ba650ea8", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527837, "uuid": "921562b9-a1ae-4452-a9ba-c7f97ab2869c", "value": "3072:Ei49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:EH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527837, "uuid": "368d3e06-5820-4497-b2b8-e4b9b127bad2", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527837, "uuid": "cf227346-9108-4e4b-995e-ff31ce1c7129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527837, "uuid": "08d94b62-0e97-4f0a-bbb1-647f46409f58", "value": "c1c49a68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b635651-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540622, "uuid": "a5b70fdd-120f-48b9-8be7-e8b87b5e488a", "comment": "Malware payload", "value": "be0fa4f6c9b48f322ee9c6b19dfe27d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540622, "uuid": "65d87487-b951-4339-8379-8031214865e9", "comment": "Malware payload", "value": "663448244b098e3aa697f8e01514dbde9a19e1a35e7f6937fb1bed21d4221b8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540622, "uuid": "cd48cfb9-377d-42b7-b42a-7e71db1c70a5", "comment": "Malware payload", "value": "b18b2496541a3c3e9d035dd957ebbe7448cd4c65", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540622, "uuid": "f2fbac37-7d9c-4fc8-b960-fb34ac9e9be6", "comment": "Malware payload", "value": "2abbcbd62c347a96eddeebfd197284dbeeb2212031e273570c80fbd6ad29deb0c3bb0b506b6bf704f64a7362bbdcb769", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540622, "uuid": "0697b838-50b5-4712-b9b6-54b6aab42677", "value": "F5F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540622, "uuid": "03db876e-fe18-4ad3-b8bd-04c12663c93a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540622, "uuid": "dd850378-32fc-475c-99e9-78ba0b938d1a", "value": "3072:kA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:k3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540622, "uuid": "436b3f9f-0ee9-467b-8ecf-d2b173e8052b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540622, "uuid": "bbce140f-c0a7-4799-8ad4-6f52171f8bd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540622, "uuid": "12b11bf7-5593-4889-97a8-1b65d3a597aa", "value": "be0fa4f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06742348-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526226, "uuid": "3dd11b36-67fe-4ebd-8c01-ae226622bd25", "comment": "Malware payload (Dridex)", "value": "8d67ec9859784826b7fed12de9d57a28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526226, "uuid": "ddf035d8-cba6-4082-8597-f10fa2ebf007", "comment": "Malware payload (Dridex)", "value": "6638221c1a34291ac3dc6665b31f28aba3ff407ff9f82c137c2e00414950dd5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526226, "uuid": "7c0a31d7-88f1-4349-ac62-33e285145f7f", "comment": "Malware payload (Dridex)", "value": "5a02302f553d70a2d05bb9fc53c564f618bf791d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526226, "uuid": "2a3b13d3-cf98-4848-9afa-53beeff3d6c2", "comment": "Malware payload (Dridex)", "value": "e4dc60ba65c15a8b9b9ddb5f8c70a679f5385379a61709113bfe32a351b018b7d187905840be929ae1d51659a32f1cb7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526226, "uuid": "5c3cc8d6-728a-40cf-b7fd-adb4e37779c7", "value": "6504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526226, "uuid": "e1a5ac6c-6164-4bf2-88d9-feb947f061b2", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526226, "uuid": "452a6938-f44a-4a11-8d11-ae559e5f0671", "value": "3072:pi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:pH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526226, "uuid": "988d4da2-ca0e-400e-a5bb-c545889b238e", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526226, "uuid": "73ae2ee6-e524-45af-990a-006889b7b084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526226, "uuid": "a427f2da-af3c-4a43-a570-b2c7b0a39958", "value": "8d67ec98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225c2717-b9c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554190, "uuid": "33672e8b-a2a0-4266-ad38-e50dd3cc44bf", "comment": "Malware payload", "value": "91439c6e37905cc7f3f1a4ca25bcee00", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554190, "uuid": "a9f92ab8-4179-4c8e-9179-92f38c6ec2f9", "comment": "Malware payload", "value": "663be5aaaab6feac002338ea8218fe88337b4b6ccb46b29d4f2c70443916cdd3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554190, "uuid": "e62e6051-7ce1-4d30-9f31-ee7fdb06a2a5", "comment": "Malware payload", "value": "751489422730b7da5aac681ca05f1a720d09ccd2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554190, "uuid": "0ad3e171-3093-41d7-ba7c-7cfb47591592", "comment": "Malware payload", "value": "cffb1af1a44abc8b07cbd38f50e2d89ddcc5dd5252b581d10030b9f8672f9e2fa2b345d4abfc6c74ffee7682356359d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554190, "uuid": "cc48bba0-7f26-448b-b6b1-6a3d328b3171", "value": "8F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554190, "uuid": "77fd5306-2760-4299-b54f-01e86e455d82", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554190, "uuid": "0889e59d-3fa7-4fd9-9e98-74a8b17a5fcf", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554190, "uuid": "6e0e2dcf-9085-416d-8313-96a8c98aa378", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554190, "uuid": "3f80fb90-8c17-4523-aec4-1bd8968f3178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554190, "uuid": "ce9dbdb9-e82b-495a-bd01-3a287ffcc7ff", "value": "91439c6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0318637-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545838, "uuid": "641933c1-31d4-4ddb-95c5-a80c35ccb8c0", "comment": "Malware payload", "value": "25ac1ef72b5c18c02d102f5e70e2cf7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545838, "uuid": "38970bd8-3070-460c-9386-af7c96bd13a8", "comment": "Malware payload", "value": "665e41e4f4659fd65be661a1127e46e2f91de5406bff76db5a0dac0449ea82ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545838, "uuid": "b779ee0f-31e9-48cc-b230-2a5fbc390845", "comment": "Malware payload", "value": "10fd201b602076c3d46b90925df9baf81e0ded6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545838, "uuid": "0174388d-df67-4a55-bdaf-20ef3d596de6", "comment": "Malware payload", "value": "5d6faa1e906822a744372260e77951f9d9bebd016c50e598c1c0c4a77c988551aec7adf0ade645a466876f4e1dd4fa45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545838, "uuid": "3e984067-d756-4ec2-8694-9f8ec1d76427", "value": "A104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545838, "uuid": "d64ade69-f8da-4511-a73b-82e8a4a138d5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545838, "uuid": "3d3b8955-b8e5-4615-a680-2080cc1fe39b", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545838, "uuid": "255c7294-c528-46f7-9336-12e44a5c17de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545838, "uuid": "ccf41eaf-3883-46cd-9cf2-2101e1fbac9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545838, "uuid": "15343384-14e9-427c-8eac-68525c6e77a0", "value": "25ac1ef7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feddf35e-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472526, "uuid": "cff610dc-c1e4-43b9-b77d-91e3ec973199", "comment": "Malware payload (Dridex)", "value": "d7fe7e319f3745e8fd80b61c57961577", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472526, "uuid": "d76fd4d2-04ca-4fce-89af-91b709c22786", "comment": "Malware payload (Dridex)", "value": "66721b30afe5e6a6415072b0db53881eddc6cca48a518027e65179869ffc85d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472526, "uuid": "4aa0445a-48c9-4283-97ad-2056ea5f605d", "comment": "Malware payload (Dridex)", "value": "936c126afd05425efd65b69df67ff25dc2759b0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472526, "uuid": "6ca78c34-8e81-45ce-9be5-705ce1e4c4da", "comment": "Malware payload (Dridex)", "value": "e0e13eeba85de7964d95951315d46f4371edd5bc83d531a603b0c475a51c2f010b3a66a279d90f9173caec10bdebcd3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472526, "uuid": "9229f0b3-ab26-41ad-806c-b4f464455c54", "value": "B4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472526, "uuid": "db1f3f72-92e3-4447-8f3a-1e4c0db966dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472526, "uuid": "61323613-c650-45fc-b5b7-e1243778264b", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472526, "uuid": "c3f83dc2-f837-4456-9ec9-e70ed263a053", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472526, "uuid": "8bac8e83-2bff-4583-b0d8-e38701a86697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472526, "uuid": "edde1db8-2713-4bc1-863a-102f4d2cc7b5", "value": "d7fe7e31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b63032-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468860, "uuid": "f220b9da-3f49-43f0-b1da-9a78ec2bc26c", "comment": "Malware payload (Dridex)", "value": "c52f5d8021bfb849af5b944696362a75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468860, "uuid": "8e9eef15-7bcf-418b-aeb2-130e45e11af9", "comment": "Malware payload (Dridex)", "value": "667df2f272218e051e074a343d66ca84f88ddd9daf954078d8ce0de4bf0cdba1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468860, "uuid": "c2abca2d-4e74-4715-865b-aac845248332", "comment": "Malware payload (Dridex)", "value": "c503851c7fd6eaf35ea21b863903b3b9a6c7548e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468860, "uuid": "a245ad4b-de7e-4aeb-a2a5-e0c362db126d", "comment": "Malware payload (Dridex)", "value": "fd91c84306ba32d441bb98b3b7ffee986e5a6b73a3df499eef8d4010af005ec090e673b226c0698431b064cc21a7d8c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468860, "uuid": "e85a87ac-e22b-411c-9920-38a8ba768a15", "value": "EDF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468860, "uuid": "bcded261-1b9f-4d3e-b532-32a3a652f043", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468860, "uuid": "8fbe19fc-45c4-4825-9fc8-8ff75bdb8332", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468860, "uuid": "478133bb-73e6-409b-9251-ca1ee2f659eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468860, "uuid": "48c642f7-64ce-44b7-927b-9be7da4fa37b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468860, "uuid": "4beb5d1a-685a-4dc7-8097-56edaa3b5181", "value": "c52f5d80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffa0e34-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540656, "uuid": "7be5b70d-32df-4695-8311-f7257520f111", "comment": "Malware payload", "value": "417c4fa5197cb1191ff2f381578ddf0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540656, "uuid": "64f8c34e-2811-4d49-aa96-1f548ac758e9", "comment": "Malware payload", "value": "6680d7ca1b2602e1afeb66bd6154c5a6113632bc131b30045bbdd8fb513f42ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540656, "uuid": "5f7b0542-c2d0-483a-9cd7-ef247263ce69", "comment": "Malware payload", "value": "fa040dda6738b6774ea41460a25af26c6e7df1a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540656, "uuid": "8b3de48a-d367-4295-824a-265237a365e4", "comment": "Malware payload", "value": "79eb18032362edc08fd2d5d39d00ca80f75dd3e8feda6d54fafcae64ace90335f21bb5c3b76bc94782b27b511cb2093c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540656, "uuid": "cc0dcdfa-05b1-4711-b992-29274cc83ea4", "value": "0CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540656, "uuid": "6e1efae8-8560-4269-9b18-c1adb4f4a639", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540656, "uuid": "bb618e4f-a100-4d66-a665-61a17bb88494", "value": "3072:diFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:meAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540656, "uuid": "c81e0357-aecf-47d1-80eb-d39bcadd2a01", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540656, "uuid": "44acd29a-abc1-445a-a52f-dbde8834fede", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540656, "uuid": "a029c2ed-565f-4ea2-9613-fcde18448ee6", "value": "417c4fa5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0ee985-b97c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621523046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523046, "uuid": "a93f44f5-39e8-4322-ae1a-61fa20ee89be", "comment": "Malware payload (Dridex)", "value": "69d3f46c2d37b5411efc56e3f54fa516", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523046, "uuid": "4d90e5a1-030a-4948-85fe-6d82a1b9648b", "comment": "Malware payload (Dridex)", "value": "66b9031fe02793fbbdc975b666da70b97a5ef71c1319c6bc063dae3e2b040701", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523046, "uuid": "e5a72ebe-c8c5-41a0-8429-945bd6755c25", "comment": "Malware payload (Dridex)", "value": "e09e3c316980171c22f33f9ee0aa91a3623d68fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621523046, "uuid": "93a85147-06f2-420f-906a-8cb248e47d43", "comment": "Malware payload (Dridex)", "value": "a6f8fe2907051ac40df2c0b4e55afac2575d0ab8a7b6c0d85e6f7d0982cf45824a0258b91ba7dd97db9f4a401040bfb8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523046, "uuid": "9cb07c0e-ada9-4c1d-9482-163593d76f07", "value": "F804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523046, "uuid": "101fab0c-6f5b-4fcc-93cc-53903282641b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523046, "uuid": "a5e7daf2-f7b5-4217-bb84-e4ce5d7fbb7b", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621523046, "uuid": "75fa88f0-7b73-4635-b24b-be9dd0fd5cdf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621523046, "uuid": "3ce68590-310f-40f0-a766-e86417dc1299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621523046, "uuid": "4ec7f952-f0ee-4696-916a-4e0d4bd798c0", "value": "69d3f46c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2373f817-b9a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538730, "uuid": "093a987d-e081-47f8-94a6-48f461a97b73", "comment": "Malware payload", "value": "c8b41d95884dc07d924e610579bc916f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538730, "uuid": "ac175676-3dea-47fa-9855-d52477aa9d4b", "comment": "Malware payload", "value": "6730733910feeeabea5bd6ccc2cc1f47106285a19168d5ee79f381b02ca48340", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538730, "uuid": "05aca19f-1f83-4bb7-93ea-ec11f3c55353", "comment": "Malware payload", "value": "7ca6f7223d4e1883c568030aea94ae189e018824", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538730, "uuid": "4fc32a40-0702-43af-8bb0-fa85282093e2", "comment": "Malware payload", "value": "9b50785f27e5842ea9cc17755323ea75cec16801a6b96e5c007ded9c0ffd66b8ededfbe68d5547b4eb683a07bf87bc60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538730, "uuid": "ff99e01c-0844-4b21-8708-19e967f4704f", "value": "32F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538730, "uuid": "7d81db3e-fbfa-4bc4-bb23-3548e5f29f32", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538730, "uuid": "f35e5be0-f0b9-470f-a6f4-5b7566c18a88", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538730, "uuid": "cfe54d28-6cc3-4124-a38f-4e3b452731ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538730, "uuid": "58bf20ab-33d0-433e-a2f6-b35102423f92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538730, "uuid": "2e9e0a11-c340-43d4-96e4-ca6824310523", "value": "c8b41d95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7761ede-b9a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541152, "uuid": "c909a058-3129-42c2-8f8e-61a35817c09b", "comment": "Malware payload", "value": "1a7e9f24e9388e1931df2b6236164f47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541152, "uuid": "788f3ef2-4963-41da-b7f4-cfebe73b6659", "comment": "Malware payload", "value": "6752d6bef130d388c897541e7793b1011168a3496dea9f50f2d35514e1c0f3b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541152, "uuid": "a165c079-edce-4c33-a006-c1567eeb4b64", "comment": "Malware payload", "value": "c2d8f3566d5e741937a2a6f6b230050b3fb65bbe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541152, "uuid": "b8dc3fd4-6d71-45f7-9f36-5685f92865af", "comment": "Malware payload", "value": "e7f7fc52e24e895a2936196f4139ea4d451540f2fb263a5409e30ee039d8edcbcedc0e557703271ad99f946d62457e7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541152, "uuid": "00f1f9fd-2ac5-4886-99e9-73e7e21a4538", "value": "4504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541152, "uuid": "580fb3e6-0794-4257-83e8-b0aa70fb0cc0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541152, "uuid": "ff3683ca-02e0-42d8-9f8e-955e0c152c03", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541152, "uuid": "f4933a8c-4399-40c3-a03f-f3677a41b5ca", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541152, "uuid": "73f1934f-77e4-4dd0-8a71-1c6d7eda8048", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541152, "uuid": "4dc94841-037e-46f0-9d1d-f849478fdd61", "value": "1a7e9f24_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a39dcd-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537690, "uuid": "ac581764-af07-4599-b112-c05c55c611f7", "comment": "Malware payload (Dridex)", "value": "e4029ff791546ccfe4a5d8f3707dc9ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537690, "uuid": "50f12cf0-dab2-4912-9ad0-e8a14efb5ec5", "comment": "Malware payload (Dridex)", "value": "675e2ae644ac314ad1f74893dbbcc316018db4ed9d158e34066ec55646ee63af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537690, "uuid": "7c9a3931-b31a-4ff1-9389-0948a756ea99", "comment": "Malware payload (Dridex)", "value": "f5784f619fb96095243839d8a9091d10edc144db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537690, "uuid": "26049293-1a9d-4f35-8828-a8fd13815445", "comment": "Malware payload (Dridex)", "value": "36991b134c13f6cfff62872c3f8341e3fa51e7d8ee2507995bd1a6bca4c288abb283cc15f380e6fb60209fa66bc3a6f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537690, "uuid": "b56c721e-b5d7-4913-ac16-4da5855c10a3", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537690, "uuid": "2654637d-75e6-45b3-96db-c3ae0d764b38", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537690, "uuid": "2e3d9893-37ac-4f3c-89f4-69603122f0a5", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537690, "uuid": "02349b47-c3dd-459f-843e-e8e46bc0c5d6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537690, "uuid": "48dd6938-6da9-4fa5-bcb2-302eaeb7455c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537690, "uuid": "332130ed-a46d-4f93-8834-94667030c379", "value": "e4029ff7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758dbac2-b9ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621544021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544021, "uuid": "c11e975f-ee3f-4f50-9c2c-e5a198a792e1", "comment": "Malware payload", "value": "b95a03e5f27ff6bbaa45e6bd87e355da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544021, "uuid": "07eacfcf-f5aa-48ec-bf27-54afe158440c", "comment": "Malware payload", "value": "676bc92d6723bdfabcad01086d6138be2e7d8921fddac4963db51f50f7cc3470", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544021, "uuid": "f6068242-c74c-428d-95dc-5d23cb9bedeb", "comment": "Malware payload", "value": "3c7f3206ff573d8323a15851e8960c7f1ad28881", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621544021, "uuid": "8ba6b3f5-516d-4920-84c2-38e10416d0c2", "comment": "Malware payload", "value": "bd3122ae55c3039dff5a90e7927b5b0ece26514d3f4c947fcb8beef3437e8da898fcc50acbdef4d66d164382f62f0e17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544021, "uuid": "9a6d2c63-aa54-478b-b44c-7f273e77de23", "value": "1A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544021, "uuid": "8d67b6de-d3aa-4db8-8748-4bd8d49755d7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544021, "uuid": "d14c5379-3c64-42d3-aba0-31b472b9d565", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621544021, "uuid": "ed390a1f-7f9d-4556-922d-3c824a87ff12", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621544021, "uuid": "2aa22242-b528-4c7d-b49e-4b0aa6481efd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621544021, "uuid": "972bab3d-9e5c-4c91-b732-afcc6d728811", "value": "b95a03e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8040c7ae-b9a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539744, "uuid": "c9098b7f-77fd-481b-9212-ff6b37759279", "comment": "Malware payload", "value": "86129c607478308a4ca8129dbf8c10ea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539744, "uuid": "899b8e66-9628-49c8-9019-780d64fd5991", "comment": "Malware payload", "value": "67821dc6433a5ef3b8ddb47497a714a6eb08be5cb5de99567191463386e2c4db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539744, "uuid": "345ed11d-71b7-4567-855e-4968c94b5ff4", "comment": "Malware payload", "value": "9b29824d8d9fcf4d47945124e6e16654859eff26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539744, "uuid": "09b2d4f1-0b5b-463d-afd6-11a71c5d51ef", "comment": "Malware payload", "value": "871c114f6cbeb8c67f4f79309a3125a35e95ab545791e1ffde18b2ed182d73d3fbe7d1483c831339a5d9420fab628ee5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539744, "uuid": "787175e4-a5b5-4ecd-b988-65036658a388", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539744, "uuid": "96fa0fd7-acfa-4bc9-85c5-423b422df2d2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539744, "uuid": "f5dff9d6-f822-45ba-842e-c13d1e855760", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539744, "uuid": "3ac85fc5-21f7-4a11-af4c-d684a76eda6a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539744, "uuid": "9300aae7-4694-417f-8340-d948123a744d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539744, "uuid": "c0e1e980-431e-45e6-a383-f44aff6c64d3", "value": "86129c60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02d375e-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537785, "uuid": "dc85ac0a-2100-469e-8789-92b211133bab", "comment": "Malware payload (Dridex)", "value": "eb705c4c58e7810ca24ced9b5a3eac48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537785, "uuid": "738ae896-22bf-45c8-b413-8e0311017c3e", "comment": "Malware payload (Dridex)", "value": "67a0d274f7e4ef879f7c2eae15ec88bfffb63a12173af7cb4d78dd989e8db358", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537785, "uuid": "07de3521-990e-41d0-8054-2c2233749054", "comment": "Malware payload (Dridex)", "value": "f8f8628635d63a74ff9379db16558f6fb3d11207", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537785, "uuid": "f11a4405-5d82-48f6-a112-0a172dc1fe17", "comment": "Malware