{ "Event": { "published": true, "date": "2021-03-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-03-29", "timestamp": 1617062582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "40ffc7ef-7cf9-4685-819f-8490e5878a98", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3269882-90c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617047267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047267, "uuid": "c3131a0f-acb2-4888-867a-9630bb058395", "comment": "Malware payload (Dridex)", "value": "f13e6e958f4764b269daa240a747c845", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047267, "uuid": "84476dd7-7935-4a76-aedd-fb8664294095", "comment": "Malware payload (Dridex)", "value": "006e592f760a87219ad92ca26582ac07d3b3e71f9f529396266c310e893e634e", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047267, "uuid": "a657d5d4-a212-4ab2-b71e-9d56309a3ce6", "comment": "Malware payload (Dridex)", "value": "7e7db65c3a77a4585be520a4a8a45dddb81ed18d", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047267, "uuid": "e371413e-f003-48ab-8364-e2d040487f97", "comment": "Malware payload (Dridex)", "value": "34d4f4bb25f5798893d4599e89520b1d7f3c2757f3a835c214ee21ea650fbe27410ab07e65f59d8dbdfb6b909bbf621e", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047267, "uuid": "c77b4f5d-43c0-496c-b604-d3fc281ecaea", "value": "E8C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047267, "uuid": "d1d6d745-3566-4ee4-9c4d-69e9540594f2", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047267, "uuid": "4ffb982a-c7ad-4f0f-bb75-372d4fbcc9cb", "value": "12288:Gt+D1yz/1SXpqDaoWmwsFRHk3eBWIc/d:GcA1aLoBHgeBjc/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617047267, "uuid": "de0ae3d2-eb1f-4f6d-9287-016d4d59b596", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617047267, "uuid": "1c0b9800-a246-492a-963b-3173151a3597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047267, "uuid": "1320a922-beb6-4b27-80d0-a384eee48502", "value": "006e592f760a87219ad92ca26582ac07d3b3e71f9f529396266c310e893e634e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842019e0-90e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617060959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060959, "uuid": "9294f1b1-74c8-45a3-92a2-dc50afd779b1", "comment": "Malware payload (ArkeiStealer)", "value": "e1edad05494a14cefa05fa28c3611a6e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060959, "uuid": "984039bf-f77e-4ef7-b755-1992d568a0b1", "comment": "Malware payload (ArkeiStealer)", "value": "00b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060959, "uuid": "0171c2c0-1d67-4f5b-a2b8-20af363fd529", "comment": "Malware payload (ArkeiStealer)", "value": "718fe9cf4e4a7272ffa0583c0851e3134d6f1547", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060959, "uuid": "5d55048c-aafc-427d-bcc7-78bb2529bdf8", "comment": "Malware payload (ArkeiStealer)", "value": "ed31801981a32c0843a9ef5baf9c778b27501033e065e584854b7cb13ac54634fe61df74b3727ea3d0ae92fa5e844cfe", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060959, "uuid": "0081add6-8909-4ffa-af08-5fdcbfe0ebb5", "value": "75B40200B5E5D137C5672A704826D2B04A3EBC659F324BC76B887B695E316E18B7B333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060959, "uuid": "2de5eb8f-55c3-4970-8bf3-7286b06eb0a1", "value": "1b9a4302f0d59f5d4c40f6b7b971caa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060959, "uuid": "a58e849d-d292-4acf-8733-8049e1aac99c", "value": "12288:lxzipgnsyBP68w82zof4BUcXVTQaUe4CZ5cktLCC:ljnQ8X2Uf4K+xp//NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617060959, "uuid": "ef32788b-d710-4cbd-89bf-f1cbd51726c9", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617060959, "uuid": "45aeaadb-b00a-4228-a9fb-d800043f76d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060959, "uuid": "1b91bf71-bb76-46a8-b1dc-be449ba134b6", "value": "00b09aba4c90b634ce887da826fc74284f171698c203d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66344041-907c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617014952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014952, "uuid": "e4c4cfbb-a504-404f-ab02-f69fc57882a2", "comment": "Malware payload (SnakeKeylogger)", "value": "381f22643ced782ca7e5501ceed056ce", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014952, "uuid": "57768e9e-739d-4bd7-9b9b-37822ea36ea5", "comment": "Malware payload (SnakeKeylogger)", "value": "00ca19d95b18e4787718e0246321847075c567d5a7c3c661e7ce06b845a20dd5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014952, "uuid": "6a43c47c-be86-4b44-b965-93312eb3714f", "comment": "Malware payload (SnakeKeylogger)", "value": "1f29fafa19a5a1b4b6cb867d47d725ce9670e67b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014952, "uuid": "82d41429-87ad-4e85-9178-c5798d92ca05", "comment": "Malware payload (SnakeKeylogger)", "value": "3bfece68ba8b624390fa14434e285cb39d9b84446a6d2fbaff94938fce148f295eeecc9b43d6307ea772bcdd9431ae43", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014952, "uuid": "59fa9c10-bbc4-4c66-b3a1-b1a5e6303bd0", "value": "93D4E0E958895601D91754F18D47DB7133AF7E2E896B8006B7EBF6CD8C2AD839C13207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014952, "uuid": "2a5a874b-8d99-4c21-afe1-4485db782dc0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014952, "uuid": "c24a4a91-9d1a-4c0c-8515-182d23f44b01", "value": "12288:b61f+x32v9JW8RFCm1AbfChY9P/ohofe/XzQ6V0cKUELtPw+:m1f+F2J65p1/gEmQ6V0cKUEJw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014952, "uuid": "7656c475-3869-49b9-9164-af2b302ab96c", "value": 654386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014952, "uuid": "ccb205f2-152d-44ba-8712-f930e56370a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014952, "uuid": "8abc9c02-d73e-4e7d-a0aa-c37cab95e7d2", "value": "Part List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195962d4-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616997644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997644, "uuid": "f1f36c14-dc9e-4ad0-82d4-1aee8d757500", "comment": "Malware payload (AgentTesla)", "value": "2045baa6df39f698d3a1f419ee82cf10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997644, "uuid": "19a9906e-d3d4-4223-8132-3e5bd07dba3c", "comment": "Malware payload (AgentTesla)", "value": "0163960cfc461069c75f660b910978c0acc5c94ef547f0de9e5a12aae2c1f3c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997644, "uuid": "1cf2f32a-c119-40e8-9c62-f0cfd8382960", "comment": "Malware payload (AgentTesla)", "value": "82a707f3547d3920c092e3033caefd8189525783", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997644, "uuid": "ba2889f5-34cd-479d-a69a-471155378ea5", "comment": "Malware payload (AgentTesla)", "value": "43a8ad1bc66eecd9f79066bd2b3d9819b3b2825a3aa1d463b6592f83f859c57fa0afcc62227396bd465029907c171174", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997644, "uuid": "79f65bc9-0a61-4a9a-8dc9-c891a3bc252a", "value": "E2C5338F6D871B47D43B8DFD98A6456E6272CD04B9068F05338A3921A17377A53E1F2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997644, "uuid": "465b6a20-8f90-4012-94e1-734a49aa92cd", "value": "49152:TF4XVv288cQCkktIbM+RtsyDVFbg4yOMtMa7/zpABa5fLsmI/F:TmOBfsyxt3DVHynBABcg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997644, "uuid": "6d4a582f-f32f-441f-9eb1-f126124c872c", "value": 2694656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997644, "uuid": "19efbea7-053d-475e-87ae-6ea7af45c2cc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997644, "uuid": "5c980d49-ec40-4608-9b59-a7cf686e90de", "value": "BA_Invoices.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319c917f-909f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617029897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029897, "uuid": "06e12828-58ab-4dde-92ee-e71b31209766", "comment": "Malware payload (AgentTesla)", "value": "7f3f01ab211d046a76dafd5b486e4d3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029897, "uuid": "98118adb-5c0f-4824-8c90-995f3c3ca5cc", "comment": "Malware payload (AgentTesla)", "value": "02547e4aa7ec66f8f90c3c48719956a48961ed3706fec0204f0cd29d4ed9d14c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029897, "uuid": "cd2e50d5-66d1-4f38-8c86-050cc190202a", "comment": "Malware payload (AgentTesla)", "value": "aae9ee57637b7b22633178099aef1f241b4bd813", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029897, "uuid": "81ebd2bf-f7d2-4c45-90fc-8f87165ad81d", "comment": "Malware payload (AgentTesla)", "value": "85af75858be9418c0fca72d22343796291342946aa0692acb4a69fa10efcf72d185ef3446e0200f1f9cb109137d38139", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029897, "uuid": "f68af0d1-f90f-49ec-9129-6dec576e4e8b", "value": "31B423DDD4DA674ACF82939F618E8D90AAC3C2BE6CC2C963E4AF90B51F03D5154C5623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029897, "uuid": "0ce0df8e-32d4-4b3b-9aa3-fb73d9d71473", "value": "12288:l2uiikwMm10X5dnx1y+ok4+888GO99wu0mVq1sQSwvbg:l2u4Dm1U59C5V88Gw9wu0kq6nwDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029897, "uuid": "023ca8e6-2bca-4e59-addc-46bef8b47436", "value": 