payload (Dridex)", "value": "b29f2dacfe36a26f06268e9a55e8f5de124ad1d9a0dc53dd87abf2eb6e9ce6805395415748f2ffb59247f082dce3f2d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537785, "uuid": "46d6497e-d0ca-450c-b346-c84fe762c341", "value": "1804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537785, "uuid": "dba27726-4e52-4523-b8ee-42e6c2b6d345", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537785, "uuid": "5384086b-973a-4cfa-90b9-ea713af67dac", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537785, "uuid": "cc8e1f3e-a105-4431-a71e-22d59e46f515", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537785, "uuid": "14c7372d-ffbd-434b-97c4-46792cfc480b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537785, "uuid": "5efbd14d-4015-4a94-8101-04bbee418dd2", "value": "eb705c4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba47306-b98a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621529187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529187, "uuid": "23d287a5-4dc8-4423-8831-9bcc3c335008", "comment": "Malware payload (SnakeKeylogger)", "value": "d324ce7f6244a22da4cbe112723acde7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529187, "uuid": "4b06029d-ebd0-42d5-a93f-35c38825f3dd", "comment": "Malware payload (SnakeKeylogger)", "value": "67abcbff50aab0202494fc3a32476486b5c654e0c16e02d00f1178546ac5db76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529187, "uuid": "6e5ccb14-1f9d-43ee-8843-bbd9bb22c448", "comment": "Malware payload (SnakeKeylogger)", "value": "a36261121d435f46ae9de513152825fe5cac8b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529187, "uuid": "2d88bacd-3e63-4c47-8ae4-45dfaf552721", "comment": "Malware payload (SnakeKeylogger)", "value": "f4d92e4ba23cd1eaa9ef180e3a599c09edcc4f53d46dff47606a99f5cbbf1c70509b0a845a52753e25c23f2f5ca3ad54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529187, "uuid": "aa1b524a-7205-4f43-b725-661657b48c1f", "value": "1D848E64AF931F5BC6D8D1FD40C6D166C9A9FC5DC2B2291A37B2CB86FE00544ED2C286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529187, "uuid": "70def9e9-0b16-4662-a9a3-47b388a357ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529187, "uuid": "08602db1-d747-4d6f-a27f-8cf615961743", "value": "3072:H/VfszjuQS93meLsCdF/mVsfhTgZxQNO934veajDre6FX5M:H5ejyLLsSdL1gZx190eajDrdFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529187, "uuid": "33bd8600-3b68-486b-950d-715e608f5a08", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529187, "uuid": "79918b51-7e20-4531-86d9-001a747a0cd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529187, "uuid": "458084c9-c687-4b50-b383-c53e788b3428", "value": "AF7TQP80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfefd2f-b9af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545002, "uuid": "3de52306-1ce3-41e5-acc1-a69bf46c8f94", "comment": "Malware payload", "value": "b9fabe5ccd2016b66aafc35c1cb79ee1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545002, "uuid": "5911e230-f9e9-42c9-a11d-6a51e2979ebb", "comment": "Malware payload", "value": "67afd4cfcf5a2aab202fdb938af76f432093552aa8e048a1f91502f0bedd347e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545002, "uuid": "27792e19-7b81-4bd2-bc40-3b8c3fe55dd4", "comment": "Malware payload", "value": "0ca1492ceab062ad8e72cd11ee4062895f8d85ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545002, "uuid": "a36d1f43-4675-4d4e-9549-730afdc848e6", "comment": "Malware payload", "value": "6ac851d48214fae99681283c24d9c4a537c895d8e8d8f6f0dd85563cad877a4206bfdbe38b583362237d8aef219593f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545002, "uuid": "a0ed1886-861e-46ac-ae7b-4249cb67b8a2", "value": "0F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545002, "uuid": "12b9f83a-949e-42d5-a185-6f45649930d0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545002, "uuid": "d91bb21b-70c4-4134-bc50-02a5564c5cab", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545002, "uuid": "1c0d9928-2c25-477f-86d3-1583f13dcadc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545002, "uuid": "68e24e26-7848-4a65-a055-9ed5090486dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545002, "uuid": "33efd877-78bc-46d1-8e4a-7b05087afbf4", "value": "b9fabe5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bafa31e-b998-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534958, "uuid": "e833372d-3523-4d31-bc0e-e31291f6b35c", "comment": "Malware payload (Dridex)", "value": "62990e1552f41cb18f455fa5b8d4ae87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534958, "uuid": "35a12048-e65c-4624-b192-bced3d5a7ce4", "comment": "Malware payload (Dridex)", "value": "67d112a8388157755ee6fa3ae24c345e82dccf4c61a2f2be9091c2472122b461", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534958, "uuid": "09713bbd-7d37-4fbe-8402-2f6fb9f18b5e", "comment": "Malware payload (Dridex)", "value": "40e5f520dd0649f973a603e9bf65525996cbd406", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534958, "uuid": "75d825e4-515e-4536-b8a7-31a5e6666e05", "comment": "Malware payload (Dridex)", "value": "78808821350527c4b84f4481e1464a01f206be8c9b338998ec9affbf4fa3729ec2c5749952d313f19042e404e49208f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534958, "uuid": "b95cc6d7-1831-46da-acaf-0a99e6453183", "value": "7404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534958, "uuid": "9f2d0ea1-6c50-4a46-904c-2cc05376770b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534958, "uuid": "dc588be2-45c9-4176-a5e1-34fa586b2fd2", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534958, "uuid": "fc08fda4-eb13-4215-b9d7-3817823db8d7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534958, "uuid": "62140af6-86ab-4760-bc15-ed1932481c91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534958, "uuid": "eaff7b12-56fc-4f36-aa1f-5643fda5cd4b", "value": "62990e15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0518328e-b907-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472536, "uuid": "f17896cf-3ad5-4d18-89d7-521442026b86", "comment": "Malware payload (Dridex)", "value": "07e487a54adc49befde4cceb889aecbe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472536, "uuid": "d26a544f-2b44-48a3-b030-0b1e1b649d0a", "comment": "Malware payload (Dridex)", "value": "67f07a433eeba631a917c4bc79063bc9cdcbb3431520f1a2c0a6a49acce490f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472536, "uuid": "a90f164b-878b-4249-a2d2-6973b78d6b2a", "comment": "Malware payload (Dridex)", "value": "24d45376314b3082b8d7673b7a168eb4923f31d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472536, "uuid": "85a35c00-8ca8-4e07-8da4-33b639d44083", "comment": "Malware payload (Dridex)", "value": "83de05866aae78dfe068ff5fc10ed0bdce80af0c8965cdf6470cbb03040b2853e2a09d50d6bc7c5e18eb6b363ad31100", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472536, "uuid": "55d110a9-39dc-4939-ade8-a759cef5c491", "value": "47F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472536, "uuid": "f13906cb-d680-434e-a509-8dc318b8ef6f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472536, "uuid": "690f09b7-6fa9-4c71-bca6-78a791ae7905", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472536, "uuid": "55281bb4-7568-4b0e-9fc2-11b6e9e06986", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472536, "uuid": "596296ec-f11b-4030-8004-2b3d3f51ba24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472536, "uuid": "1ce01bd7-8d58-45ed-bac0-d765aa7207af", "value": "07e487a5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c291eb8e-b9aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621542862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542862, "uuid": "d8bf2350-df5b-4b66-92ea-9df75db17fc5", "comment": "Malware payload", "value": "b03c7ab94a8e936fa175206110b78d23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542862, "uuid": "75b87343-437d-4e80-bbda-e9ee62f94624", "comment": "Malware payload", "value": "67ff23b6f2cdb1cdfb78068b0a27f2859ddce5be3d074b775e4cfe38a5f67e9f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542862, "uuid": "e7f96910-ad9f-42fe-ac4d-c711799e7577", "comment": "Malware payload", "value": "1bbf741b41215fab1dfc3732f3943076ae29c12f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621542862, "uuid": "623ffec8-6f73-4008-8b2c-948337a5526a", "comment": "Malware payload", "value": "1359e20a2e6959c29a9951c51cd132902b1052514175665968797dc5320661bc746b38f5febde8e7798d9dfae0d7f81e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542862, "uuid": "348fe2ca-dbc0-449f-af21-2a41b2a04f05", "value": "AC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542862, "uuid": "7bd392da-e8a6-4f7f-afd2-da24c3e92676", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542862, "uuid": "12306837-27aa-4570-a344-29b7f7ca9a7a", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621542862, "uuid": "0d2ec19e-1dee-4d71-a397-cb96a2d26e3b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621542862, "uuid": "a9682962-4f2a-4869-8df0-95962f391b9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621542862, "uuid": "dc94ca3c-4b82-49a3-9bfd-2dae61b35244", "value": "b03c7ab9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e55650c-b985-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621526856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526856, "uuid": "b7bc674e-9478-47dd-a12c-0aa3526fc442", "comment": "Malware payload (Dridex)", "value": "5ea8353d260e28e7c6d1a051fba0e798", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526856, "uuid": "4c6a6a2e-7d47-4bbf-bc4d-641bea0daf95", "comment": "Malware payload (Dridex)", "value": "68065e972a0b8372813a28d8ed3021891d07e2db2759e593dea43fd7851b36b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526856, "uuid": "9ba404ed-79c1-431c-860e-a7978d08be8a", "comment": "Malware payload (Dridex)", "value": "7e5fe1c8bd3b3f10ff7a8dc9e871a2d8ab825617", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526856, "uuid": "400e65c0-8f04-4e0a-a2b2-a0c4fa610385", "comment": "Malware payload (Dridex)", "value": "87095caf9f2d7de94b6df08c29c03c4616e7f3426d79d18ba500cf3c0cbd9fa4fd2886e86c6a6cea1b0182b38c401f82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526856, "uuid": "5f20bc48-f8a2-455d-9fc1-72662bc6a37e", "value": "0404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526856, "uuid": "cd01170b-f742-4daa-9013-268d84ae7c66", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526856, "uuid": "8357ed24-1562-435e-8115-856ed271c4d1", "value": "3072:hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:hH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526856, "uuid": "9a625d63-688f-4fa0-a433-a4754a89fa8d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526856, "uuid": "382b350d-9545-4825-a02e-87573956b6d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526856, "uuid": "2d505802-10d4-4c8d-b839-bad6dab80a9e", "value": "5ea8353d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ca983c-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539113, "uuid": "4c825318-4713-4f17-bd08-c33e68e5351a", "comment": "Malware payload", "value": "6a26c610f61916ea74263de7c9299618", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539113, "uuid": "ae89c1e4-e5ab-431d-baf2-e60108b187ec", "comment": "Malware payload", "value": "682451e613134fb69add07b8d005397391d446c2f834f12e1d854017dbe89cb5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539113, "uuid": "e107a941-3c8c-4784-b9b5-f07cb827ef58", "comment": "Malware payload", "value": "c7cc20fc91cf7e3da55690848b937c53f6b56e3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539113, "uuid": "7816afcf-df72-4e45-848e-0cbeafd60354", "comment": "Malware payload", "value": "92c1fa0902bb78cf4f72f05d3abeadd1afcb0bcd637b7760e82cf6b02405b16040654b2297f269f7bf161b57ca219863", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539113, "uuid": "1ee14d9c-ceeb-45e4-8a4d-cd551865e85d", "value": "1604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539113, "uuid": "d97e26a5-ca3d-4111-94ee-5dd0e6eeb3d6", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539113, "uuid": "85228d31-adfb-448c-b87f-d68116fa871d", "value": "3072:Xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:XH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539113, "uuid": "1de8a2ed-7811-422a-981d-6742a0e5d885", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539113, "uuid": "c74fead9-948a-426d-839e-9aefa61e8cde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539113, "uuid": "f4eaf367-bbdf-4f6d-af30-22801786e839", "value": "6a26c610_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a552dd-b9b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546060, "uuid": "fd2712d7-dac1-4521-a225-4648d6951b9e", "comment": "Malware payload", "value": "2b1569930be21678e53dab41baa0b2d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546060, "uuid": "3a1344c9-2abf-4734-a391-22a3dbaf8030", "comment": "Malware payload", "value": "6826148a815e81055b4e162ca7feab7181931cd0bf8cdc1286bf641fa1710f43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546060, "uuid": "409588f4-ef36-4de2-b4ca-fe6647e8009d", "comment": "Malware payload", "value": "d1dd2596a21e39b4908ba97086d8abe62e519ef4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546060, "uuid": "9a0de371-a210-4e56-a00a-90c1606af855", "comment": "Malware payload", "value": "85817b271a9a36d17cca7db2c607b22bd3a9cfa4006746b4a887d1734cc0f70f4746d3dbbcbc7ea18f898eed6730f3d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546060, "uuid": "b5635dd0-7ab6-4725-b6c9-dfdd42ac5c3f", "value": "0D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546060, "uuid": "0904389d-1a8d-4456-90de-e0622b88c62e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546060, "uuid": "bdf58081-f55c-4bcf-ac96-d2031bf3bcc5", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546060, "uuid": "05e813b2-bb91-470d-85e2-14ca9ca49b3c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546060, "uuid": "a85b3b80-479d-4567-a0b2-e3f1f9444724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546060, "uuid": "e0934cd8-8717-4999-8435-35e3b19b1479", "value": "2b156993_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cdb549-b9a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621538591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538591, "uuid": "ddcac311-bc87-4b38-873c-eb3ec08da47f", "comment": "Malware payload (Dridex)", "value": "3dda7abc72c51ea2123f8b92f4926e48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538591, "uuid": "ed745ea2-e2b0-49ad-8be9-64ecf8ddf361", "comment": "Malware payload (Dridex)", "value": "6827763767e9d667622a1dfbc99f81dd158a53b47610433ee66a642d140cba2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538591, "uuid": "fa1c9ca9-ac36-47ce-b727-9bcf9922b271", "comment": "Malware payload (Dridex)", "value": "f5e02dfe41b93fd385be5c91aeeebc746faddc54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538591, "uuid": "5b9c5a52-86fd-4944-b405-96e5636c01f9", "comment": "Malware payload (Dridex)", "value": "17cc5121aeca8415f01cdbe0dc7e722be77d71b84dd490ec0c2d2dc29cf838a2cc96b8b98105263282c82b0422e55bbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538591, "uuid": "3b33a217-7ba8-43f7-86f6-586a5c7fde95", "value": "3004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538591, "uuid": "b7e6f182-04a5-4860-9a8f-65ddf4799faa", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538591, "uuid": "cfd70963-1548-4e6d-a789-c3428e9a0708", "value": "3072:Oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:OH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538591, "uuid": "54e1f694-fd37-4a35-bd8b-6da93c956725", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538591, "uuid": "91673e34-958b-41b7-a757-a3a58aaaef9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538591, "uuid": "076a8904-be75-421c-a275-532cdeb9ff98", "value": "3dda7abc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1519a9af-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532693, "uuid": "456fb90e-cf3d-43ba-9eb8-6e1d6e8d5be2", "comment": "Malware payload (Dridex)", "value": "1f7ff1f025aec7a23f24474cd5666484", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532693, "uuid": "cc56131d-8f6c-46ce-9db3-62801e900447", "comment": "Malware payload (Dridex)", "value": "68fdca7ba8d6be6b90c54703e65e78116e816fe69fba9e1a283e34eddc9c68ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532693, "uuid": "a143d96c-f175-4353-8af9-bba1918e83f5", "comment": "Malware payload (Dridex)", "value": "7b2e92340610df4f4f4823ddf7da395477fc3b51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532693, "uuid": "d5d0dbb7-2f48-43a6-a1c7-3673107e04ce", "comment": "Malware payload (Dridex)", "value": "7197528a87d67060f998d35ca6343196e30b633d107149bef9fb78e21ba9505f35dee8de4ab9013ee0c00f1575bd1eaf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532693, "uuid": "9f4a7d04-31d0-49dc-91dc-deef0e4625b0", "value": "1104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532693, "uuid": "bdeefb44-631a-4395-a430-f2ba55c8da26", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532693, "uuid": "3f1fef52-a086-422b-9d34-82240cab1165", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532693, "uuid": "93565197-391a-4674-9362-95879b78a91f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532693, "uuid": "eea32ee7-f114-44ca-a9d4-8684688ae0f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532693, "uuid": "8908b848-c89f-479f-98ed-f199056fbe35", "value": "1f7ff1f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11021880-b9ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543423, "uuid": "ce9399cf-5bee-4cf2-b5b0-43286221ccb2", "comment": "Malware payload", "value": "07c0c8c2c75aca099aaadd2f8b6fd9fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543423, "uuid": "0ffa34bc-13f3-477c-9f45-00e22ea4a2ae", "comment": "Malware payload", "value": "6901672ca14eb8180f8a863d63bc89a4b5ab4983d22354c8bb376d3c37f2c4cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543423, "uuid": "fe7857a0-709d-4d4e-b61f-d114bd68b85a", "comment": "Malware payload", "value": "d0504911930bbd893bd63452d0e2f7eeb870abb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543423, "uuid": "99dae6e4-2eef-4087-b246-2c9e4cf6691a", "comment": "Malware payload", "value": "8a77537f482ea67c1fa70795f0352454b3f1f307bee35b11c12fd16cf48e9cc1810d2a40c7efa1f54c4186301596fa6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543423, "uuid": "64b5516d-99d6-466e-9837-0511403c53f1", "value": "CE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543423, "uuid": "a9909f8f-be0f-4cd7-a3f3-14e2f8d51f25", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543423, "uuid": "33e6cd12-a88a-4e01-9910-c7b8d4865a2f", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543423, "uuid": "80a87d07-4920-4051-9451-e97627649789", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543423, "uuid": "f3f5b938-12aa-4c66-a876-b8186a47bc38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543423, "uuid": "a61804eb-2a58-4e16-a920-50f8ffa81cd7", "value": "07c0c8c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f374e41f-b964-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621512879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512879, "uuid": "294b250d-c520-4a01-8690-b7cb33359dd0", "comment": "Malware payload (Dridex)", "value": "f5359a91cefd874597bab74ec9e7d617", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512879, "uuid": "ca2c76f3-7f94-4954-9fe8-7de594601fa8", "comment": "Malware payload (Dridex)", "value": "692a44bc9b9bcda93bfceed15535359a8a27b90dfec20eec84b5753e96ca324a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512879, "uuid": "8b1314e4-23a1-4384-85fa-32019492a345", "comment": "Malware payload (Dridex)", "value": "dc6b61580c14d41d0290da11eca16581ea1e8af1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512879, "uuid": "cc472075-ba86-4e6b-a564-d33cff3b1210", "comment": "Malware payload (Dridex)", "value": "088660250faa2fb09ee3d13681896dcfecdba813bcae2f84d804a3d9a857398dc36152db9da080072b67eab5929130a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512879, "uuid": "14f7ea5d-36b1-4bf5-b358-e733837695ef", "value": "4FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512879, "uuid": "f9919a08-b1f5-479a-a64c-174b11da3e4c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512879, "uuid": "15b7ee68-d1db-47c1-a953-ed2724814f68", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621512879, "uuid": "8a12b9ee-ac60-4dd9-a11b-60f3fb9a427f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621512879, "uuid": "dc8a45de-7c84-4243-9ed0-3eedb56f5c08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512879, "uuid": "fd86b9e3-e786-492f-8e38-0e3d67a9f083", "value": "f5359a91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5b401d-b9c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621553532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553532, "uuid": "db2d1b03-5ae9-40b2-a995-2ad2989b635a", "comment": "Malware payload", "value": "ada7bcc4be2abe797a5d542d2579a6b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553532, "uuid": "2942abdc-51f5-4680-8807-11c8fcc755ef", "comment": "Malware payload", "value": "69592276d09c142fbc51a096942d7381c92d19121b429a59ed70e0b254b1e624", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553532, "uuid": "7e3d1e2a-6255-4665-86cf-797943cadafd", "comment": "Malware payload", "value": "987044a23326af150e128ec4a0f0cfd7b11025ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621553532, "uuid": "d6726bb0-b6cb-4ee7-95a1-e9de9cf5c305", "comment": "Malware payload", "value": "e29d2337455a21a398221506ded24046f6c81f5ce7abfff10d85d687fdcb81cc263a8edd867039c5298095a956245986", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553532, "uuid": "f21b97cb-76cf-4fe4-9f21-f24cbae6cb62", "value": "EBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553532, "uuid": "f5f3907a-296b-43fa-ad74-1cd38b43b8f0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553532, "uuid": "17481eb7-03d8-467d-b414-d345196ebae6", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621553532, "uuid": "5388da07-154c-4196-9a23-7c195799c528", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621553532, "uuid": "a30d401f-e929-4233-95bb-03309aea6062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621553532, "uuid": "88f1e152-bf35-40a6-bf6d-a5c5e94e93fc", "value": "ada7bcc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd05fe4c-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533887, "uuid": "5a18112f-ab8f-42f7-8f02-2ad59798210c", "comment": "Malware payload (Dridex)", "value": "88284df0a33d407b0315d0be5f3eee78", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533887, "uuid": "d1a2640f-4bba-49c6-b5c7-57d50dcf42e0", "comment": "Malware payload (Dridex)", "value": "69605b1f49b00bbad401f5c4e5447f37086dc1473ebc787e402d76e7b7640d91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533887, "uuid": "e9e4651e-f61c-4817-8b5d-6659c37f66ae", "comment": "Malware payload (Dridex)", "value": "f4c53d4843b04881352b16cacf248f013f20b759", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533887, "uuid": "3b16116a-bc66-4a4f-bce9-d78b89d02196", "comment": "Malware payload (Dridex)", "value": "28b30a31de07bb103adc47c336f219152b2073c3f4f1cc2321a4be6bbd0297f3975386cc404a1115412407dddcb49d67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533887, "uuid": "14b089d0-d983-4e0a-b7d5-1dc043a87c27", "value": "9F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533887, "uuid": "12e56490-1530-4afc-8a46-1dd0eef99c19", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533887, "uuid": "5db613e6-603a-4015-8261-c69602324c12", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533887, "uuid": "d6f4132c-995a-4bd3-b087-fdefb9dd1373", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533887, "uuid": "df8c3bb7-b7de-485d-9a4c-19fcb58b76f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533887, "uuid": "6e45a40a-871c-4430-83e0-545061f7a010", "value": "88284df0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f711f1ef-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528347, "uuid": "4c2cf374-31b1-4590-97c3-c3deb4e69a65", "comment": "Malware payload (Dridex)", "value": "9702c8b884859fd14ed68cfbcc25c041", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528347, "uuid": "d9dd8f78-ee89-47e2-aa1d-b7ba1825d212", "comment": "Malware payload (Dridex)", "value": "69f858e1823b8a7d4f403f5bb975428ed06789b1ac585bf8ad492a286349f3a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528347, "uuid": "f43dbade-aaaa-4354-8579-bf57a722112e", "comment": "Malware payload (Dridex)", "value": "ed3c31977949f23f4deff5db47b15e55c2ecf58d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528347, "uuid": "c227fd6c-f680-46ed-a25b-100cb08b1f8f", "comment": "Malware payload (Dridex)", "value": "538ee63285a2dff8f9a544663e51957fcf6a9c127abbdd0773cd76618b6738a2bfbac3bf00e1f53b0484d1334f95fee7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528347, "uuid": "94e45eda-0405-4167-ae2a-d76f2789ef29", "value": "3E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528347, "uuid": "3f72abf3-5ba1-462a-9636-f8f9cc3fe786", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528347, "uuid": "8be52fdd-0a0e-49fa-9cc5-d7d4fa7b71e0", "value": "3072:1i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:1H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528347, "uuid": "c3c5a727-f7d6-485f-875b-df35b7c60435", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528347, "uuid": "0203f607-20cf-4a98-a5b0-0f023eb8078b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528347, "uuid": "c0897e08-c4c3-4b49-8861-de7cc31884b9", "value": "9702c8b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e938421c-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1621533048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533048, "uuid": "a0dd39f6-e3ee-4bb6-8188-f9e2899391e8", "comment": "Malware payload (AveMariaRAT)", "value": "ad0516ffefe7aa4de39f498af33dc4d6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533048, "uuid": "e01b769a-6c7a-4ad1-b5b3-cc79ecbe74a1", "comment": "Malware payload (AveMariaRAT)", "value": "6a0075d93fec0997f74906d3843bdaa763ec60b88bb4ea17f19c210c411598a9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533048, "uuid": "5c4ca0c6-9c2d-46d6-b2df-b42f2c48ce96", "comment": "Malware payload (AveMariaRAT)", "value": "0b3cfda64c6897b39947d6cd962dcfa412a22176", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533048, "uuid": "78dab146-9d91-4f35-9b24-7edcbb0afd6d", "comment": "Malware payload (AveMariaRAT)", "value": "e195dd457e7553f963063da7a3397b4d0f2ee35a97d82273131aedfed3ab8c36c1ef070d69b7c45b74b77b990fef7838", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533048, "uuid": "e35b2177-bc1d-4a3a-aeba-dd791f89392f", "value": "1CA412112318EB59F57E77BCB428D12003F0781CEB21EB5DAF5A117E06D3B8B47A9A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533048, "uuid": "eef3af09-eb99-481c-8f46-2ff18b789f14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533048, "uuid": "1edc1c1d-9aa5-47b8-a99e-dc76a7548537", "value": "12288:dsAgFyPfSuVya+NXMLWRmvoRgETQE/kwrOKz:unFytCciR5N1Hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533048, "uuid": "e9f10b59-048c-4bb8-b958-0e6226a5579d", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533048, "uuid": "1676c78b-bcce-4645-ae46-13d19ca772f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533048, "uuid": "1a393dd6-d8c6-41ef-b4da-1cc1ceafd803", "value": "PO_402114 doc.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f6a814-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529818, "uuid": "a2d345c6-465c-46b4-af3e-5f1c2b7da010", "comment": "Malware payload (Dridex)", "value": "3b54a40e89b3a5164cdff8a442c6691b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529818, "uuid": "79d23fe0-cf18-45c6-ae26-2d2c41866a36", "comment": "Malware payload (Dridex)", "value": "6a2e0c5e4d588d0cd33882355540dca5a81f8b1bfbecee2e9f40c67c0e570fb9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529818, "uuid": "40ad9f06-6114-4672-94b0-46fddffc5cf1", "comment": "Malware payload (Dridex)", "value": "0840cec7c305a31575d76552ad7bd890c8e4b437", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529818, "uuid": "321f8afb-85cf-489a-af1a-56d3b71dec2b", "comment": "Malware payload (Dridex)", "value": "2fd90a8943ddd5aa0c8f278b20532319c8a9e7f9534dc4380040a356bbd62dadacd07c0bd186301c13a09cd0d4e7606a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529818, "uuid": "d85e7c56-99de-4a42-a1f4-ae489dc65bdc", "value": "F004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529818, "uuid": "297f71cc-acdb-4495-957a-c82d225cdb17", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529818, "uuid": "ad729e46-4a9e-4147-ae40-f548d26c0889", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529818, "uuid": "f2788941-cd6c-4877-b1b7-6073d3995fd0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529818, "uuid": "555b0ba7-6322-4d48-b517-d1f893ab6f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529818, "uuid": "3563b444-8c75-4ed0-8748-4568699d9cc0", "value": "3b54a40e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73924a1b-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621533710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533710, "uuid": "80fdeed3-8306-43f7-98b5-4d1a1de52ae6", "comment": "Malware payload", "value": "a0bceb78fc2a30de70ac5ebb97d59316", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533710, "uuid": "699ae70a-f512-4a43-9c6c-ca5bf3fbac61", "comment": "Malware payload", "value": "6a4808a2ee2138026765063c02a5c1e3a91c4f99d9abf90468b3f2cf0649790c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533710, "uuid": "e406197c-db29-4110-b6fd-7ad953958b4d", "comment": "Malware payload", "value": "a523359bfc6467ad0565c717a3773d8e7cd1778e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533710, "uuid": "b31884d2-ca6b-4d05-b0a3-49f46eeae5f6", "comment": "Malware payload", "value": "3d799abf0a610fc849dbf1c7da7460be5ca4b5b3190666fb0e552c918b4f06633bb19f8bd9164b4916d008526834c925", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533710, "uuid": "11cc4364-b471-4aa8-a73c-adbc95a6ef78", "value": "4C87E03122E56B96E57EB7B5157110000BFAF8A1E732F70D7DAA64CE15B6E0087F2B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533710, "uuid": "116709a6-0de9-4ebb-a7f7-da88d9d29a23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533710, "uuid": "f29ff1a2-d402-4f4b-86a8-4e4814e59919", "value": "12288:+KCxjQKz6CpbVq1JmubvDNC78uZHckgx9Pk0JGf8C1:+nzVbVq1JzrU78uR2Pk0Jc8C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533710, "uuid": "538fcf31-2e73-4c06-86b4-e0c5f4c2499c", "value": 38797312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533710, "uuid": "68eef34f-3ff5-4ed8-9f95-e2b92e1a34ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533710, "uuid": "ff71594e-7091-471c-99f0-7df52bd4bac6", "value": "PO 229156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3635133-b95c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621509416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509416, "uuid": "0bfc06dd-225f-48f7-8760-930c561f602a", "comment": "Malware payload (Dridex)", "value": "7316da037f0fce9ae4ec7cc953c5ce2f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509416, "uuid": "e77c362a-e589-4582-ace1-8a56943e74fe", "comment": "Malware payload (Dridex)", "value": "6a542616b915f4e78426568d2b557b7408b171d71eabd5fb0d320de0f5ae9af7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509416, "uuid": "7384b06b-bbd5-44da-bdf2-51f3015f928c", "comment": "Malware payload (Dridex)", "value": "b4985f85f945f8c4f9cbc38e6a05774ec678e5bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621509416, "uuid": "24d84a31-ef18-471b-aaad-531e834c2891", "comment": "Malware payload (Dridex)", "value": "0cbcae138890f60976532f6959f89605a743342ec682dd632f384da6ff3192f16b92c20862166d13882c04b854df7ab9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509416, "uuid": "4c1a116f-d6c1-476a-9109-8a97aba2aa66", "value": "21F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509416, "uuid": "5a7fc6fa-caf3-4ae9-873a-0a8360766dc5", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509416, "uuid": "c4e95b03-148e-4228-94d6-dfcb4e611d8f", "value": "3072:5A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:53J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621509416, "uuid": "43e444f3-79bd-4246-8ed0-b84fde006b92", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621509416, "uuid": "6996392e-ae64-4b84-87c3-9a85591222e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621509416, "uuid": "1bb97600-b33b-4e1d-bcfe-a26ee5c8525d", "value": "7316da03_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5bdbdc-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621483828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483828, "uuid": "5fa006af-62c7-49cb-a879-115bea1975b3", "comment": "Malware payload (Dridex)", "value": "4fa75469f4be6eb105477052ba05d292", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483828, "uuid": "c67ef63e-a978-4207-981c-eb3711de4134", "comment": "Malware payload (Dridex)", "value": "6a6a587ebac7b70b5e651ad4772754f821a7854823e08a9c7162c7a755565600", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483828, "uuid": "f1f10012-d11e-4372-b494-18fa27a562fd", "comment": "Malware payload (Dridex)", "value": "a9d193256b042642b2d3b0012190bbcd69ed00f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483828, "uuid": "402e5d11-5eba-481f-923a-dbcd2cdaeb79", "comment": "Malware payload (Dridex)", "value": "51940513ba57acddba56a5eb82d2368689b425114e4b11bba685fa96eeebe1a4c15dab6147b93ae2f289336e568baa3d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483828, "uuid": "f03ee39f-5a5e-4f5b-83be-f45237065447", "value": "B2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483828, "uuid": "4e9448f1-e0f9-4d71-8c1b-ad83b849f899", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483828, "uuid": "68090a87-7451-4545-9b23-ba01b6fe79fb", "value": "3072:wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483828, "uuid": "c0dc5486-4d97-4abe-946e-4113b66cb6a1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483828, "uuid": "2e68190a-ee54-453d-97d5-582fea96683a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483828, "uuid": "afefebd6-6b8a-4d3c-8fea-5970b4c6479d", "value": "4fa75469_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087d3051-b955-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621506043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506043, "uuid": "0d059b54-4fd1-46ab-949d-776072153e28", "comment": "Malware payload (Dridex)", "value": "885a88dcb120a9e593606a20dba27e47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506043, "uuid": "842e40c3-046e-4a66-975f-0c1c2724be57", "comment": "Malware payload (Dridex)", "value": "6aa90d1a45d7538989059803ac01bfa08b7f28f1fb7321c58d296f50e9d85670", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506043, "uuid": "99f61769-c728-4e94-8b25-33c29567b59d", "comment": "Malware payload (Dridex)", "value": "6ac9a4c68f964a47967e5517bea66b38da39aa42", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621506043, "uuid": "e516ffa3-cc96-43eb-a9d4-b76438f2f6a7", "comment": "Malware payload (Dridex)", "value": "2b7312385fd68cf4c86f6df3b1fa9a319758a6933f3fd2b053968637d98769853e73091b25dad695afc561321a7dd1ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506043, "uuid": "fc13f430-6698-4426-8dd3-729ad164b954", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506043, "uuid": "2e4d98f3-6b24-4049-8bb3-d59aaee95a52", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506043, "uuid": "2ce2ba9f-ecfa-4820-aa4f-535bccd9e287", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621506043, "uuid": "86e0919b-5ae6-4df4-97f0-e97ed3ed2313", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621506043, "uuid": "91c769b9-005e-4bd6-91de-b2bedcf46070", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621506043, "uuid": "31d1c3b5-7a1b-40b0-9e53-9afd6f0793d9", "value": "885a88dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9adc50-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527791, "uuid": "b478c403-2058-4428-ae1c-07ce802379c7", "comment": "Malware payload (Dridex)", "value": "0d54df9565cc7b48b50b953d0dbabd28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527791, "uuid": "e516511f-aa1f-4542-888b-d0618f1dca04", "comment": "Malware payload (Dridex)", "value": "6aa9afe6bbb5aa2a387c6213e96902d38adc0cd88e6c0b3d597f9f2bf998c274", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527791, "uuid": "50b6019d-3482-4a05-9bdc-4fd262ea2559", "comment": "Malware payload (Dridex)", "value": "34399de8d0e8cd9ecb526c3db0942b55fe9898e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527791, "uuid": "dd6b6758-72d9-486f-abba-1bb1adb67f69", "comment": "Malware payload (Dridex)", "value": "5a43611adc1328e52c4eeb3b6fafcb8804341a7ef62d99488020a616b1df6e56dc87bdb55796a4de97527b3fda0fc9b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527791, "uuid": "731dda8a-7cb8-469a-8475-cc578b010852", "value": "6B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527791, "uuid": "b23028f1-6ea5-404b-925c-92f77963fa42", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527791, "uuid": "d7a05270-ca8e-4b33-9d97-dc995c268636", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527791, "uuid": "52180a4f-33d9-4aa3-816e-b221641c7242", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527791, "uuid": "c89f1eda-4e7b-4de1-92b9-308446378893", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527791, "uuid": "40164000-cc11-4fba-811b-1bdb9a3ad7df", "value": "0d54df95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe24e2cb-b9b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621546827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546827, "uuid": "ccc014e8-34f9-4f16-be4f-f2404deea862", "comment": "Malware payload", "value": "94195820d1fcbaae0274b287060f0f68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546827, "uuid": "2d198719-ebc2-449c-89e3-7fe392447358", "comment": "Malware payload", "value": "6aacd36ed2ed6cc37f250756480ecb8e4702e9bd73bee21df6f6b98159791820", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546827, "uuid": "15f6ab43-a062-4555-84e4-a53b24dc2b78", "comment": "Malware payload", "value": "86d55a0f7341453a9478f000b0c3c9947b0ca72c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621546827, "uuid": "b9a648e1-4ad9-4821-91f8-02703d21dad2", "comment": "Malware payload", "value": "966cf15fda5f30dcd7248a6fcf19a324ae183f701cea560d74b1b677b8a18758d877395c056c9e8a9b6500b78c816084", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546827, "uuid": "ee1f5f93-ac1a-49af-abe9-4601c7e3bb9d", "value": "D7F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546827, "uuid": "ad333ff6-5394-4fdc-b4ce-e09afa0ff6ba", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546827, "uuid": "3ed8cbd4-607b-495f-887a-1d25d67ea3e2", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621546827, "uuid": "b66f033f-7dbf-4979-a96d-e29a8dba5836", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621546827, "uuid": "1dd8b083-027e-4c9e-af57-a0ad17b8c21a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621546827, "uuid": "e7e127be-7d39-44d5-8c14-6f16dbb820e8", "value": "94195820_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d76d88c-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540464, "uuid": "e54fe29f-9951-4a6b-833f-af254c790071", "comment": "Malware payload", "value": "dc7ad8290d203139c6395c4ba122879b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540464, "uuid": "eae3c875-d831-4491-8a97-96375015d4fd", "comment": "Malware payload", "value": "6af53fc1eadc4bbd718977e6d247aa2fa5af1a3ebf068ed68cace23601ab9a90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540464, "uuid": "bc70a122-1a1e-4e0c-a802-087f52701dc2", "comment": "Malware payload", "value": "f77b36afe22806e06c71afd0325e60d2c65e5a64", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540464, "uuid": "ee9ff25d-260e-45f3-a8c8-160acdfbfbd0", "comment": "Malware payload", "value": "8c5be34700183dd393888edefd07d17e9d5ffd0dc493e2f62b68b95f5333664238f5162dfd4df481a473b101dbbfebff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540464, "uuid": "c2e3b953-4b1d-4e77-8ab1-b3d5df50f722", "value": "1004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540464, "uuid": "c3d9722c-858d-44e2-8e23-f9b213a12bd7", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540464, "uuid": "db89ccd5-cf7a-4a8f-afea-a824710f5309", "value": "3072:Hi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:HH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540464, "uuid": "b8592d0e-809b-4fb8-a70a-ff44c62ff380", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540464, "uuid": "9e10c869-d119-467b-bfdf-847d754cc96c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540464, "uuid": "9f6e7a91-bf28-4f77-801d-223a1940325c", "value": "dc7ad829_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccb3cae-b988-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528357, "uuid": "f8cc237e-0c72-48a7-a557-491aac284152", "comment": "Malware payload (Dridex)", "value": "3d821f302f7a77b345469348d8533140", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528357, "uuid": "2c883e15-0c24-4ab5-a261-c1433c981f1b", "comment": "Malware payload (Dridex)", "value": "6b50d7abebab83cb3c041b9031618602fae7d508c9e1da2f4564433da836327d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528357, "uuid": "379dee26-c289-4613-84e5-e93178e70c3b", "comment": "Malware payload (Dridex)", "value": "59325791d7cc3b84a97d92824435a6b5462cab57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528357, "uuid": "7305b77f-f610-4360-889c-8b3301e4e22c", "comment": "Malware payload (Dridex)", "value": "badae461eacc4a6551c02e08ce4e97202c9b30dc0ea3f30994de91d921dd0a628030490b6fb783272f7f86188838e538", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528357, "uuid": "291dfbf1-42b1-4d40-9feb-93f14e527c2f", "value": "F404BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528357, "uuid": "c949d0c5-e806-49e2-b427-a8efc14a495d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528357, "uuid": "f1a528d9-3ce4-4ad4-ae18-bc3ba680fa29", "value": "3072:Si49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:SH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528357, "uuid": "3c041bba-a6dd-46db-a4e1-172c2aad14dc", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528357, "uuid": "5baa226b-c551-4721-9612-415b32352a2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528357, "uuid": "9de837b0-fe8b-4dd0-af35-c3e9d6814de4", "value": "3d821f30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4685d36-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621538221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538221, "uuid": "619ccf5a-00fe-4946-a032-e5720ef8f438", "comment": "Malware payload (Dridex)", "value": "fbba9f8e67aef28ffc252e50302b0cb6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538221, "uuid": "48c83038-3da4-4eed-8e5b-6f3333061ee3", "comment": "Malware payload (Dridex)", "value": "6b51a2fc106e45fb193192ee2817140164c0967a18981a8930e5802e87ffdc65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538221, "uuid": "7529a711-de81-46f6-b3de-ab47421a58b0", "comment": "Malware payload (Dridex)", "value": "23ecd1abca30011252d990590bc920959ee6a246", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538221, "uuid": "40b06f0c-98e8-486d-a833-7bd7b8d1e37b", "comment": "Malware payload (Dridex)", "value": "7d586a78bf83b904b72bad2d0588d20b03772fe71412b9febe3b77224a3ae2a7fd5fac70e5f320f70cedf8daca3dd548", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538221, "uuid": "f3358aed-7f34-4b72-83ad-805ab30f1dcf", "value": "1E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538221, "uuid": "4767fe7d-113f-48ea-94e9-b304bdcf6bb5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538221, "uuid": "099ad8fc-1a8e-4806-9312-e4ecb9d34d22", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538221, "uuid": "d0c282eb-dd78-4d75-9966-db905b2367de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538221, "uuid": "9542b1f9-b196-4388-9bf8-5a558c7062b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538221, "uuid": "54b89ff4-2264-4f39-947d-b78bc59835bb", "value": "fbba9f8e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24ac875-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "7860d370-9e6e-452a-baa4-03f25b424d28", "comment": "Malware