540338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029897, "uuid": "db696a3e-df02-4974-98a3-d94f291e38b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029897, "uuid": "ac139ce0-bdc2-475d-a820-157cbfaf626d", "value": "Encrypted Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1effc024-90a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617032872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032872, "uuid": "35de3334-c76b-4177-974a-2df1f7267a94", "comment": "Malware payload (SnakeKeylogger)", "value": "e9b09dc0283a05c415967a5f9fda77b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032872, "uuid": "d38a99a5-97c3-477c-8222-507be96920a2", "comment": "Malware payload (SnakeKeylogger)", "value": "0281a1dd2e7c08858776b3b3a568752bf1ade2d2f1691a3c8de99da4c5448eed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032872, "uuid": "32fb190d-813e-46e2-b4fb-b54663ea82ed", "comment": "Malware payload (SnakeKeylogger)", "value": "1a547fd352690175b56c4de61760ff8e4b3b235b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032872, "uuid": "75501b69-a1ba-4f10-b927-6f8808971ec9", "comment": "Malware payload (SnakeKeylogger)", "value": "a4bd284f08267800438140f8a05913891de2053ffe39f1f5dd5a23a5478791e00e7874b2b0c67336c77d13efe85a5627", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032872, "uuid": "0d7e9a7c-bae3-45df-b149-b01704fc3d0f", "value": "FBF42337275198B8699B4E5C3A3D3D0A820F137667E163E35B4F2EC8433A4F667A5270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032872, "uuid": "3f930d08-5adb-4eef-b092-31d0268e44f1", "value": "12288:insL1b5/4beJkTwCip6vgf44+vTasf0ZzsNLXig1sN1biXrpBblFuoqSs7b:AsL11gbeV8gfXuTRsZzsNLXig1UUbblu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032872, "uuid": "59485292-1a52-4d21-93d8-1362f96f053d", "value": 751476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032872, "uuid": "63aae81b-c17b-457f-8eb0-a94be3eb8aea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032872, "uuid": "e9d80216-5c24-41a7-bcad-41a27684c04d", "value": "INV0000075.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa08eff1-904e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616995444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995444, "uuid": "11cdf338-76f8-4b31-b53c-9417f86a581d", "comment": "Malware payload (Formbook)", "value": "ccd96bec82ff2fa89b457246cb340edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995444, "uuid": "d8bf3bea-58a9-4363-8b90-bc5162e07f74", "comment": "Malware payload (Formbook)", "value": "029f8f91cce35bc2b66f10c473237024d772c4643e30b9a10acadfe3ce6640d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995444, "uuid": "f369d39e-aded-4799-b839-ac0f40a59f24", "comment": "Malware payload (Formbook)", "value": "4dd3ffea150d4d79d61b4c2fc31e3a801cd723a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995444, "uuid": "e4b26dd9-abdb-4fc8-ab83-29c6223b66e6", "comment": "Malware payload (Formbook)", "value": "d567570a9e98e14a8762fe3b9fbefd9b191cc5ee7d199cbc58f016d59b7ab6f2f371ec678fb51087a2becf21c42853e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995444, "uuid": "b732a0a4-de94-4b00-a55a-e228922b5d0d", "value": "B9044E83B94C43AFDB5CF93274796231A0599FBB18014A47B8CEDCBF8C3659E19841DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995444, "uuid": "cb35fae3-341f-4640-92bd-f89828e83998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995444, "uuid": "ce8c9f43-81e2-45f1-9cc4-cbf02bc8c80c", "value": "1536:Oa16YkWRGrVCiowPxUQBnVtGr2tUzOrS0U5eBKMNlJfSg5IqywKyLDTVZ:96Y2MPwJpjGahStlM3JfjpzKyLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616995444, "uuid": "6a9cbfcb-233b-4639-92a1-c37bba7e46c3", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616995444, "uuid": "6148db53-f464-4825-a4f8-8d8351da6a92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995444, "uuid": "05074650-3b7d-48f1-80e9-ffa7bfe9d070", "value": "BIOTECHPO960488580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62cf809-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616996591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996591, "uuid": "e69f125b-b9f7-48a8-b560-74b14d4180a3", "comment": "Malware