payload", "value": "552e0c86af32d750a34292aa931a0467", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "720989cd-7cb9-4442-a2f4-6ff91fffd741", "comment": "Malware payload", "value": "6b5b3725133457f887b7c364fe975c1fbb5b7597aaca8f89b324355ba5bd1368", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "65b87b23-d8e9-4b8f-8b0c-99d08580c3a9", "comment": "Malware payload", "value": "08e15c7a4e2cf0b764114c61e263b2d623b6d624", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539399, "uuid": "95fb2614-14cb-4973-91b4-4d401dea68ac", "comment": "Malware payload", "value": "b9b187b29119fe7e4dc9b1be55d94715a4631f6e2085d839ace42a6548de6beaed2e670aa137bd761e79f40797f38bba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "f8af4f5d-fb84-4c82-aabf-6abf62eedaf2", "value": "7804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "7808d1d7-212a-4470-b6bd-64b6c575cd27", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "fd465072-33f8-4147-89f6-f711dceef818", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539399, "uuid": "367dd576-04a8-4acb-95db-3798290365c7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539399, "uuid": "5aa1e008-bcc7-4844-946b-76d8fad3c63c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539399, "uuid": "c64806a3-96da-4273-a83c-3d5abe7499fe", "value": "552e0c86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fbc86a-b90f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621476059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476059, "uuid": "fc28984b-abb9-485a-8a03-ddb9209d4c70", "comment": "Malware payload (Dridex)", "value": "084469b1dcd874701c3279fb671b7dc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476059, "uuid": "d565dc9e-bfab-4fac-b17c-4fb2335a8ba8", "comment": "Malware payload (Dridex)", "value": "6b7bcc3dce184a67bb46e37e7d543e028d78aee305269313dd7dcd6509a90d06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476059, "uuid": "55e20edf-d81a-43b3-90b9-824870e5f4b5", "comment": "Malware payload (Dridex)", "value": "bd06d061d954c0306b5d6624a5fa3cbc21a813da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621476059, "uuid": "5460c718-36a1-4cc8-844a-9c478f6c47f5", "comment": "Malware payload (Dridex)", "value": "22c0c44c702d43f6189ca647caed4a90b8a87e972dd87a564849629f268d1286b08e2507b274b033c603fcf814abc068", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476059, "uuid": "bb5ebfeb-c8fa-4e40-a35c-17788eeaf16f", "value": "13F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476059, "uuid": "eea3137d-adef-4637-8f07-b02a133394b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476059, "uuid": "4fbc2a79-789c-48d5-b77c-7dcc6f0f8e0f", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621476059, "uuid": "6e5f44bd-d6da-4242-a08c-6910b604a74a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621476059, "uuid": "d1a29474-497c-4a60-bf9a-1766884b38e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621476059, "uuid": "cec3b909-78de-4adf-b8d3-01987dd38789", "value": "084469b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801b8af5-b997-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534590, "uuid": "093d8ac8-305d-4de1-b735-0c6fcb38d584", "comment": "Malware payload (Dridex)", "value": "efa6fcfb7ffb88734410769d875caa28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534590, "uuid": "3b206429-5774-4eb6-875a-74b7131913a9", "comment": "Malware payload (Dridex)", "value": "6b7e2be20f73d26a0bfa8db63df1e4fdfc3b9b57ecbd5d4fd8d4a1fdd5be96b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534590, "uuid": "e3cd8dad-f00c-4c88-8f03-0e215ac02b25", "comment": "Malware payload (Dridex)", "value": "40157282c15038a8788c03142c9f6cce19c22301", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534590, "uuid": "e6460078-b046-4282-b06b-2d3879e2bb50", "comment": "Malware payload (Dridex)", "value": "cc908ea094943445353532e0e48901ae2fdafceca019ca5bb9f122ee8169dfea26c8f19a034dca389ecea6cfe32bebfa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534590, "uuid": "d57e7150-4b63-407e-a461-2615f5710755", "value": "2004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534590, "uuid": "edf2df82-3c94-4ecc-8454-039b8184943f", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534590, "uuid": "8cee9a46-73f1-4557-8131-5e60e2193616", "value": "3072:si49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:sH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534590, "uuid": "8a3ff483-659e-44b3-8c14-508566c0a755", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534590, "uuid": "b9565109-58d1-4948-a3b3-68d3318f51ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534590, "uuid": "1018f666-079e-4069-b70b-bd05133e2ca9", "value": "efa6fcfb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f907d043-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533075, "uuid": "1db534a2-e6e6-43fc-b5fd-c2f866bd4703", "comment": "Malware payload (Dridex)", "value": "6ef4ad6707673258ae02d05c69e7a3ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533075, "uuid": "577a0549-e516-4e39-bdc3-bc2e663b08af", "comment": "Malware payload (Dridex)", "value": "6be19668c2a5dd5a17f4e9965edfd814c0fa1429e385b90f09891cbfd44d3f6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533075, "uuid": "ad8196db-8a96-4a2e-9219-9d47785bf063", "comment": "Malware payload (Dridex)", "value": "245d453f2ede88b314e248eca4ff8cabf1778190", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533075, "uuid": "7c3f0a1c-8895-4e53-9993-55db455896f0", "comment": "Malware payload (Dridex)", "value": "be55d1ad517ea2eb128eaf07b63ae12cdd3660c6783ffcaa4f34f842796d3a895052754d17ac08bdaf1943bed5615f62", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533075, "uuid": "291324f5-ade2-4e9b-92b7-d4e7e88197c6", "value": "5004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533075, "uuid": "819fe899-1359-4eb1-8b30-8c554f3ef58e", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533075, "uuid": "d8b9a053-85a8-4e23-8981-50cbb9279958", "value": "3072:ii49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:iH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533075, "uuid": "51edce6d-6d74-4d09-baa9-f102f18c3a60", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533075, "uuid": "796d5939-f5dc-44ec-a066-b1d8d32f428c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533075, "uuid": "6076b3d0-273f-4ed7-a55c-7f3e880ca7ab", "value": "6ef4ad67_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130596d5-b99e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537414, "uuid": "c28c8c39-17be-478a-b26d-baa337844ddc", "comment": "Malware payload (Dridex)", "value": "07685be6e6aa6a314049cfec84c12774", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537414, "uuid": "41a32af7-f7d2-4078-8071-ca396f83229d", "comment": "Malware payload (Dridex)", "value": "6be549e2935b23e0a7465cdc050f9865157064d8dcf6e77889f00a3994f29346", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537414, "uuid": "2d7ba953-4249-4e0c-8073-c9b271157718", "comment": "Malware payload (Dridex)", "value": "1f21a8b9fb09f6699fbb8148c7a5622e1c8fc410", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537414, "uuid": "a584429d-04c0-4927-bcdb-20e1f6b435c0", "comment": "Malware payload (Dridex)", "value": "be20f26f046bd64977955b10b0a39bc7b44c7a918149471bab2742624992a419395d565274b479cc1a2e238bcad6ea51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537414, "uuid": "d2069f94-966f-4b21-95e2-abc35688c50a", "value": "B1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537414, "uuid": "69c62b31-4964-449a-8f17-c4912411376c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537414, "uuid": "049c03ac-5c53-4890-9c32-4f57a871daab", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537414, "uuid": "b28d289f-9c80-4a10-b392-be6bc7677790", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537414, "uuid": "29e31463-50fd-4e94-9993-dcc8166a3909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537414, "uuid": "b7770481-5dfc-4555-89e4-658372e9f80d", "value": "07685be6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7701f416-b9c0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621552184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552184, "uuid": "f25b1062-6cb4-4882-9cc6-461799b2428a", "comment": "Malware payload", "value": "0a37a14e5b7b9bd376cdb1fbe451852e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552184, "uuid": "150ac622-d6ab-4400-a3ef-ab45be99c2f0", "comment": "Malware payload", "value": "6bef48c158c1ffd0536b221ebdf343f6128b67c781b05f2e589f78037c930c3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552184, "uuid": "ce574b5e-1e40-4475-a2d8-d0877bd86b72", "comment": "Malware payload", "value": "c9fbe51fd9437d7248f19b5c24adc63811e54aa1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621552184, "uuid": "8cf33f21-7a7a-4269-b999-0ce74c193de2", "comment": "Malware payload", "value": "809cd425a95f6f8cf2e9ea9d4405d530a5aae55a1db60d3871f38299e2d6813fa5c3bbe9758cfeabb90b942f98e68975", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552184, "uuid": "38a01893-880b-486a-ae84-9a4ee7896124", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552184, "uuid": "d4af7d1a-3f74-4933-8fdf-870525fb24fc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552184, "uuid": "bada1648-e993-4349-8f48-81d306fb2184", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621552184, "uuid": "19edacea-b4a3-4d18-ba19-fb746fe0ba5d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621552184, "uuid": "c549261e-d429-46d1-9c9a-a1e25ad25bb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621552184, "uuid": "25970d61-1ad6-4207-897d-f1cd19a63259", "value": "0a37a14e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc05e79e-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621487016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487016, "uuid": "1c9aacd8-9f8c-4e61-ad6b-a0650fa2adc8", "comment": "Malware payload (Dridex)", "value": "e0c2c3d4b24df3171f675c530db7c00f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487016, "uuid": "ea8c1d97-9d1a-49dd-8e4b-c45184f6b8a4", "comment": "Malware payload (Dridex)", "value": "6c038ab857889dc80ea1c07fc535b560defd5a307b139946f76188daed272632", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487016, "uuid": "774bbd10-fd89-4227-bf2c-eda60dab5c72", "comment": "Malware payload (Dridex)", "value": "ee81a9cb40b5303213b33fa6df4ef406c8522a74", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621487016, "uuid": "6e9df7c2-1179-43d4-9547-94cc575dae53", "comment": "Malware payload (Dridex)", "value": "fb101cc7b759078e32118b1920d9ab079c2bcf4fa382f4aae547c432a2c532addf08762fce1b048fd4c6553dd1d965f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487016, "uuid": "527e78e7-0353-413f-86af-8b31f37df931", "value": "FF04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487016, "uuid": "3b69248c-51c4-45bf-9fcd-f7de36806adf", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487016, "uuid": "2fce769e-205e-434b-9d98-3e6ffbe46656", "value": "3072:QWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:QWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621487016, "uuid": "85d93fc8-6e74-4eaa-93a7-eca0a7f2b0ef", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621487016, "uuid": "fc648b62-76fd-451f-8d21-4b6df6d021ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621487016, "uuid": "a4ba6c67-8e85-4594-9914-7cbb27773c5e", "value": "e0c2c3d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ba4030-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "a601a3fb-0ace-4614-8a8e-6913667133ae", "comment": "Malware payload (Dridex)", "value": "40d47cd4cac9398c385b1e7bacfe434d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "b463671f-f785-43a8-b36d-021f80a4ec0e", "comment": "Malware payload (Dridex)", "value": "6c16b7b066c0368b4896d07e8f16ddb692268b6d64a67aa5b3b748930b978fd8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "1c4917ca-8455-4294-b975-f3872498199a", "comment": "Malware payload (Dridex)", "value": "c5cd5bbadae952c7b81137e888e5a7191f16cfde", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533494, "uuid": "957eb3f0-eb8f-4c15-85a8-c6ff3d5f1453", "comment": "Malware payload (Dridex)", "value": "2f5270a332fcacdabe977c8870ef2d275825266bd55a82530524f7a8fe913a319f621542dcd7f2513fb44d69479cfd99", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "cea972de-a666-46ce-a693-b66c7a0ed12d", "value": "C804B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "047faacd-75b0-4081-82da-fa457661bda0", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "067925d2-7dcd-40e2-bfb9-2d81a9115f0e", "value": "3072:kWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:kWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533494, "uuid": "971c8646-f74e-439b-8b3a-67c61e535b58", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533494, "uuid": "80e27fc3-9288-41bc-ac87-f44fdf6c89fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533494, "uuid": "2cdd4eac-055c-44d8-902a-196aeb516181", "value": "40d47cd4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654018f4-b980-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524667, "uuid": "83b11840-7d94-49af-9d53-4765f57f8656", "comment": "Malware payload (Dridex)", "value": "5a5e84d22b1bcfeaba1f60fb7b940227", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524667, "uuid": "afb11e70-a6b8-4333-8d5c-2338e95f5634", "comment": "Malware payload (Dridex)", "value": "6c6b334c2e515bdad985e176e687b7569fa4f1d3ab1e064d32b935dbd9bb5b23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524667, "uuid": "f68a434f-747d-4bcd-b51a-dcb05b98b38c", "comment": "Malware payload (Dridex)", "value": "d02241cc0774dacaf22c56ed3bba7d7d81bb8de9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524667, "uuid": "9435ef2d-abb8-443c-bd9b-13e755ad8359", "comment": "Malware payload (Dridex)", "value": "45e002e342df721fa3255a3a6c12a598670a55c3d05a16d898beae5423d3199095a886753f45d1973fc32210040ee9e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524667, "uuid": "f74f1848-d641-451a-9c14-84ed094f4a60", "value": "6B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524667, "uuid": "d8659729-5d26-45a7-8243-2a3e709653be", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524667, "uuid": "9d2a31cb-9eed-4bfd-aaab-6e7adb46d6b7", "value": "3072:dV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:dV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524667, "uuid": "a0200683-dfd8-41d6-aec3-4180c3be8563", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524667, "uuid": "a422202e-2bd3-4b33-88ce-c95cf029f202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524667, "uuid": "8692589e-d667-4fc1-9bbf-3feb6562ffb8", "value": "5a5e84d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f56478-b964-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621512645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512645, "uuid": "9f38ac47-ba9b-4159-b52e-69674882037d", "comment": "Malware payload (RemcosRAT)", "value": "daed4663a9ec90f38e12b3f6725f45be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512645, "uuid": "5a9fecdc-669a-4cc7-a14c-f76990a7ce44", "comment": "Malware payload (RemcosRAT)", "value": "6ce798e776cf4fdcf419958817fc139391ae804e1f47b12998312fd8cea6621f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512645, "uuid": "b2227d03-71d5-450d-b615-fc8829be493b", "comment": "Malware payload (RemcosRAT)", "value": "3f8eeb7861f1ef29afdceb66df946c88eac59bb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621512645, "uuid": "59d85c74-cc1e-4e89-a16d-c503ddb45da3", "comment": "Malware payload (RemcosRAT)", "value": "741cfcf8931c9bf0d59732c77c2aa952cf77d600d5b50124a69469c1e586949dd3adf31081fbae11a8401845e2ddfe64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512645, "uuid": "d7f95f6f-c6d6-4f93-be94-51dc3efe5f9c", "value": "561402A536F448A7D01A567299B393B9A7B1AE0C1611028FB7FA3F5324720F3CA1375D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512645, "uuid": "3e4f7889-bc8c-4b7a-b382-a08adf612263", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512645, "uuid": "10478517-e591-4dae-aab0-a61f6f594e0f", "value": "3072:MQIURTXJV0kuMzk5qf/8cjjw3Q61AwhF9rUMZ6BSWNOi9G59jTe0cE5Cs08M5twt:MsxjzkO0cUQ6eTNOi65ojwh04D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621512645, "uuid": "cf8eaebf-a249-4be6-a5f3-189a68ca2c1d", "value": 198746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621512645, "uuid": "b85793cc-28b1-4ccc-81e2-db2d3a653d2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621512645, "uuid": "eedda291-06a4-4bc9-8ded-089c4d2fe4b7", "value": "PO ????-34002174,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c8328d-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621524149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524149, "uuid": "cf151649-c090-459c-82a4-165e32513b5b", "comment": "Malware payload (Dridex)", "value": "64937a9d579b72debc1b2c58c87407f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524149, "uuid": "952fd273-4728-4577-a750-72db848da970", "comment": "Malware payload (Dridex)", "value": "6cfb1c9aeb75600e77812881b67f53264fea7978290b06f93758792bf8170ded", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524149, "uuid": "95a26679-2cf5-41ef-ab6b-404bdca95702", "comment": "Malware payload (Dridex)", "value": "3104aedd073cafa0bbb233530f3788135ea36586", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524149, "uuid": "2636595b-94cd-4b80-a71f-cdebfcfe0859", "comment": "Malware payload (Dridex)", "value": "e70b19fa0c9a1217c5aadf107ab4bbc555d52461a15ea37d8d0a11f8078676e207a5f589cc1a1cf407dad30debe89188", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524149, "uuid": "9c4cbbbb-6f71-438e-ba49-59a24ed8caa7", "value": "2D04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524149, "uuid": "080ae658-6f31-4a88-a3ba-12aa3a14ac3d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524149, "uuid": "8fb23abd-e762-41d1-8d01-9bc21922ae8e", "value": "3072:di49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:dH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524149, "uuid": "cb092d58-a565-4668-9544-0f1f0d6af8df", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524149, "uuid": "048d1476-7df2-4e34-9499-b9c9e1bf5e83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524149, "uuid": "d852ff44-29d7-4c0e-9fac-a4f54058c018", "value": "64937a9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e881862e-b96c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621516297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516297, "uuid": "dc6ac910-2ce6-43dd-ae41-231f5f1fc715", "comment": "Malware payload (Dridex)", "value": "60b444dabcfc96e032d01f806367bee1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516297, "uuid": "964c03c5-66c4-47b0-8ea5-40ea012c6b06", "comment": "Malware payload (Dridex)", "value": "6cff6ca9e55aef4b9e49414576cb5df07c6db98b7604aa5147d75d0dcecb64ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516297, "uuid": "4a1666b9-daa8-452e-b5e5-6808c69fb683", "comment": "Malware payload (Dridex)", "value": "8bff8abc6e3c76cbe1579c4114ad271fa56c91b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621516297, "uuid": "a8ed0cd9-2f34-4576-acf7-b68844e065c2", "comment": "Malware payload (Dridex)", "value": "b3537a4fea3f19909d7d90354eedd1677ceafcffc0c0576d635290f96bf8058e849cd334ea465c67206e65c8d70c79f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516297, "uuid": "30c2afa5-7b55-4625-ade6-5a756fbc4b18", "value": "9804D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516297, "uuid": "aa8912b7-2407-422e-ac44-12350cb8fbac", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516297, "uuid": "f4b847a4-3844-4c36-9139-db5440e6105a", "value": "3072:sqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:aVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621516297, "uuid": "01bb60f8-2874-4894-833d-3d5ead7f6ad2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621516297, "uuid": "92295d38-a62d-406a-ac41-837b5210b8a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621516297, "uuid": "1b124af4-330f-4515-b23b-7dfd2ff1b2a1", "value": "60b444da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f747cc58-b99d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621537367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537367, "uuid": "e7162718-a83c-44dd-82ab-881814e15bfc", "comment": "Malware payload (Dridex)", "value": "e5a3805a4638ccd35242588e8cc81b9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537367, "uuid": "051fc3b5-7644-4e7f-8180-34b0181cc51d", "comment": "Malware payload (Dridex)", "value": "6d06c9c23ee3c71852b25637facd329f4ebd3e4afde9d586f6d514bbd76db57c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537367, "uuid": "9e922427-1b8f-400c-a4fd-3fb3d3d2c71b", "comment": "Malware payload (Dridex)", "value": "9f05517078dabbc7308b6d70bffbcfc3b5f2f5b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621537367, "uuid": "9b1179b2-ca92-4b03-a4c1-5c8f4e09cde4", "comment": "Malware payload (Dridex)", "value": "1cee974d7f637a5d280c810a95799e2e1cfcc9306907794975b9ceb52d79ef878b08fccc4d62012816bdb5501fa2c240", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537367, "uuid": "e71d789e-2d70-427d-bbaf-ac0f4b064538", "value": "31F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537367, "uuid": "60c8748f-7bfa-4cee-9fa7-b486ef15f55b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537367, "uuid": "b7c36c62-c072-4122-a797-2d340be32551", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621537367, "uuid": "748d5401-7f8e-4410-ae25-398f74e9b072", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621537367, "uuid": "70923bd6-be8e-4b5d-8592-dcb61750a0a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621537367, "uuid": "02747985-68ea-4a07-a190-4cc571c2277b", "value": "e5a3805a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8369d76-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479709, "uuid": "fbab2162-0e10-4da9-8de3-a286a0783228", "comment": "Malware payload (Dridex)", "value": "983b27ddd225b51184f73a520b698089", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479709, "uuid": "3f361f8a-8ace-440d-aba5-8367d0450959", "comment": "Malware payload (Dridex)", "value": "6d13c07cfd7e6c606f566c4c8568137a30f91b5f10111b273c5e20bf5013d644", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479709, "uuid": "ee489748-4f90-4c03-b8d7-79d171582f78", "comment": "Malware payload (Dridex)", "value": "981682b6c2cf86bfa362a5b34fbf8ce41c8b147f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479709, "uuid": "8935e9f9-2893-4683-9b4d-88c02e4684f6", "comment": "Malware payload (Dridex)", "value": "def6e9725dab7fd72b23a204efd90e77e05100afe598898d7e2da8737d68dff548a2ba1bea744717a5ac09c74535053c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479709, "uuid": "3962aef2-c85f-4a98-9e01-e6c6401879a3", "value": "5BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479709, "uuid": "8f676124-8d0d-4a7f-bfd5-481135ad9177", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479709, "uuid": "2ffd3388-237d-4dc6-a2a1-53df8cd68e62", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479709, "uuid": "4f35d34c-4d8c-46f3-858e-528891583877", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479709, "uuid": "ebc2a961-340e-4eac-a623-8a59a39b32de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479709, "uuid": "b851192e-fbf0-4fff-8605-1b2fbfda2f8e", "value": "983b27dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34f872c-b998-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621535159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535159, "uuid": "be5db52d-1237-46df-925c-031396dd3d18", "comment": "Malware payload", "value": "0fe5d772f297041109b60a4bd9fa52a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535159, "uuid": "f28f4709-fecd-4049-b712-ce31b527419c", "comment": "Malware payload", "value": "6d21d07a100fa7201aa27100f11e732cd6ccdd6d23db931023f5bd656047c565", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535159, "uuid": "a35117ac-a547-4d77-a1f7-65b2dc3b2299", "comment": "Malware payload", "value": "6692566557f900f2be89aa4793285a3923da9a23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535159, "uuid": "32734f5f-623e-4a90-95ee-3d36fb30d2c1", "comment": "Malware payload", "value": "dc1ec3aef9adc6d37c961f6852487e6ad5b80a9b663c4c1b5d2bec1595c28db102215aff6ef9fbfe42626a6023b01b7f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535159, "uuid": "3e2f67c1-d3f3-42fc-ac05-0d0105084555", "value": "278423102126C18F9F1022F326B0FAED95324E8E9CBE6D22965928DC5FD51ADCFBC51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535159, "uuid": "16669135-c890-4341-993d-d1b850940fc0", "value": "6144:0DKhqVYIzL7upeyNJaQB7/9QWfr3NPcIp1d0ZPNtDIXP/eQXMnvBNi9FOTNw3ruM:0DpCIzvONJ1ByKZfd01nuPW0ivBN2Kwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535159, "uuid": "e73137fa-7a18-4492-ad56-447be465e097", "value": 390644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535159, "uuid": "a86a2696-0085-404c-9d05-6c972a3b9cca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535159, "uuid": "5d0bc4b8-78aa-4410-9c47-f09e9db6a206", "value": "0fe5d772_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d9da75-b9b5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621547678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547678, "uuid": "dd8d6863-051f-48a8-bd3e-7b5f4954163f", "comment": "Malware payload", "value": "b6551540c1c7be2318dd453abc36b01d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547678, "uuid": "31d6c8e1-a8fc-4481-a56f-80135adb343e", "comment": "Malware payload", "value": "6d429eb1830fbdd4cfbbfb5bd11fe47347282c97c1684a75aa80ff09f097d5de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547678, "uuid": "8e89296e-e780-49a4-8edd-16eca37099a2", "comment": "Malware payload", "value": "c3a93c7b0f0e98021d902982f0c08001e40262bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621547678, "uuid": "1c086906-1c1b-4fdb-9314-d8ec2ca44b6c", "comment": "Malware payload", "value": "1e55f12a21240b5ae22717629bbcd0845899c4067a1088aa9b47d21866eb908fa491226c3a68e8c82d5c8261f6ba8e76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547678, "uuid": "16dec93e-6858-4705-bf62-347a5fa2cab7", "value": "0725AF22B2414436C17A1E385C1B66B69E35BF31AD28946737F93D0CBF356A13E292C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547678, "uuid": "ce961a09-6330-45ba-ba38-1ce4914e18e9", "value": "12288:WS80SbYOAD65QF6ofEwawyWCqGjUwudw1239PadHiomSD1zmEyCiomjNs:W3VbRAQQF78waJqqtGoOAHaCCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621547678, "uuid": "cefc0790-3cc9-4c2e-a882-e98e77c850ee", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621547678, "uuid": "03490683-b782-40d1-9c53-51da47731756", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621547678, "uuid": "38676a2a-c67e-46eb-a5e8-cbe1eb4b4a0c", "value": "b6551540_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c251c9e5-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532983, "uuid": "d019ab8d-cf8d-4f54-81ba-01e20c66b7cf", "comment": "Malware payload (Dridex)", "value": "ad5491f5abdf924ffd4ce5c87faf2221", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532983, "uuid": "d6ff08c7-d34e-4dc4-81d2-7872a358f2ec", "comment": "Malware payload (Dridex)", "value": "6d9174a2195c8892299d359e199da28e208706e29a066e08382907bbac8bd10d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532983, "uuid": "c016e9df-e05d-4c82-8e73-304071c03708", "comment": "Malware payload (Dridex)", "value": "473216b9ce42fdfdee25a8145774286d72d50070", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532983, "uuid": "d419b406-a51e-48cd-b719-b1be0c1069ab", "comment": "Malware payload (Dridex)", "value": "61069b37cec838fd816206765006c4e83e43153f9cbedc345d09092b5a70b1c93af15c741601710807a24f4cb787b3b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532983, "uuid": "7faad44c-5699-4c3d-905d-2edae0891e5a", "value": "BF04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532983, "uuid": "65dd8939-5f14-436a-b470-9991f8862508", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532983, "uuid": "c5666ecc-cec2-4f4b-ba34-93e896860806", "value": "3072:Vi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:VH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532983, "uuid": "51fdc8aa-d55e-4385-a751-06d0c5158d92", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532983, "uuid": "e1826e86-fb15-4ee5-9db3-d38cae03d568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532983, "uuid": "78c4ba53-d6d4-4b9f-9643-c998170bffac", "value": "ad5491f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb457b6-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532949, "uuid": "14b30a54-c25c-4b62-99cc-bbb764eb0bfb", "comment": "Malware payload (Dridex)", "value": "6b5e02cc4a7b6bd7fb5d1b1cc6640693", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532949, "uuid": "fec22d88-0b6e-470e-96be-b2d842ff09d3", "comment": "Malware payload (Dridex)", "value": "6d9cc67a1758b251b29cc096d04c14d9dd886fa3468785ebee1eb931b75f113b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532949, "uuid": "be794dac-7300-4d1f-b462-96ffe04fba57", "comment": "Malware payload (Dridex)", "value": "ffdad8106650660801b1e3a9377da3125a15fda9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532949, "uuid": "65fa8b9d-b670-4523-bd2d-bbd9878e1c95", "comment": "Malware payload (Dridex)", "value": "976adb7f91539533128cc7a5bd390aef4422fd4649d52c690155ab5e2ecbf6ba92cb874067c72c3435ea98f09fcd4d92", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532949, "uuid": "d9b1b83b-0d5b-43df-a092-f7ecae8ff611", "value": "E004BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532949, "uuid": "dfffffe9-3858-4c0f-b43c-0333cf55e620", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532949, "uuid": "0e843878-0a38-4f50-9980-9d5123da8f67", "value": "3072:Li49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:LH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532949, "uuid": "8a839b4e-7c35-4851-9570-88ebcdcdf099", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532949, "uuid": "7cf82630-14eb-4542-b31f-8757a8fd4d3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532949, "uuid": "aa1f1411-18cc-45c4-a431-ddfcfb038e7f", "value": "6b5e02cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1fb932-b9b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545165, "uuid": "7d012c21-bc85-4d8e-bf40-56aa3f6e69a2", "comment": "Malware payload", "value": "691775925fb9b5d58f499b52a2ba426b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545165, "uuid": "e192db63-a36a-4dd6-a3b1-6d79d1dab5fc", "comment": "Malware payload", "value": "6d9cce031f04292d584d8bbc6c86308bad5a9ec6f3f8af7c0bc8335692bb4e78", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545165, "uuid": "e0994637-1b33-4815-9cc0-774f4e93e31d", "comment": "Malware payload", "value": "5abf45120901b4081a58c79bbf2fa4a2946c106a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545165, "uuid": "cfb35268-8fe3-4f05-8e02-40f576052672", "comment": "Malware payload", "value": "7d58ff8ed896973488e293738279dadeb006232535891ac6128489a1626b3ade3a85bfcbe8b49927802775fe1a5522c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545165, "uuid": "a6b7a84a-71a9-41c2-aec2-3e8a4389539c", "value": "3C04B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545165, "uuid": "3f0103f0-a16e-47e6-aaa3-6d5d9b2dde44", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545165, "uuid": "aecb1073-8019-45be-821f-026647d25226", "value": "3072:iWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:iWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545165, "uuid": "8e0bd320-3692-4318-9bdb-10d66ba43558", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545165, "uuid": "0ce310f8-e281-43f5-bd34-332e8f43d653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545165, "uuid": "7aef65a8-e2c2-485c-9870-82f10c3c1c8d", "value": "69177592_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8039fd-b976-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621520228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520228, "uuid": "688e28b0-1d81-48be-ae75-7dd391a8a7ef", "comment": "Malware payload (Dridex)", "value": "fc0ef2d285b0ac492838aadd5a32d6a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520228, "uuid": "b8322fda-5951-450e-988e-4fdcccbafe5f", "comment": "Malware payload (Dridex)", "value": "6dd7f7437564ed48a43b66a9d08a61a9affda93260a8b35c08a264bdb5adc284", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520228, "uuid": "4b21e23a-8dbb-4832-bb64-0fd7c8553dfa", "comment": "Malware payload (Dridex)", "value": "f015dc0c321ee699877f25cca0d9d67027c3ecb6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520228, "uuid": "c10da08d-09b0-4ec0-93b0-8ab84433622d", "comment": "Malware payload (Dridex)", "value": "90a35b770b3dff1aa768bcf76288a952ca1a132a5908a1a57f94b8f293c5d355bbb433be592b517975427bfe6418018e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520228, "uuid": "164454a2-15f1-4d96-b3bb-38be2fd7265e", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520228, "uuid": "c42e37b9-5b65-4b07-9533-3b93997fb5fc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520228, "uuid": "be8166bb-1f05-4af3-9a47-e00e65f21e4c", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520228, "uuid": "e6669455-d8d5-4366-b6e6-7f2a9789a630", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520228, "uuid": "e481a55a-ea39-4925-a764-3d0f55908a7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520228, "uuid": "c98518ac-0f48-43e0-b285-587b59d81ae6", "value": "fc0ef2d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9b8c14-b994-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533269, "uuid": "c73a0606-d1b9-4e53-bec5-eef81122840b", "comment": "Malware payload (Dridex)", "value": "75381dd5155c3b5b1a0de602d5018890", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533269, "uuid": "d1a27735-8d5a-4456-84e9-1bb019d491b5", "comment": "Malware payload (Dridex)", "value": "6df974c9caadff69101a4f0b68965444b8dc838fe49183ec3132319aea861f0f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533269, "uuid": "cc2addde-06a8-492d-ab81-532d51a29035", "comment": "Malware payload (Dridex)", "value": "57fa0fb0c1a217ed00a5eb761ca7cf164c51a101", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533269, "uuid": "3fdecdca-e511-4038-bfb4-942382068b62", "comment": "Malware payload (Dridex)", "value": "7b0b2fea423ff3600a3ea740656ea975bfe1ea03011fb28a2601ce70c0c746e80cdfac368c5fd6f9eb0f265e59cc35a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533269, "uuid": "9cc6a471-a34c-417a-af24-763f67a7dcce", "value": "27F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533269, "uuid": "c3d04db5-dd01-4db9-ab33-d561ac460db2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533269, "uuid": "c1e60053-995b-48a3-af3f-02fa0224a8ae", "value": "3072:Qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533269, "uuid": "779d0f0c-1774-44a6-b09e-153631989447", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533269, "uuid": "a7c74e50-d24d-496c-97ea-d9dc4cd0493b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533269, "uuid": "d179853d-1f6d-4d1f-9bab-525bfd403463", "value": "75381dd5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a811899c-b9bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550119, "uuid": "b863fc6a-c2e8-45e6-a56b-7bc8037e02e1", "comment": "Malware payload", "value": "1b7f5279e2360caa1bdfc86dba1261c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550119, "uuid": "9e2dfb3a-1a25-4c4c-91d2-77aa07f3edcc", "comment": "Malware payload", "value": "6e0f6703ee4e75720650a7dcd3482e36e99befe6da1d092a91aa36edef12b8a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550119, "uuid": "bb3d4f06-668a-4da8-b3aa-38e75eeae117", "comment": "Malware payload", "value": "d8f984ec07a244e10c428f1ec350a9ce175a2e6c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550119, "uuid": "0762d51b-b654-4d25-a0ea-c08e1773d1f1", "comment": "Malware payload", "value": "71330146cc1558d50a6019c0dbd6fee2ab8d2742f1dc6034b3780c21586e5db7793ede2d3e1944bf345400d05f1d43e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550119, "uuid": "916ef7b1-ce02-4372-8b81-b95c55462b84", "value": "5C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550119, "uuid": "eea4753c-ff16-4688-82aa-0674684bd37c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550119, "uuid": "457e6a04-9db4-43c9-baee-ebf3f69c8c37", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550119, "uuid": "d9bc1233-230c-439d-a515-b817d6ff3536", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550119, "uuid": "a6ba5826-cf71-4eb7-9827-fcc6febe3c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550119, "uuid": "a7de6b15-5a08-4aa1-bd6b-282cde1b1a77", "value": "1b7f5279_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c719f6-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541797, "uuid": "1ca0986b-3251-4659-ae98-c09f4a7d1770", "comment": "Malware payload", "value": "e62a1f4801466b6be820d71e74f94480", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541797, "uuid": "7461109c-b711-42c6-b6f3-d647291e87f8", "comment": "Malware payload", "value": "6e34116a2c7cf8a4c0846dec1681489ab6d6e83deb0d062a79ed36029b8d9a16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541797, "uuid": "694a84ba-7cf2-4330-84f5-c12345b8f6f7", "comment": "Malware payload", "value": "ac83ec990afe7a9e99ee797065dc026f32647ea9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541797, "uuid": "084d0684-896c-47ad-9e19-4fedf931d57e", "comment": "Malware payload", "value": "ab39c0b063bab6a1ab9eb32065616853c9b238ae26b72595fa935aee14d4f6477ff249781f413603d620f6c9c1cb689b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541797, "uuid": "bb0676ac-328b-478c-bc8c-f4ea1d529db2", "value": "3704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541797, "uuid": "1733cfa8-2e3b-4a03-83e6-ed20e081e389", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541797, "uuid": "1a4f9dcb-3529-4c6b-9f33-bc6fd8069c1c", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541797, "uuid": "cdbe652c-f30a-48ea-a240-65e36fb4a87e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541797, "uuid": "f9803169-a4c6-4937-8e28-98f3a453b453", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541797, "uuid": "a4e2a6a7-116c-4023-a615-76aaa2566409", "value": "e62a1f48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32db2e7a-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529736, "uuid": "fc89288d-5b3c-45b4-8851-fe39f2180b55", "comment": "Malware payload (Dridex)", "value": "9f966b55fd8c0bff02074eea90aaaca6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529736, "uuid": "e0b97504-c824-4116-8b8f-7c187a04992a", "comment": "Malware payload (Dridex)", "value": "6e359754831fc13ef7ca0883d8543158c51e0b4f1bb2b73c8505e5119f097f96", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529736, "uuid": "9234a511-d40e-47bf-87f8-bcefdc7bee1a", "comment": "Malware payload (Dridex)", "value": "222c29d0de81fe3ee45af721b828538b729b8b1f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529736, "uuid": "665be8a6-3c3f-4ff8-a8c4-26a86bb36f9c", "comment": "Malware payload (Dridex)", "value": "1e7b275e3246735d99193a7dd0821f2e44b98d067dd1f79d21216e59a1356154eced4dea0ad83f02d56146cd076b9bd3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529736, "uuid": "b04794e4-f015-40c5-bb35-5b56e22b1d3f", "value": "3E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529736, "uuid": "e6e3ad82-a5f3-489f-9990-1b34bb889fe8", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529736, "uuid": "defc6d35-8f38-440f-bef5-7d04aeaba83b", "value": "3072:xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:xH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529736, "uuid": "eeb85040-8d75-463a-b1e1-2982fab9622d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529736, "uuid": "86f89626-7715-4037-bc60-61543ab38b1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529736, "uuid": "c78ef2db-19fd-4a27-a6d9-d23814a38cb1", "value": "9f966b55_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f38ee1-b98d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621530387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530387, "uuid": "91da346f-8c68-44ee-82f2-42215fefaf2d", "comment": "Malware payload (Dridex)", "value": "2c30f2840a6ebb59e4b92415f8aa86dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530387, "uuid": "0989d574-8281-4703-a016-01e5cd8cbaf9", "comment": "Malware payload (Dridex)", "value": "6e9436aa56862f03e78e08b547fbe48b2a704e070669b51b8838313e3485cd56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530387, "uuid": "04838d06-eff1-4ce1-8659-dcd7ef40c934", "comment": "Malware payload (Dridex)", "value": "1f3a9d174eb290787b2c4a3f8e603ec324a8ac53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621530387, "uuid": "ab2ad366-181e-4828-9ee2-8d703556f7ff", "comment": "Malware payload (Dridex)", "value": "8159973c7fc076070c93e115b00a8b2e141886dd8234a17340b8ab56c330752384d0375ec3f9209b2804509e30ed0afb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530387, "uuid": "678378df-75f7-4b16-8776-41ae8bbbdaae", "value": "6104BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530387, "uuid": "2f33cc3a-04d7-4b9d-831a-5245a2a6c0c7", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530387, "uuid": "f374194e-c5a1-4804-ae7a-b65ae809ec6e", "value": "3072:wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:wH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621530387, "uuid": "9b7fc1f8-c10a-4f97-9acc-3212be5e6c28", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621530387, "uuid": "f6487cab-8207-4a25-88d6-63c17147abd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621530387, "uuid": "7d73eb66-9cb7-44c4-a255-95892e2c037e", "value": "2c30f284_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14def43-b998-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621535075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535075, "uuid": "d7a7b58e-d056-46de-808e-de39a9630b40", "comment": "Malware payload (Dridex)", "value": "13e967b6f2130c3526450cf65e94c087", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535075, "uuid": "ca742cbf-f8b2-40df-bd30-b2c79aa13062", "comment": "Malware payload (Dridex)", "value": "6efbccb8d2494c77c8f4c835aaa968ba9549c08cf6994f767f0680e2bcad86f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535075, "uuid": "7cdfd783-f91e-4298-8b53-45372395cbeb", "comment": "Malware payload (Dridex)", "value": "fc663b27d04f2bf0660ae7a669a170ff0964da6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621535075, "uuid": "52899294-28d2-44ae-9b5c-42937446ff2a", "comment": "Malware payload (Dridex)", "value": "ffd342c7e8f41d474b4c11f53ab98cf0f5ea47ea68e56c911f0daf7778d5813fc05dc1b9d55270d2710c06897a5e68b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535075, "uuid": "83cd6105-35f0-439d-8d07-e1dc6f4c2a57", "value": "4E04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535075, "uuid": "3348f613-93eb-4505-8144-5769b9c0778d", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535075, "uuid": "36c2eb22-7b42-4f60-ac38-d019a6e853f1", "value": "3072:yWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:yWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621535075, "uuid": "7c97ea01-4f9a-4f37-abcb-720fcc7cc86e", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621535075, "uuid": "b7a56ce4-3b44-4099-9e47-ce2942b29c8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621535075, "uuid": "b30f53a3-e9ba-4747-b4d2-9e69f3d71b2d", "value": "13e967b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d059ae-b952-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621505036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505036, "uuid": "45f9c65d-5b80-4e02-8b64-3dfa27dc0d87", "comment": "Malware payload (Dridex)", "value": "0502f96d27084d1b32fc8362bf325368", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505036, "uuid": "5de3c2bd-468a-4050-96d8-c5d0bbd5fe4d", "comment": "Malware payload (Dridex)", "value": "6f357c0b0000f736b51cd043919690fa5d315b076e430c8c8b08a60911fdd679", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505036, "uuid": "a760886e-dbe8-4b0b-8f38-18a2af7dd9e3", "comment": "Malware payload (Dridex)", "value": "9f3a90a256e2796577173971745fa27b9672c0f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621505036, "uuid": "7f6a85ed-3a56-4f70-9a6e-4e307ecc3cfe", "comment": "Malware payload (Dridex)", "value": "f0cea0e3d41b3106636941b44d5da7c6a9356d0f9db1f08f8922621cb50b12bf2a6722a4cc8a08e65ab1dccf0f142a4f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505036, "uuid": "32d492eb-a859-4d15-af7c-74f172c31164", "value": "E904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505036, "uuid": "fd02b67c-fc20-4526-bdb3-330961241f5c", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505036, "uuid": "54e366aa-5eb3-4b79-a29c-066c1b18fa1e", "value": "3072:vi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:vH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621505036, "uuid": "8737b5a0-c517-4ddf-8c6d-e60ef720c7a3", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621505036, "uuid": "15407185-26fd-498c-b0c5-c601806194e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621505036, "uuid": "ba73e16a-520f-477e-9064-82dda8acda0a", "value": "0502f96d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74309e86-b977-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621520826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520826, "uuid": "db7e65a0-7178-47f0-868f-665d87f4b1a2", "comment": "Malware payload (Formbook)", "value": "19c637c05452ad651ae373885186579f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520826, "uuid": "8b9a74b1-48d6-4afc-983f-be9de38a8867", "comment": "Malware payload (Formbook)", "value": "6f699e2d98b52c522781d82018713d76762429a68bc236f5a155c275ba7b5268", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520826, "uuid": "21968951-8d65-4315-a1c9-8281406a9ecb", "comment": "Malware payload (Formbook)", "value": "19596f70fcdc6c8156de419a417bd8ec27f77dad", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621520826, "uuid": "36ca6f3f-df36-4d18-85df-1ab3beae0ebe", "comment": "Malware payload (Formbook)", "value": "1bd85c905c35ff792ed07d4698c1cd36eb00548b4c7b4d707edf2820d0e0db7d68830ea3ab9d08dee827377ff6de9fce", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520826, "uuid": "24581ad3-9abf-45b3-a36e-fcd21010182b", "value": "EF0381E6B296D846DA4903324DE7C6E76766BC115F57838B3389F31E1FB0AC08A13617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520826, "uuid": "a5529438-7a66-4573-b2b0-dd1a29db5606", "value": "768:Nck3hOdsylKlgryzc4bNhZFGzE+cL2knAJ0OiCgPZiz7y0yUh38e2+m:Ck3hOdsylKlgryzc4bNhZFGzE+cL2knR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621520826, "uuid": "55fb35a3-f009-4e74-9773-66edd79dc43f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621520826, "uuid": "5f34b13b-bde9-447f-b895-06cb1489e76a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621520826, "uuid": "2faea847-c044-4b13-a78c-153ac1adc484", "value": "19c637c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b7ba64-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540500, "uuid": "39535bfd-8141-4595-a177-c8e1b9daeaf9", "comment": "Malware payload", "value": "f5ae03de0ad60f5b17b82f2cd68402fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540500, "uuid": "65fed37a-ccb0-458b-b9ca-112958d22a56", "comment": "Malware payload", "value": "6f88fb88ffb0f1d5465c2826e5b4f523598b1b8378377c8378ffebc171bad18b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540500, "uuid": "02883703-c590-485e-8a14-53fffd60a764", "comment": "Malware payload", "value": "7c3d7281e1151fe4127923f4b4c3cd36438e1a12", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540500, "uuid": "31127fa8-4b17-4e41-be46-396649b170a0", "comment": "Malware payload", "value": "98b6b9618dc1fd4966c40da0e633b6b9af69b9c2c8d9c6cccd3abe165199e598474402d8de7f8dc75eec8bd6efcd6c10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540500, "uuid": "1890d8fb-680f-453c-9741-679267bce5d8", "value": "3B747C6AB75050F6C1678278CC67C232D6F1BEAD4760570F86E4CEAB3F326266718705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540500, "uuid": "62a02979-2a24-494d-84f4-da71c61aa9a2", "value": "77aed1adaf24b344f08c8ad1432908c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540500, "uuid": "9c78bc93-01df-4702-abcf-fb85e26ef41c", "value": "6144:Tuknw6IdOrtDbUngzrlzMA32rOZT+zDwSMm:KaHIArtDbUngzBMA3GOZSzDwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540500, "uuid": "48b52d6c-5054-4be2-9aff-886f0d76c176", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540500, "uuid": "7e0f41ae-6e1f-43f3-bf66-ffcbe800d38e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540500, "uuid": "3b04c9a1-d3c7-472b-aca1-8b1708b1aa89", "value": "cmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7753b5ec-b984-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1621526415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526415, "uuid": "e9bd74ac-2dba-42bf-be34-0e775539d66b", "comment": "Malware payload (IcedID)", "value": "bfca0dc0df5fd885c51038952ff3be5c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526415, "uuid": "b0b1851a-8724-418a-aae8-e9ba02216df7", "comment": "Malware payload (IcedID)", "value": "6f98390caf0b29232f57e84eb825b0aa8af3d5fa9e70fc689d38b5cebbc7b4c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526415, "uuid": "98cfe222-5435-4aa1-9b8a-145be4af6c5a", "comment": "Malware payload (IcedID)", "value": "48979ddd712ee434821de3c74fe3175f66d0f22b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621526415, "uuid": "7b0923a4-d273-4adb-a148-37431595cc88", "comment": "Malware payload (IcedID)", "value": "bb8f4e70a1996b4b5a8bac93056fc26fcb54ccc4ad55a0ceb10bbf2ff4ee47589671ba3dc76aa5a054e62a83a428b5f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526415, "uuid": "13e897dd-145d-4ee1-9c7c-7cd379ff5cb7", "value": "B1130972F6629844E813D67BF23FF2701A76A270062D613B715DA7538462E23AF27317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526415, "uuid": "22feb13c-e69e-419c-a495-10654dc8d482", "value": "5eddc054fb0b48a4bdf81f75f9b1b4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526415, "uuid": "1940747d-2e00-4a8e-a932-e1a04758399f", "value": "768:2NUtEnqlX895Z1flb4ykWvMctB69lMNIWOVuKuSjUXmJeRHwvGfnjiKs2F:yxq25Zp5pv/t8lMNIWOIQUX3HRjiKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621526415, "uuid": "684b8caf-bb2d-4bea-9598-1a2efba4a5cc", "value": 41606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621526415, "uuid": "11144fd5-f7bb-4e40-b225-0e95c37dab5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621526415, "uuid": "f0325ae6-4fe7-4058-bd63-6db2f132d296", "value": "6f98390caf0b29232f57e84eb825b0aa8af3d5fa9e70f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecb4bfd-b921-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1621483934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483934, "uuid": "82440966-cd06-43cd-9384-233a65abc96b", "comment": "Malware payload (BitRAT)", "value": "ef69dc0bd291c83dfefdf9b91142b499", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483934, "uuid": "81d166da-0982-4696-9691-547158432c7a", "comment": "Malware payload (BitRAT)", "value": "6fa2e40496158766ad593ced07f7f16c762f04dcc1496e92c7489844a5ab0531", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483934, "uuid": "4437f961-e79d-4d58-a14b-37c95cc24890", "comment": "Malware payload (BitRAT)", "value": "cf4e1738ddf56554f5f24bcd7d2294208b1c0b73", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621483934, "uuid": "16aea46d-99aa-4b13-8513-1193fb127a52", "comment": "Malware payload (BitRAT)", "value": "a7801d568ab86be3a225f5776b3129718355a72960aeff41561ebb0cc13234cee998259d022783945a7bd6930006b1cb", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483934, "uuid": "b0a6fa10-d2f5-4c3b-907f-476d210811c0", "value": "50A5334CE0DFB232C26D78B51A07945178F86F20F226A5548BB728971117DC3C9AF6EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483934, "uuid": "624bcb20-eb90-4f7b-a075-547d24190732", "value": "49152:Ya4q/rUQbBxxJXvJfehQp1LXgNpw2CjxeaO6OZm/C:nfbHxhvZe6jwjqj5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621483934, "uuid": "11093360-9389-468a-8acd-fea8855dcacc", "value": 2110268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621483934, "uuid": "dc0544ec-e9be-414c-ad1d-00b181015fc8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621483934, "uuid": "fd5f6260-af4a-4795-9839-b8c3d86e25be", "value": "ef69dc0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f86ffd9-b995-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533623, "uuid": "a1a207d1-3678-421d-9ec3-4f5cab2921a6", "comment": "Malware payload (Dridex)", "value": "d5afe14297cb3a0c93799ac0d193a7f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533623, "uuid": "e1d1723e-ae95-4144-be8a-3746407ed062", "comment": "Malware payload (Dridex)", "value": "6fbe07affc09966d3a9f22c4c3c1443b4eaa237962745a38371eaa9ecbee63a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533623, "uuid": "f0e3e20f-5976-4aed-9e69-1ab9b1f3d244", "comment": "Malware payload (Dridex)", "value": "5ca42c98744b6d19bb66d73f0ea8b63dc081bed9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533623, "uuid": "f476b091-2592-48df-b2f4-53606a50d441", "comment": "Malware payload (Dridex)", "value": "30fbc76141d2b1799dffa2afdc3d31298eaff35680dc6d0788c7a2b38635dcc262e8169742a386faa4fe9ad212897216", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533623, "uuid": "6d43a903-e0b9-4b40-a4ea-ba4b63a2107c", "value": "6A04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533623, "uuid": "320416b6-7357-4e6d-aa61-81b88bae8f78", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533623, "uuid": "dae671ff-3d65-4c03-97de-1c29187af184", "value": "3072:+i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:+H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533623, "uuid": "55e188d5-cc10-4233-84c9-90b589eda8ae", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533623, "uuid": "1dc5824b-6bfa-4661-9d15-d5d3dce00a96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533623, "uuid": "9584e946-4056-40ad-b3de-68147a805d3e", "value": "d5afe142_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4260ef06-b9bc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621550378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550378, "uuid": "c95e4d98-fb7d-489f-aa16-2e97f2a56119", "comment": "Malware payload", "value": "db1c63fca351f02aadf4e52883d7aca8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550378, "uuid": "4c7f9dd0-5c08-4c68-b545-914e8267af4e", "comment": "Malware payload", "value": "6fd5d083a6751114988a1cfc8d42b73711d78bef7cc804a154628ef4a6f3ed10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550378, "uuid": "9acd6b20-50e0-45a3-a827-a1f874a53656", "comment": "Malware payload", "value": "1a74e1282bed4f28f6e6e74652c5a3a89df4955b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621550378, "uuid": "ba0371c4-2117-4e06-b354-6dea44976e5e", "comment": "Malware payload", "value": "c0db6f14f418f5557864d1990493ff2a932ecb86167ae44560c32814f38379eb23181428f39d23ed64bd05f46643be43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550378, "uuid": "747a23fd-9ed7-4104-926f-337c645de6b7", "value": "20F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550378, "uuid": "616b1515-3e3f-4046-adcf-9896d843584c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550378, "uuid": "0aefa56b-8ae1-46c7-814b-0ed32dcc7b13", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621550378, "uuid": "e6e3663a-eb5b-47ef-843e-3bbcd6de2019", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621550378, "uuid": "e2a69dbe-38cd-4af8-bf7b-6a531bbecd8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621550378, "uuid": "2352efb5-55d8-4091-ae0a-2f6b7bd3b728", "value": "db1c63fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0543259-b989-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621528765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528765, "uuid": "03312477-a2f1-49eb-8064-791d72638867", "comment": "Malware payload (Dridex)", "value": "fc21d4cf4be010956134674177036171", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528765, "uuid": "0937fe88-6123-415d-9d7e-e8a6d7064dce", "comment": "Malware payload (Dridex)", "value": "6fe8ce4b07176cac0fed90234fcfaf8063e95f15f46204c7eebda42f013fc6a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528765, "uuid": "8aa8950f-6173-4d07-b24e-b98c704ce1e5", "comment": "Malware payload (Dridex)", "value": "e10955900362296ca629e02f0e38ec7d4d7a9a4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621528765, "uuid": "b3b108e3-61b0-4c48-ad12-18830c8e3338", "comment": "Malware payload (Dridex)", "value": "b94c1f37aee35077c82e4a4063d95944fdd6133200b77b8fe81f8767b952e58b51864d5f321c979cc53bb10e6e506aa5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528765, "uuid": "7087a7bb-96c6-4fe0-abdb-85ae048b4918", "value": "1F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528765, "uuid": "6535aacf-d613-477a-ba71-6ad312ec1b02", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528765, "uuid": "d69662d9-ca21-4901-a799-815e1c0b9514", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621528765, "uuid": "fd7a7252-a013-4e94-9c72-e177579b875d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621528765, "uuid": "2c6ca129-9f2a-4724-bd25-6d9a34958824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621528765, "uuid": "972e741a-ca35-41e6-a120-ad80e8142827", "value": "fc21d4cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d105e0e5-b981-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621525277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525277, "uuid": "719cbfc2-a199-49d5-b998-3613d2f8ce91", "comment": "Malware payload (Dridex)", "value": "53300561861796fc40ef112aa8651738", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525277, "uuid": "1076fd36-79d4-4c4f-8182-aac0cf3d096f", "comment": "Malware payload (Dridex)", "value": "6ff5e435d893e47d1c2f10eef4ed7c38d33088b3bd6b8dc330b02fd04c7cd8b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525277, "uuid": "971c3baf-5c78-4c85-b8a6-bc6496052215", "comment": "Malware payload (Dridex)", "value": "e377015ff1be657e4a5a4170fe02daea8bdbefc0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621525277, "uuid": "a0b4a673-7000-4ac0-bb06-0380902cc0cd", "comment": "Malware payload (Dridex)", "value": "9c37e9134567e96879be0be6d72242897041fa1a3ec36899c887c85fc333d3d6b52f5e86cd79e417e311d8468e879b02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525277, "uuid": "4d5464dd-fbb5-4dd5-9e5a-7b7c98a4b927", "value": "C004B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525277, "uuid": "6b669be6-9f68-4baf-b584-858ac698a083", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525277, "uuid": "f9d81019-4a30-4d05-b82d-aa9cef47b5c1", "value": "3072:cWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:cWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621525277, "uuid": "6835748c-4203-4754-b9f3-0ec7c1e68d16", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621525277, "uuid": "1c20b432-b26b-4104-a05c-1b458dbf613b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621525277, "uuid": "07cace11-c800-46d8-9990-c4cab1ea5b78", "value": "53300561_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5a1471-b9b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621545908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545908, "uuid": "b8650c0b-57de-435e-bcf6-8a9f51a4769b", "comment": "Malware payload", "value": "4cda31ae011959642b1ea7f52d400ea6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545908, "uuid": "87d4d561-3c3b-4488-9c10-370132577fad", "comment": "Malware payload", "value": "7020e0a1f0290555e6a5854b9944d927a336c8df26285649a92cb58996d32892", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545908, "uuid": "298bbd09-e5da-4341-916d-3bad4e938ed1", "comment": "Malware payload", "value": "5cf2dec44819d42f4fe13878a0c51fe29719479f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621545908, "uuid": "f35e0c8e-27a9-4b1f-9a3c-ff91d5beb0e0", "comment": "Malware payload", "value": "02f5acb2d99af38d4f5c7a27cb1396554b1444d00eb42c7438f1cca05beecb5d8b6986e8e9ab207a9745f4d3974fe1bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545908, "uuid": "f7a8d247-2afe-4971-bab8-0551ac1d998d", "value": "C604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545908, "uuid": "2a59dc3e-88c2-44f9-9066-6b739b12afbe", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545908, "uuid": "2af55e5e-d497-4175-a8d6-918cc92b9260", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621545908, "uuid": "a5fe47c0-37c4-40fa-a6b5-28a6d258f40d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621545908, "uuid": "3e969c0d-73df-4eee-bc02-cf9a64e977c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621545908, "uuid": "66669d84-2a8e-443d-9dd5-5ea7c5c994c4", "value": "4cda31ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806e6671-b9c6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621554777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554777, "uuid": "312404df-6c7c-498f-9425-6442abd83ed2", "comment": "Malware payload", "value": "a34e0e81ba78f98953d6b2b3def26c3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554777, "uuid": "5371a9d2-3093-42e3-9986-5d2bf7376973", "comment": "Malware payload", "value": "702e68187abbca9244a665dd397680be9614e8ae1f7a4b2181adacdbf5901f0f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554777, "uuid": "7cc3fdeb-6f4f-41e5-b3e4-f6789b29bec8", "comment": "Malware payload", "value": "fc056f360faaa0d93c1b7d5fd1fcc62bee707260", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621554777, "uuid": "c886167d-85f1-4e40-adaf-f3f09ebb0360", "comment": "Malware payload", "value": "ef607cf66241f9b6fe2e3e473f144679103e6944e7b040a2419afb32c8ce36d5d0a9d43d24e7e304dc7a13726b512d97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554777, "uuid": "96c17fbe-c6c2-4036-808b-445585990678", "value": "9F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554777, "uuid": "8ec6fdc2-4618-41e1-b6de-12725bee4c60", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554777, "uuid": "6ee972d8-8e1e-4d19-b65c-1a8d082d1443", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621554777, "uuid": "cacf5208-8ce8-4bc9-87ac-da7fd6dc3f49", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621554777, "uuid": "2c0492b7-9607-4ce0-bb5e-918c9ce07c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621554777, "uuid": "29bbc1fe-0599-4cf1-a637-ff3b5013849a", "value": "a34e0e81_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcaa54f-b996-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621534106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534106, "uuid": "c1b9cb29-c476-48a3-8c2a-2b42a4ecc74f", "comment": "Malware payload (Dridex)", "value": "7f22d9be4511e880b43c22e77c68c854", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534106, "uuid": "57e292c0-7c58-4359-b4ff-6dd8717f336a", "comment": "Malware payload (Dridex)", "value": "703d0fedee931c52544410e59637cb4eb076cb4a5f84f39b9888d0a10b7413e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534106, "uuid": "33f532fa-f80c-480c-a2fe-3bef26a7d2f5", "comment": "Malware payload (Dridex)", "value": "a1f69c0d6f9f3c2445ca1a194e56d8eaeb0a6c6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621534106, "uuid": "335b0444-620a-499f-a0a7-e7deff59b73d", "comment": "Malware payload (Dridex)", "value": "8661388c821d5b525c71d939d19465ecfd959e9e689863fdba50ab03aa9849272e6621ccc72b24e1d5ae40c998f10148", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534106, "uuid": "80bdff20-d93a-4f78-9140-3b2624332a15", "value": "B904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534106, "uuid": "72ee57ef-3297-4c17-87ef-723bf1397fbe", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534106, "uuid": "60e50d5d-2023-49c4-ac6e-8d33267df3e3", "value": "3072:Vi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:VH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621534106, "uuid": "db556249-1ecd-4765-8993-f75cc9aa3e52", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621534106, "uuid": "6cb84360-1a15-41d8-8cfe-efff7b172e88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621534106, "uuid": "f14aa82b-3498-488e-8b65-0839ea5f2740", "value": "7f22d9be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9aa0ca-b97f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621524410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524410, "uuid": "a8beff3b-b468-4c5a-9897-1cf8fd706c70", "comment": "Malware payload (Loki)", "value": "917193bbd6aa1b2361d9829df2174f1d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524410, "uuid": "912feb46-c1e6-4fb2-9af8-25472c81182b", "comment": "Malware payload (Loki)", "value": "704a6365aeccfc6903bcb6c909f0f3bacba171f2ec21f863475367142e1e4a04", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524410, "uuid": "a50b0814-36a0-4a6e-b25a-a2c9f78b22d9", "comment": "Malware payload (Loki)", "value": "481ab8ee06c8e17bc9a0c7ce64f2803d7622caef", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621524410, "uuid": "26a5e5f9-cfc0-4baf-8b12-21eb929e46ee", "comment": "Malware payload (Loki)", "value": "7eb037e66019b4053a7962a67fa274482386a38eb1875810d307ff8578cfcc5ff7adcf2a5b5725201a47600b5cd809ca", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524410, "uuid": "d3823e51-c591-4ecc-941f-2f2c39091dfb", "value": "1315AF3272519032C26B1A789C0B52B59939BE30ED18995737F97E4C7F393A17A292C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524410, "uuid": "27663432-1fb7-493f-b68f-4ab9266f481a", "value": "3e8a518ae58159a44bd8bc83008aa8aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524410, "uuid": "00619d0a-1034-43d5-888b-ba7980d7d914", "value": "12288:9S80SbYOAD65QF6ofEwawyWCqGjUwudw1239PadHiomSD1zmEyCiomjNs:93VbRAQQF78waJqqtGoOAHaCis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621524410, "uuid": "6d508dda-706b-415b-9b93-8779b8b65591", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621524410, "uuid": "7362fe5e-f288-419b-9376-872f1bb52146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621524410, "uuid": "5ea4317c-7f9b-4ec0-8a29-fa8c753998ae", "value": "Comprobante_de_pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c00270-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472512, "uuid": "9a81252f-fbd9-42d3-91f7-34056ee5e9e3", "comment": "Malware payload (Dridex)", "value": "8396a26dcf82683f066c770ed35acdbc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472512, "uuid": "6c8097e4-cd38-4716-ad9d-3c6c1e097bff", "comment": "Malware payload (Dridex)", "value": "704c3011917b29ce6f810206df46da946801b139e11a6a3a5aa0d55cdb0940f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472512, "uuid": "25478ad9-d62f-4b20-b434-294b0847b36c", "comment": "Malware payload (Dridex)", "value": "06dcdb33f43da90432ca74ce6a9c893a729a5608", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472512, "uuid": "a4a3f11a-d914-4159-b91e-91c3ff543b8f", "comment": "Malware payload (Dridex)", "value": "d407f66b03ebb45c03833b480423af637c578b3b6003f375687b373fd3d636eee7cd791018ea3f8750845a6d6095f8ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472512, "uuid": "ca11c270-9e69-427e-b38c-69529efcb52f", "value": "6DF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472512, "uuid": "721bbad2-dfa3-4981-a4a5-eb176a6a90a5", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472512, "uuid": "6282b375-4050-4ab0-8af3-9f42ccd3d35e", "value": "3072:P9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:P9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472512, "uuid": "a2179e9b-869b-4b72-894e-2ddddb2b0032", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472512, "uuid": "32f96b56-21a8-45c6-aee9-55ebab05ff31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472512, "uuid": "5589b448-75da-47ae-9fad-08f0a5fbc1fe", "value": "8396a26d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312a56d2-b94a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621501386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501386, "uuid": "d109d071-2d74-4c5a-a91d-e03a4f05f8cf", "comment": "Malware payload (Dridex)", "value": "788743d81a0b5b877f13207188cf774b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501386, "uuid": "ebeea06d-52f8-4184-9312-4f7c3954b573", "comment": "Malware payload (Dridex)", "value": "7061ce3d1f95c2814912acaed816287d60a87c110f76242e39434e518119eefb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501386, "uuid": "3d5bf4e4-adbd-4710-956a-cdc379cdd5cf", "comment": "Malware payload (Dridex)", "value": "d777b8c062d6599de3b09b835d324845e584070e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621501386, "uuid": "72f8c2e0-97bc-40ec-839a-8ee81793bb74", "comment": "Malware payload (Dridex)", "value": "a08ba4bd37b13a6ea6f75c77eade9987a7e4f22c16a14dd5017eb043e44a130773c436c67b2b483a5bf63c82b792a9dc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501386, "uuid": "ab965433-8c4e-40a8-a16f-332e4ba83804", "value": "6B04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501386, "uuid": "6680be1b-4aee-4fe6-82bd-cf570711dc35", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501386, "uuid": "f203b870-528a-4d4f-bb7f-5069f46331a3", "value": "3072:/i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:/H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621501386, "uuid": "4fe630c3-b993-4906-93da-7a6ff760eb11", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621501386, "uuid": "81c40687-749d-4cf9-8a31-e113f1e7f70b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621501386, "uuid": "276bcf0e-52ef-4fd4-bb38-2973a0eca02c", "value": "788743d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fac62de-b932-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621491103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491103, "uuid": "5bba0f98-3532-4ae7-ae31-8bd37afdaecb", "comment": "Malware payload (Dridex)", "value": "dd2ebf1d5109887942dc0dd4523a5367", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491103, "uuid": "a174e4e5-47c3-4021-abf7-eaa1586b6e58", "comment": "Malware payload (Dridex)", "value": "7068ff811851926098f5d0f568b2698eef0fe88573c4b9a625692a9aaa4c5c92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491103, "uuid": "baec9467-c4d7-4b6a-b1e8-70ca27162ee9", "comment": "Malware payload (Dridex)", "value": "c1a861477bd55921999deeac244fbc34f8854bc4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621491103, "uuid": "0592fbd3-2825-4f1c-b57a-3012df9920ff", "comment": "Malware payload (Dridex)", "value": "b624624c8ca4622ea1bdbe3548cc4b72a7113a3cda5bd46d8d727c3a406149d36f0e7bc3a60643c20aded60efb11b05b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491103, "uuid": "8c4116ac-cea6-4fc1-856f-d720afa5846e", "value": "00F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491103, "uuid": "391f3236-83d1-4a44-acad-453245d6e150", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491103, "uuid": "a26f210f-5ba8-46e8-915d-cd31322554c1", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621491103, "uuid": "6a68ee60-81f7-428e-a0b0-a0d11dd7ac67", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621491103, "uuid": "1ced76ce-4a62-45c0-9f52-390f98b282b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621491103, "uuid": "f88df3a1-c8d4-48bc-b4a2-cae68b82998d", "value": "dd2ebf1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324d7d3f-b9a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539184, "uuid": "68bab67e-45b7-4100-b840-454a368664d0", "comment": "Malware payload", "value": "34b078edfece1609b09f4e7c09c46ac3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539184, "uuid": "44b50291-12d6-4ffd-9420-3a3679aea2c5", "comment": "Malware payload", "value": "708351c3fda60ce080145e82c8ad204913d978ac7a4470745a02f676dad5ddec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539184, "uuid": "a9abdfdf-d5b5-44bb-8c68-0ef2c01fe5c6", "comment": "Malware payload", "value": "e454d9baef381b6219b4e54b2ab13cb2aaf46f1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539184, "uuid": "eb95fc2a-c7dd-493e-b408-7dadc3ce51b9", "comment": "Malware payload", "value": "fa516e28fcd2c748f4d92bcf16ec194293aedd01e346e738682889ac1d579e8390f2ffbaa207bc60edbcdeb016d574ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539184, "uuid": "5f7584ba-7897-45cf-a3e0-c622fd19a01a", "value": "6804BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD28ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539184, "uuid": "c5f31af4-5fa8-47b4-8b9c-3e7d810e395c", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539184, "uuid": "d74d91d6-25e7-4b09-8138-b8f691e4782d", "value": "3072:ui49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:uH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539184, "uuid": "168669fa-f05f-4ddf-9546-6a27af9e8ced", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539184, "uuid": "122b7366-be0b-49f0-81e2-a8eb9289dbe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539184, "uuid": "6b578c8a-2517-474d-8633-8ecdd6290e92", "value": "34b078ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557e0aa0-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529365, "uuid": "99cdcd5a-e899-459f-86cb-3a26a7b9196d", "comment": "Malware payload (Dridex)", "value": "ee5c97db8d1c6a8f1636d48591e338df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529365, "uuid": "52cad478-53de-4627-8900-87e3f723880a", "comment": "Malware payload (Dridex)", "value": "709e91382bfe70146cdeb4a40424ffe73eff422397231cde47a7cc88c99d2c50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529365, "uuid": "d19fd100-141c-40f2-99cc-d246260c63b0", "comment": "Malware payload (Dridex)", "value": "c0d65f34d770ed342a3f61357921213fb0a1f986", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529365, "uuid": "0b37712a-2a82-4060-bc45-3fb8028fb1ce", "comment": "Malware payload (Dridex)", "value": "589902e42e6cea5e8de81395e328258e8b41df923a730de76af13bb7402901943afe16a511c876c1aec8710a8a58d5d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529365, "uuid": "8bcad52f-6288-4242-b962-c3c37b29c119", "value": "1104BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529365, "uuid": "d3c253be-609e-454c-a621-730c582bc94d", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529365, "uuid": "c78c4766-647f-4e56-9245-a80535053d04", "value": "3072:si49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:sH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529365, "uuid": "799a17cd-eefa-4d98-b57f-7202117bb908", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529365, "uuid": "740b1f91-8d09-4c6a-9949-4e1c3fac901e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529365, "uuid": "f55cdf2f-874c-4385-ba5d-428741e1a70d", "value": "ee5c97db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678c791b-b9a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621541850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541850, "uuid": "3c50c448-7e8d-45c7-aeb5-8dd4aba8adda", "comment": "Malware payload", "value": "ec7e5056d2ae006f54823ccc24700d90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541850, "uuid": "4088c4c0-8d39-43ab-a882-dcde553777ca", "comment": "Malware payload", "value": "70aacddf1b8dd17000fb327a804127f33a18b88a5b57294acb52997712c4f2ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541850, "uuid": "f39f97c4-19bc-4897-8098-12fc38944fab", "comment": "Malware payload", "value": "96806f63343b9ec8a4f47c7d22e3921c4487d6a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621541850, "uuid": "d4b6d3b3-6bf9-4e17-811f-76b9475dd6c6", "comment": "Malware payload", "value": "f91639faf69da4679777abffd5690239b15fdf5e1fd7492962cbadd488af0a06668cff1035483264963724fbac313f77", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541850, "uuid": "f58d2da3-adc5-4f0a-848f-e1154572d884", "value": "87F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541850, "uuid": "c40a1ab0-d55f-4b5a-8ed6-d36114e3d24d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541850, "uuid": "a5db19d4-8040-4050-8216-fbf49edefb36", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621541850, "uuid": "ee0e0e98-13da-42fc-95ed-495cf2657975", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621541850, "uuid": "9f42dbb6-1931-47e0-a324-a74cb4869ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621541850, "uuid": "e9a01464-41e1-4e0e-8648-7a37c17962b8", "value": "ec7e5056_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44355128-b939-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621494117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494117, "uuid": "92424a0a-1c96-4d9d-a5aa-b997c839e969", "comment": "Malware payload (Dridex)", "value": "f3d4f91c0abc55917fe914c0766c33f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494117, "uuid": "17c763c0-6c12-4991-b8ff-9890ebb99c00", "comment": "Malware payload (Dridex)", "value": "70abe5978d8fd168c945bd31e458a11269b6076c9f34c3660ff3d4a94f6e4d7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494117, "uuid": "2fd5aab5-b701-4400-a857-1ae75acefcc4", "comment": "Malware payload (Dridex)", "value": "c64843d747a2debaa892bb3c907be600d54181e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621494117, "uuid": "891e66b3-4e6a-4024-bc43-a18b920eed0a", "comment": "Malware payload (Dridex)", "value": "02e820853dad8c5f4ddd953983dd08f1ecff82bd98fb2c2d973a00776fdd63528649f0b1a904e6fe17fe8ba20cac82b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494117, "uuid": "516a07a9-00c0-44d3-a384-06d9e48c71d9", "value": "1FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494117, "uuid": "848afade-bc40-44dd-abf2-1b5261cca57a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494117, "uuid": "331dce7c-f847-4323-86b1-24e03dcfa611", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621494117, "uuid": "dc0a5485-d7ce-47db-a338-7d9cfeb10326", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621494117, "uuid": "385449ba-afe9-47da-a691-b78e84a6dad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621494117, "uuid": "d0f4357f-286b-4bbd-869e-30919abaa1ce", "value": "f3d4f91c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf3c2e7-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479690, "uuid": "b4bfb98e-ffea-4e58-a8c4-9ff71ac17f68", "comment": "Malware payload (Dridex)", "value": "f4ecdcd74c637d3f8bf2e320fd030d5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479690, "uuid": "deab0cbb-541c-4a33-ad19-e73519954b37", "comment": "Malware payload (Dridex)", "value": "70cca2d76140543062e2502fca7d15a2a7d1507e0001dd70c7e5599b7062976c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479690, "uuid": "33bf16e7-564a-4e55-a660-21f61d802d35", "comment": "Malware payload (Dridex)", "value": "6b9f607c9e58d1df69a939c1f329c429eadf265d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479690, "uuid": "752884d3-7ed4-4c11-b7a9-265949bb078c", "comment": "Malware payload (Dridex)", "value": "8fd8d53a12de58eea7daf908bd74b9bcf004795f8d4876ea986bb8f229e82477d452542bac9b9cd431c6708f1d51c6ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479690, "uuid": "9bb52280-b9f1-4700-8c74-3644bc7f53d8", "value": "EBF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479690, "uuid": "d25fbf24-c739-4ea1-9dc9-94b7a520e3f9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479690, "uuid": "0e344f48-32b4-4ef5-9351-f3301360bd2f", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479690, "uuid": "660f7b17-5ed4-4dc4-be61-69ec6d1286f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479690, "uuid": "68f23285-a422-47b5-a69c-83f043abeef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479690, "uuid": "ddfa8de6-2049-4ef7-b19f-a4a648d7ee37", "value": "f4ecdcd7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d690d9-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472428, "uuid": "d9f01399-e936-4554-b914-e845194b5cb5", "comment": "Malware payload (Dridex)", "value": "e4c2b6b363989b4803fbbba855526884", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472428, "uuid": "aafc65da-939b-4175-855a-4028180f7991", "comment": "Malware payload (Dridex)", "value": "70d266ebaa376eacbe851cf597fd8365f2a358dcc07282610ef88ce7e897dceb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472428, "uuid": "3165c245-0756-4ecc-af03-7bb793a4dc9e", "comment": "Malware payload (Dridex)", "value": "ba5ffd63cae9669bea8661e6389e4d2ef278fa0f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472428, "uuid": "a87d2554-7f61-44a8-a231-4d5ddd7f4250", "comment": "Malware payload (Dridex)", "value": "56bf52576f77084e722449ca652be26f3ac788ff865d4b28b4677ea8c26eec7300e8cd35369daa25755717f17f6a7a45", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472428, "uuid": "11528097-d3e0-4c1a-8f1d-be91cda709ec", "value": "0104BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472428, "uuid": "5ccc958c-d63a-4ada-b6d6-6cb79ee6ca03", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472428, "uuid": "828d71e9-a1a1-48ab-8a4a-732bb83c5cbb", "value": "3072:Vi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:VH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472428, "uuid": "c4795a6e-2431-49ac-a80b-139ca5354f9f", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472428, "uuid": "f305f577-df8c-4bc0-bfac-5a3e57b3da91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472428, "uuid": "48e769a1-5179-43cb-805d-da41473bd406", "value": "e4c2b6b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dea0cc8-b98b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529298, "uuid": "49e429dd-5741-4c5e-8aa0-71963d202d61", "comment": "Malware payload (Dridex)", "value": "166d8b838ad2f00ea7fe85ae521725dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529298, "uuid": "172409d8-02fa-4405-8871-69f1284b4c4c", "comment": "Malware payload (Dridex)", "value": "70deb2b988735832a2793878092a109e37824e8ccf9d6d73988472f82a57b23c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529298, "uuid": "9c55b74b-a358-454b-b562-ef31e2de7849", "comment": "Malware payload (Dridex)", "value": "81cf14f6fe105a6eaeb11c775d2350118170d787", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529298, "uuid": "234277af-0423-4403-aed3-8e99e6393c21", "comment": "Malware payload (Dridex)", "value": "adc97b8248539b1ff0dcedc1362cb3b98bfcaf38a8fac2bb5782e2e9005ade8b964b5b45c0624002c8dd670bfc4a821d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529298, "uuid": "c27efee3-fbbe-429c-a96c-d7bc49bd94f4", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529298, "uuid": "d95acf1e-8bac-4d54-93e9-3856c70b5ec3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529298, "uuid": "de618eea-1391-4fef-bcb9-7850d8550dce", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529298, "uuid": "fcf19a1a-289f-4283-9c92-b1d4845cb7a9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529298, "uuid": "c5894a26-077d-4cf4-a491-546a4f72af11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529298, "uuid": "86b11d0b-4e9e-4276-ba93-8c839e3d6049", "value": "166d8b83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f345514a-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1621538219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538219, "uuid": "a0500b9a-13bf-49f3-b7b0-df22829de3c8", "comment": "Malware payload (DanaBot)", "value": "918353ce3730bc8dcfd94bfade41e6f6", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538219, "uuid": "cf223642-dd02-4283-ad7a-20aae8646806", "comment": "Malware payload (DanaBot)", "value": "70e97b1be94a6abcdfbd1bec5a5408cb6ed3a544a21ce5a00554779787c22c60", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538219, "uuid": "15ac6a93-b1ae-4276-b5e3-a2d89052a83b", "comment": "Malware payload (DanaBot)", "value": "0db0ce7231b515cc856d379b3e32fd39f15d713a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538219, "uuid": "f4765aa9-972a-4744-ab3d-9e330741edbe", "comment": "Malware payload (DanaBot)", "value": "a0a1fec0f5f2e9f57ca0bd159b8cd7a22db9340bbd351fcb883b9e06c1da7d18d9a2bd1986bb965ce03f01fbd4a64171", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538219, "uuid": "440c9bb6-82ef-436c-9cd2-1a0bb105df7e", "value": "24563380B3A1D834F5FB55F44AB88179462ABED12B2455FB13C929AA43346F09D3339F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538219, "uuid": "88d0934e-7bb6-417b-b3b2-5cab12305d12", "value": "364a0fae4ca7ebb0df5cfdfd32c18277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538219, "uuid": "97773828-569e-4c32-87a8-8992f0f9eafe", "value": "98304:1adR6QfD4p9YM6ugbFxZTxcowQHz6Br17QTkDgkhO/hhlvCCumQ1H2NVR7CBOfX:Ybgp2FTSSHGBlJvIhJCCuVH2NTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538219, "uuid": "13538b0e-77f9-4ef1-a76f-a26b2b307bc8", "value": 6347776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538219, "uuid": "9d6e7d7b-1eef-4892-bae4-fedd30ead68e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538219, "uuid": "c81f8242-02d2-4a6c-9cc9-2fec9818b398", "value": "918353ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de16a57-b9a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621538371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538371, "uuid": "d1a32ace-b98c-4f39-bc2c-ff58d049a311", "comment": "Malware payload (Dridex)", "value": "91090d1b28f60ca5854ac8a6a299555e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538371, "uuid": "1443b634-5b88-46b1-b3a7-7f61a4aa8005", "comment": "Malware payload (Dridex)", "value": "712f1d3a3954440a489195900945837701c936ac0183a260e4788b758e66172b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538371, "uuid": "d4916b4c-db4a-49c9-926d-f7736ff4ba91", "comment": "Malware payload (Dridex)", "value": "5428617899ec079825d98e39c69adfcf1b46ecfb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538371, "uuid": "a4334a7a-873c-487e-928d-b5115f33ab72", "comment": "Malware payload (Dridex)", "value": "232d599e30dbc34a526fc10b5ec1f12f650370b33185104196df2a7ea9afff77f6a9564224c8c4c6cc15395be8b2ac05", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538371, "uuid": "1c0a01c9-ae41-426f-9c1b-8b8c5354b8d6", "value": "8704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538371, "uuid": "da91ae19-c1b9-423d-8cef-cceee02623ba", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538371, "uuid": "a028b732-8b37-4f45-8703-8d49ec95eac2", "value": "3072:jV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:jV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538371, "uuid": "69a91432-ba85-41d8-9447-0baf48ca8218", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538371, "uuid": "cb980013-4554-44c7-9974-e09cbeb334ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538371, "uuid": "ad540e03-3144-4e4d-a46f-b508008b87cf", "value": "91090d1b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6835f7-b928-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621486861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486861, "uuid": "5c84a47c-0dd2-43b6-89e4-37a54f80d327", "comment": "Malware payload (Dridex)", "value": "0f9079d767ca384b4373f6c52374299d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486861, "uuid": "2b7e68b3-9272-4d3a-bc0a-0515888e61ed", "comment": "Malware payload (Dridex)", "value": "714e94d8b5c7d972480e22b847d2d0966ec280042e8326045914884dfa2b2363", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486861, "uuid": "6710d809-4bd2-43ce-8279-61d4de6097e2", "comment": "Malware payload (Dridex)", "value": "434f5fc71f64a5dae0e920e8324199aeedf9016f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621486861, "uuid": "cd41da9e-9a46-4a82-9fc4-05e50c02b3ac", "comment": "Malware payload (Dridex)", "value": "5986cb8271324bc2a586578b519760d9ff921d30ab4b07f841b344cd554904d86a8f752fb6914391dfc7d568bc8245fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486861, "uuid": "2ab32e4c-8adc-4f73-ada1-64cc034d41da", "value": "14F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486861, "uuid": "1359e054-c88d-409e-bc5c-3d92b9320de0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486861, "uuid": "ca6f01da-011f-409e-8971-0b1b307dcf95", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621486861, "uuid": "eee9faa7-5ff5-4829-b345-b9afa639a23d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621486861, "uuid": "6902d35c-e86d-4084-b2b8-6df80181ba3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621486861, "uuid": "6db72f5e-20a8-46c4-bafc-e877c2464a7e", "value": "0f9079d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40090fb1-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540496, "uuid": "4500150c-301c-477b-b760-ee0281264b9c", "comment": "Malware payload", "value": "8d8563d4b91a4d5dc480ae8251882236", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540496, "uuid": "cea66453-0422-4312-91c3-985a5de742e0", "comment": "Malware payload", "value": "716dedd79331eb878fb69f272ac13cb674487317e8474c40dbd487160c17ddb5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540496, "uuid": "0588bd49-81e2-47cb-83cf-8ff43ec543d4", "comment": "Malware payload", "value": "b6ade452f33395c19bceb5a008245802c029211e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540496, "uuid": "3773144e-9f72-4a0d-9f6f-ddc21233b909", "comment": "Malware