payload", "value": "ed3dc38f72f8953452ce1ee8a8cf4f80", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996591, "uuid": "1cc2389c-6f01-4dce-93f7-b5b9a1856ac3", "comment": "Malware payload", "value": "02a1c7bef25ed4a534db3c632e4514a36834b8550064ea2bce13e7fdada64a8b", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996591, "uuid": "6088413e-7191-47d8-8c66-c94fdd362621", "comment": "Malware payload", "value": "d9d6f8e610e3172870a24983da8e72344287010d", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996591, "uuid": "4de46537-d982-41d0-aff2-585f15947750", "comment": "Malware payload", "value": "de88693e9b9a9e9f74fc7161d0bc4c6da12640b6e4cda14a06c71671b94318f52ee442ac4a4e9713d9a87db0912539d5", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996591, "uuid": "e6af26db-de44-4525-beaa-88266d1c7792", "value": "ACD2F1F1D3BC66569D628BBEC51AAA14AF45A53186EFABEE2C3010793743364D70201D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996591, "uuid": "89b49972-8b6c-4122-a8b2-03d3921b5bd0", "value": "768:XSRWYHza1qceZa696VHAukpBi3iKyfdG9Rg/xf:XwWqUNeZ1GjyBi3iLf49RgJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996591, "uuid": "49e7a586-5c0c-4ab8-b4b2-bb4b633c8602", "value": 30696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996591, "uuid": "1630ef66-2fa9-47ac-ab1f-40478aa14c96", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996591, "uuid": "82fe6cd5-e413-4b9b-a167-a2ec693f4ddc", "value": "New Order Ecandes Quote-PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a57b1a-905a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617000558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000558, "uuid": "8999108c-3e8b-4dab-a98c-db7fee1d2f09", "comment": "Malware payload (Formbook)", "value": "69db0d3945c083ac88b0f5a391a36e03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000558, "uuid": "5fa4f46f-ba21-464c-ac0c-25d2af2ecc97", "comment": "Malware payload (Formbook)", "value": "02c3598e5f583ac0f0aa5d5c666095d1ab1cd02ebf8d23ad7db61f00da7b793a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000558, "uuid": "3dda7090-88cd-4d60-9adf-d04fcdaac900", "comment": "Malware payload (Formbook)", "value": "55bb99f87b8e558f940f17b14367c0c919bea83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000558, "uuid": "a58c03b0-9634-4969-b021-23e4cc04bd12", "comment": "Malware payload (Formbook)", "value": "3662303b73bf0748536b10e33fcebfc69f1fe8c57af7570870f5d5bcf0b5ca4744c3aeb6e56b8b2132bcd0bdf599cbc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000558, "uuid": "db5f610a-71d4-4244-bb21-28b57ac257cf", "value": "35D4818C5D9DC1E6E6354BB842C9C4EB46EB5EF30F22C879B9C68BC7E020746E506536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000558, "uuid": "0c5e8fde-184d-4284-85ac-5169921f9a73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000558, "uuid": "43582f7a-2794-4f46-a972-f50fc09eaebf", "value": "12288:XalzzAjsHyWWS7FagL/yo2+7KWcWPdRn:XalzzCsHuS7FagL/yoCWBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000558, "uuid": "61840d75-1781-41b4-bd73-c8e3d8d77745", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000558, "uuid": "fa0d1a48-92a9-4f46-bd17-346506d73615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000558, "uuid": "5cedc235-cb88-4827-ae4b-df9c1552db3d", "value": "032921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc61d12b-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031525, "uuid": "be0e839e-44aa-4263-b34b-dcb0c012f58f", "comment": "Malware payload (IcedID)", "value": "8f66ace431f6225b04205ac1dfe3188a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031525, "uuid": "ce1a06c8-76b6-4150-8734-2eca1e96e6a6", "comment": "Malware payload (IcedID)", "value": "02d6867e3f785085db2cb88fd34ff884f906e40340578d48839ae82eb1dd9943", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031525, "uuid": "1bad79ce-8cc2-4a44-b234-24b377b151e3", "comment": "Malware payload (IcedID)", "value": "bc3e568b1bc0f3d1f2989dc57c0444827669bfab", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031525, "uuid": "0376ddca-c2dd-4575-b2fd-6ac14e709365", "comment": "Malware payload (IcedID)", "value": "cd3da300e72fd465b4dc9cf6d932fe712f424b66a358a12a378c3cb8273d6595f3385a6e6b4852ae10a806a6e4416aec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031525, "uuid": "a79c68fb-0767-4c13-9fec-c494f96a71a6", "value": "62B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031525, "uuid": "c14b21cd-965f-413d-9ad2-21d86a39376f", "value": "3072:s26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:sLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031525, "uuid": "a575bcb6-cda1-452b-bc52-75e68bdf6a31", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031525, "uuid": "6b9542f7-9171-4466-aed7-17926c179a67", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031525, "uuid": "efc3a7b0-4888-4302-892f-074ba979394a", "value": "document-65789758.