payload", "value": "08c79622110d44bcebfffc0e765667eb7df98004aed20fb4ff4d3781436d8f0610512ce90902c5de63ffcce218a4ad5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540496, "uuid": "bda3627b-0402-4cf9-b9c4-3ce5a39b7786", "value": "ED04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540496, "uuid": "cce2142a-7151-40f4-a14a-45c1f494e6bc", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540496, "uuid": "ddf2cb6b-6b65-458d-a060-7e02167f9c40", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540496, "uuid": "4d4b726d-7e06-465a-bd26-4e7160a74694", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540496, "uuid": "da0d9980-a276-4d8c-939c-d8d0accf42ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540496, "uuid": "4014ae8e-fe45-4622-b7ce-a5d0669ec53f", "value": "8d8563d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c879e437-b99f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621538147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538147, "uuid": "4a9d7da2-1e5b-40e1-a641-5b3cb1efa882", "comment": "Malware payload", "value": "e07a5f838ee38bcf62e13dfc7c09b544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538147, "uuid": "f12e9282-c97e-40ec-acd6-85b1df1f3d67", "comment": "Malware payload", "value": "717d8bea831da6e8e0aefd914345af25b3bf951e40fced1738419668f3bf372f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538147, "uuid": "b519e4b3-5d22-4d98-8e1e-090f395f1c49", "comment": "Malware payload", "value": "b03551b94b74a63f6697c4f6860431184f7fbf4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621538147, "uuid": "6517a1d2-cea3-4609-baf4-0082ac57b9e4", "comment": "Malware payload", "value": "981a8443973463fe83ec5bfdfcdb1155b2ff4d04840d65f1a84588a7340cb0806d92d241e0b0ffd9b06d97bbb4110766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538147, "uuid": "0d8dacda-0e4b-4cbc-b4c0-e596a302a36b", "value": "B1C4E13122E56F96E1BF7BB9587100005BFBF469E322F70D7DA610DE4166E4187B2B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538147, "uuid": "0026a9f6-9634-4f19-9bdf-bb2a4a2c3ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538147, "uuid": "9769f992-405b-4473-88d2-1fe5d24a647c", "value": "12288:/lqxNeKzNQhGv8qry7aiE9tQidizd0kvfEJRvm03Jit8:/mzNCYy7KaidPkHu9mcit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621538147, "uuid": "7a4516b1-d119-4a40-a9fb-9aa9cd3d1131", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621538147, "uuid": "02ab8417-25f7-4d51-b58e-43c937997394", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621538147, "uuid": "a0a8a6b6-8e8a-4572-aa1e-3e62851048ea", "value": "RFQ MLK #656577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f881f07-b8fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621468876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468876, "uuid": "1f649bfe-d0dd-491b-bd84-e5badb17829d", "comment": "Malware payload (Dridex)", "value": "17b1957f92ec6592960c2541fab167db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468876, "uuid": "a8d6421d-c66c-4c64-8527-9160fd68c397", "comment": "Malware payload (Dridex)", "value": "71e14fbf9687283e65c425cbb38425a1175fce61a76bcd139f56abc9750521d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468876, "uuid": "ef056328-530c-4081-9c0b-c931bf7aa384", "comment": "Malware payload (Dridex)", "value": "0a55ad7ee365bba3202ede81e236cfeb88d80091", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621468876, "uuid": "4846a97a-e9bf-4c22-a9e5-a0937d7a2c19", "comment": "Malware payload (Dridex)", "value": "1baaf63a9f3e262f9d7b7ee764a34704b5d8d3128355544fad4ca54de4de5d5580abc233421499cec7c8119ccbeac24c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468876, "uuid": "ea69b13f-0ce6-47f6-a2f6-f8d6810c6195", "value": "09F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468876, "uuid": "36dae3c8-8073-47ef-b816-88005bf75dd7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468876, "uuid": "4f37779e-9081-433c-a1bb-3a3643e3666c", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621468876, "uuid": "7faf4623-b6fc-49f0-984b-0376428418fe", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621468876, "uuid": "79b7a59a-e803-4dcc-b62c-9932d9130f20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621468876, "uuid": "149b432d-0ba9-4cd4-b7c6-42e40aaef151", "value": "17b1957f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce35644d-b993-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621533003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "02587991-d6cd-4bdd-af68-1cb5e3185d56", "comment": "Malware payload (Dridex)", "value": "f546bba9e5a2f2b1ee11e407ee1cf6d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "e5715770-05a6-4b16-b6f1-2083ec009858", "comment": "Malware payload (Dridex)", "value": "71eb0ae4d663724005b6c7ff4d39b5e9206a02f5ced0c6a610b4f54237835245", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "1236017b-0d94-4308-bcd1-de9e11d37329", "comment": "Malware payload (Dridex)", "value": "f742092cd69bda6b9828bc5489ddda095d710d22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621533003, "uuid": "e099f094-a395-499a-8600-459db9053647", "comment": "Malware payload (Dridex)", "value": "bcdd70a56128f2bca1b1d9c8c9c1b7a7843a798e4f6286851175da5218aafa2326da2d710b6f441b12e6804210d96c64", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "5d49dc0f-3ed2-4a3b-9050-58596428394f", "value": "9E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "a0aac1cf-f65b-40b7-90f3-ced99800e6c9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "534eca9a-49c0-4118-91b9-3f80c123a218", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621533003, "uuid": "bfa709a5-c448-4360-969b-2ae317ec1f5b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621533003, "uuid": "e738820c-4fe4-451c-b693-a38736a442b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621533003, "uuid": "878ce266-8531-4ab4-814c-4e1d0a01e2a5", "value": "f546bba9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104e5e47-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621539986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539986, "uuid": "06e0b4c6-e383-4a33-bac1-cb5e1308bebd", "comment": "Malware payload", "value": "c471c617d21a04d8bae1a32209e95aca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539986, "uuid": "d20e6fcc-0fe8-4310-8c3f-55a5f37a5baa", "comment": "Malware payload", "value": "71f1f470e692401d607f7cd56f1cf98b4cd56e123d8247d83e3ca3e8c2e6ad35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539986, "uuid": "507a7138-be03-4798-a408-a777faf8ad10", "comment": "Malware payload", "value": "d688e8280c1fc7fe6f39f66bc0aa345dff392039", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621539986, "uuid": "9cacbfab-67ca-40ce-9b06-aee3cc2b10eb", "comment": "Malware payload", "value": "fe4821200264babb1fadfb664af622fa4e690777ee90706ceb1a59e53a2e1a12c12feaf5825c613a08f014e8d74283d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539986, "uuid": "db5e43bf-0e21-40ba-91e2-08fbffa9acbf", "value": "0C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539986, "uuid": "c6d5f1a7-3845-4669-b15e-fce0cf8d8453", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539986, "uuid": "b3001356-02b2-4d25-ae07-4396db65ae4c", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621539986, "uuid": "86eb0443-725f-43a4-8238-c3bd8f797ae8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621539986, "uuid": "7f138b02-d745-4714-89b9-99f036c223f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621539986, "uuid": "3676ae40-68b3-4589-8e43-505f1e84fa16", "value": "c471c617_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53dcd93-b917-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621479704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479704, "uuid": "5a135b75-590b-4eb9-88b5-e4a1871a2d58", "comment": "Malware payload (Dridex)", "value": "672fc5ee1dd55859a77e822a452ce59f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479704, "uuid": "3b7bb131-b35f-4b8c-a115-0f49b26d029a", "comment": "Malware payload (Dridex)", "value": "71fa79e4085ac28ed66346ab68737b28265d43255b42c51fc1c4fc3ae39312a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479704, "uuid": "5c218554-03a7-4dae-ac0e-4725ec73b836", "comment": "Malware payload (Dridex)", "value": "90b69a32ea07feaf716790df5f294e43c27b359d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621479704, "uuid": "83695aec-c200-4dbb-8f69-5e1b8e8f4588", "comment": "Malware payload (Dridex)", "value": "2170cb183076088cfa207e5c8b28046c592813a8c7b2a36dba876fb8d4ec425a653043a2239e9068c4379a4280109abe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479704, "uuid": "2c598033-2ffc-407a-82b2-ac75b37ffdf9", "value": "7C04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479704, "uuid": "1e6056c4-a706-445a-9a90-dad5cdf0342d", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479704, "uuid": "5ca7c533-d1d4-4957-88c0-4cfc31bca5c7", "value": "3072:YWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:YWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621479704, "uuid": "21bb3fca-5a53-42bf-99b4-ace8d6eefba1", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621479704, "uuid": "ebe8d4bd-77a9-486f-933a-88e1d909c3e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621479704, "uuid": "d13b401c-9952-48c4-9df5-8be9f3de1902", "value": "672fc5ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448399d1-b9ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621543080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543080, "uuid": "4b302d1e-75d1-47ee-b8fe-b821235c1d98", "comment": "Malware payload", "value": "9906b45cf3d984b36a6978a6e5436c60", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543080, "uuid": "8e908b18-cc03-497a-acb3-a37ceff9dc3f", "comment": "Malware payload", "value": "7202864b7a85763a8e61ff41e18a38f81ce68e9b0b8bad0d836a3459df9cbc17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543080, "uuid": "e97afea7-3831-4f39-8f7c-88bcdd693440", "comment": "Malware payload", "value": "a812fce47b80995e0d51de42905d2654af811e8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621543080, "uuid": "032e6155-d01b-4466-acfe-e69025e4c2ca", "comment": "Malware payload", "value": "c170ded6af837a5334d7d07e7f25f6667e4f2acc1e21ae17f02254d24c3c4003a58dde85440903a07526ca78a0c580d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543080, "uuid": "a3698b35-f2cf-4b47-b6fa-b34a81d46e16", "value": "21F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543080, "uuid": "e9e69f2b-0cdb-43c1-94aa-63641fce025e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543080, "uuid": "a95af45f-9150-46b7-800d-433fbcca4bb5", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621543080, "uuid": "e167bbd1-2182-4a5c-b9ce-4a8b74cda2f7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621543080, "uuid": "857a848c-917c-44af-8199-a3b98dc332fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621543080, "uuid": "64375e7e-4283-4529-ae6f-389afb3634f4", "value": "9906b45c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0df1094-b906-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621472449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472449, "uuid": "9f14d469-28da-48af-a6af-92c5cd4d11e1", "comment": "Malware payload (Dridex)", "value": "a4baf2e6daae3b913940a0d467fc48fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472449, "uuid": "e5f74cc2-cdab-4a93-8998-699ce9fd3f36", "comment": "Malware payload (Dridex)", "value": "72407f5dd5c50f2c78db0c857cb5cba68c490f138161707bd4972f6ad777968e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472449, "uuid": "29266839-9fd6-450f-8524-b5fe54eeb55a", "comment": "Malware payload (Dridex)", "value": "4c789630758f173e7f1f14ec070275c2300d5453", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621472449, "uuid": "b2aded57-0f71-4c59-bc91-56f3e05532e1", "comment": "Malware payload (Dridex)", "value": "3605e207bb4b2ba57fb837e00b300b1bbba9f2feb2f71dee4cbbf1252c30e86f384add64d183b210f17ee0ecf61dc1c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472449, "uuid": "71410811-3700-4e88-a290-40188a6f1486", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472449, "uuid": "b692987d-3956-4e48-9728-eb55547bd3e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472449, "uuid": "d23f69c7-25da-4d42-9b0d-249e33319fb2", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621472449, "uuid": "c4ba1fef-2061-4ec6-ba0d-215ba4cf083d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621472449, "uuid": "9637ecbb-06db-44c4-ab1e-15b6e78bc522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621472449, "uuid": "6f818571-2199-4aef-b195-c7c68931e5ad", "value": "a4baf2e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee04f2cd-b987-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621527902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527902, "uuid": "d0cb6675-4857-441f-99d0-173f3935284a", "comment": "Malware payload (Dridex)", "value": "c3aedc2b3356a7f8eab771c0a793739a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527902, "uuid": "9bece5cf-1334-46bd-b3f6-9c42434936aa", "comment": "Malware payload (Dridex)", "value": "724c8ce87d2c4f8def42bcde808f14296f364c7adc170b4f89e15c520d87c072", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527902, "uuid": "cf6cb6df-307f-48af-a228-7ba017f96662", "comment": "Malware payload (Dridex)", "value": "61ff52534cd8739be6e254c522dc31f0d57b1dc1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621527902, "uuid": "03c8c853-2358-4949-8533-58e5cfd2f868", "comment": "Malware payload (Dridex)", "value": "e6429ed38639dd12f9bf2d2d0663406bd495bb4856ebc945fda3c40fa59ac78d4f1a55b534d3ba31b6d82087223fd4c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527902, "uuid": "2943e483-c325-43df-8abe-367cf3471cdd", "value": "DC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527902, "uuid": "86be1d98-bc36-4f1e-8df8-e7dd41f62b48", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527902, "uuid": "1f8c4983-6725-41b0-8f79-b1c9d32bac11", "value": "3072:UV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:UV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621527902, "uuid": "41bfadd1-9a4f-45a2-b199-c81ae0d94e42", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621527902, "uuid": "cd359409-349f-49ab-9178-1f139fef341e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621527902, "uuid": "62e8fd62-6b16-4d31-802f-611629626029", "value": "c3aedc2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bf85f2-b99b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621536348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536348, "uuid": "b778f0d2-d9d2-4bf9-a816-fefdc9898efb", "comment": "Malware payload (Dridex)", "value": "914461dc21e694b3ed6cabcea1d130cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536348, "uuid": "de6a1e76-8ca8-41c8-8dc2-ab750c48bb0c", "comment": "Malware payload (Dridex)", "value": "727434d3f9fde411e285ffa33e6cb6e4f14185a01fda26d8300cc171c9dc2b24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536348, "uuid": "d4ef86e9-2dc1-49c9-a7f1-45ec875e399a", "comment": "Malware payload (Dridex)", "value": "3f644962c12b2405fa509e4db0d7305ff31d7012", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621536348, "uuid": "db0fc4b5-3f12-4675-80e9-e60c0ccc9656", "comment": "Malware payload (Dridex)", "value": "13e0cf00ffb3ca10ffd371264c5a045f8aea0dbff093a35c5de35bf637d1951104893f4cb351757ba7c7365cb7a9dac9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536348, "uuid": "d8ffe4ad-45e3-46f8-9a59-d3ac641a6218", "value": "B804B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536348, "uuid": "cf629f65-e187-4cd3-ac16-c4b2c95affcf", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536348, "uuid": "6381a9ad-3426-4af8-a1cf-d1de21583cff", "value": "3072:iWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:iWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621536348, "uuid": "c2c42895-b81b-49a8-bd4c-e45639462081", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621536348, "uuid": "8bc67dd3-4d4e-4591-883a-3af3685ec482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621536348, "uuid": "692ffca4-7f11-4cd1-96f2-2178fb46041e", "value": "914461dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b021f7ca-b98c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621529946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529946, "uuid": "f19086a5-21e8-46ac-8cc7-50484132380b", "comment": "Malware payload (Dridex)", "value": "594990333b4e6c015878b88951ae3827", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529946, "uuid": "6b975652-e7c1-4355-9331-fe9f135c7841", "comment": "Malware payload (Dridex)", "value": "728676e615a138499192597dee7602e88491930f964aef6b1d1e4bc466227d9a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529946, "uuid": "088414bc-f929-4ff5-8d5b-ecf1db7207a8", "comment": "Malware payload (Dridex)", "value": "fbb730a4f5b378d4ffe7aba4f23064189a67a7d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621529946, "uuid": "e2adc3bc-4316-43e6-bbbc-35c72fd983a3", "comment": "Malware payload (Dridex)", "value": "8783885f0436594e8dc722c6922e1b6bb6b87ba119373398d7ec24521d87d756079ed71fa2ccce28dc458bf52ca6cd21", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529946, "uuid": "c3d97de9-5e6f-4a0e-8c95-5cd88f570473", "value": "4E04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68ED282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529946, "uuid": "c489503c-01e5-441b-9cac-2646691797a4", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529946, "uuid": "ca44df22-4e45-4e31-964e-7c9f9e1dbbfd", "value": "3072:ki49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:kH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621529946, "uuid": "617a62e1-4644-478a-ad63-254f4bdc3568", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621529946, "uuid": "fdc2eab2-06a4-4888-ad6a-d38e691af1b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621529946, "uuid": "8f6ae080-d784-4c77-8362-59623c9c4421", "value": "59499033_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaf101d-b991-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621532200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532200, "uuid": "c8967e1e-0d99-42a6-8006-b8a440bdb52b", "comment": "Malware payload (Dridex)", "value": "9d7139528ea47c8a025fa45080369dca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532200, "uuid": "9afd60af-b331-4b4b-be0f-5ef557a2d3ed", "comment": "Malware payload (Dridex)", "value": "72e58ca1fe97a9a9b8f7821304d44c5b45861a28116e738aa357574a922f2415", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532200, "uuid": "a5b33739-2fa8-41d2-a537-28020af91119", "comment": "Malware payload (Dridex)", "value": "e64ad98834c64613ed521fa09960b08f584b8de1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621532200, "uuid": "c3a49d0e-bb34-487c-b0ff-839f56cd9395", "comment": "Malware payload (Dridex)", "value": "02424ccb8b10d7618318941b048fb2eea456498658cc8b65fd410f13ed08376e1030df5f66bb3997e0682ee6d6a9d07b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532200, "uuid": "6f287e44-5da2-43d4-8815-ffb6f95ade8d", "value": "E604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532200, "uuid": "211299d3-b9bc-475b-b94f-387c1cbfc566", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532200, "uuid": "79713aac-f019-487f-be41-e7e5d4baa84b", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621532200, "uuid": "5b77178e-3373-4609-bd16-42ef480536d4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621532200, "uuid": "8ca823cd-4041-40fa-b892-356170a41774", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621532200, "uuid": "54ee30ab-7fc8-4afb-8384-2d79e435e2bd", "value": "9d713952_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc0c1dd-b9a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540193, "uuid": "3dc4ecea-e0d9-4fad-8193-f01c22fb8950", "comment": "Malware payload", "value": "a3e64ac0dc1b3e83fc5bee8c47c9c461", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540193, "uuid": "c98e6e4d-4e5f-4f2d-841f-5e161a03e8cc", "comment": "Malware payload", "value": "736be9cf5dedd090e95595bfd3531632f7429c9cea6b966c86b07bd1279342ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540193, "uuid": "68499fb3-8929-4502-ab8f-d46ef193caa7", "comment": "Malware payload", "value": "74f0326bab39048c49782a76c7a9d4e51c94a7f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540193, "uuid": "bb0355e4-b3bf-4ca9-be5d-895674cd320b", "comment": "Malware payload", "value": "e63fe0a26618b26c2446bcd5da4b589411e275ab4e0d78f3870f8c0ba18d52c2792f9043954c38a48af5e0b8753c6f32", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540193, "uuid": "89c671d3-d2a0-45f9-9e8e-b8d300842a88", "value": "7404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540193, "uuid": "0eaafe5a-1138-4d6c-aee3-2f38956f767f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540193, "uuid": "d9e570e0-54f1-48f5-9e9b-519d1b1684a6", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621540193, "uuid": "1076da63-c9d1-4bc8-8f39-a364e347a2e4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621540193, "uuid": "32f66ab8-3823-4d7e-a6d6-599ad07efa9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540193, "uuid": "f993c3fd-7c45-405d-b9d5-7d31e7ee0ba9", "value": "a3e64ac0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1affa9b-b9a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621540794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540794, "uuid": "7be8d304-73a9-4e5a-a7ea-dd4b396a6f51", "comment": "Malware payload", "value": "7f9f979681b8b25a21d8abb21f9ed1a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540794, "uuid": "e8f1bcab-476c-420c-9c14-a5d3aee873f8", "comment": "Malware payload", "value": "7383d63319dc55db188f532c18aa932aadaedbd4ab3d93f31b2cec693366801a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540794, "uuid": "89ecc915-9b4e-439b-9988-3fdb8c16899d", "comment": "Malware payload", "value": "9df5487b635a0bbe6b864f5613048226a133c25e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621540794, "uuid": "7c7c4a45-5553-45cb-9ae0-a38ae032b108", "comment": "Malware payload", "value": "c65f945d11a7404c16ed567606be28fa2b4773b07a070509981d2e1da77063953932eac1afa9c61db832161cf184cb43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621540794, "uuid": "d1ecec25-d354-