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f963183-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617001520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001520, "uuid": "fc2dac15-1175-41ff-b9f9-f504aa41f57a", "comment": "Malware payload (TrickBot)", "value": "15538d294d459145a017161d68313242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot69", "colour": "#83E1C7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001520, "uuid": "05a903d6-b005-4e7a-87cf-a0657d7d048b", "comment": "Malware payload (TrickBot)", "value": "044fd5b1175fc56b4e42354c98ee0c2421e09ec10c3abbc362cb194a51b365d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot69", "colour": "#83E1C7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001520, "uuid": "c0fa7cf1-8ffa-4846-baf1-c70b174c674f", "comment": "Malware payload (TrickBot)", "value": "6742323af8e9fba4a68552aaa0513388bbdb3997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot69", "colour": "#83E1C7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001520, "uuid": "205fa83d-6174-4e66-8307-c32e438ef56e", "comment": "Malware payload (TrickBot)", "value": "375ecc98ebdf9edbdd531fa09a0bf39334ae92bdba2ccac28e48696eafbb11b2df0e1e76b5700605a9289644572ac17a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot69", "colour": "#83E1C7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001520, "uuid": "eb22548b-f626-414b-a8c0-deee8797a35b", "value": "68A4BF2936839036D5EA103059E146B50E3BBC6935EDC287E7DC33290AF82D19DE777A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001520, "uuid": "6ffcbb95-18e0-4140-b207-f11a754d8cc2", "value": "7369f42a7d3233a0f0034a71d3128264", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001520, "uuid": "4f26b796-0e7d-4104-ac50-8f6e15184513", "value": "12288:j3jAzpcTZkW7FP7cUnHv95h5AP5IjdUr3:j3jCaTZdd7cUP9P5AhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001520, "uuid": "5efe47b2-5468-41b4-9d5c-91d1e9e86c91", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001520, "uuid": "30ee847a-bb5b-46b9-86bc-4ba507cca018", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001520, "uuid": "3b89bedf-452e-40b9-9322-789885f3179a", "value": "15538d294d459145a017161d68313242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1db1773-9057-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999215, "uuid": "b6760a7b-c1aa-4ebe-8c68-063b5d41a0a1", "comment": "Malware payload", "value": "9c5c6f51fe19895c4fcf027282e0d833", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999215, "uuid": "0a5bc185-9bef-46a5-9b6e-e9d9bcc626f7", "comment": "Malware payload", "value": "04e677f4c0b040340e3cb3ac1c15ecea70d684ae70ac04eddf938df99b9c52dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999215, "uuid": "d59ce271-10ac-4f75-8c51-812d97bba804", "comment": "Malware payload", "value": "5b83cc466465cd28ed7b08a72a4fe4262deb4336", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999215, "uuid": "c7c7ad2f-5bb3-49cd-96cc-35f9c0ef795c", "comment": "Malware payload", "value": "fc0eb06cf04b6abfe25f1150c80c63b915006da9c077b7a819b10bde0fa9a89ea97a913ec1da540a5c5ea6ff6e4c0692", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999215, "uuid": "53caca6d-6b59-42b2-a40e-5cfc167ea0cc", "value": "4274239B89626223CEB245A4D388E0D59D9494707836C4DBD0191B9FFB13F963F3798C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999215, "uuid": "e665aabb-ce47-4ab2-9312-dba45572f092", "value": "6144:eJhqk7k6cdyo/s6V+YzQulgtEeMJ8sMgySat5T2Cz2JUIwKCJ6F56Hg:eL77ZcdZPzQ3t9t7p2BhCJq6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999215, "uuid": "97e4a511-ee23-43d1-93d8-377c2e4baab3", "value": 343448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999215, "uuid": "f69f5920-c638-46cd-abe5-2d1bcec30c09", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999215, "uuid": "35003cae-ec6f-44a9-a64c-a7d334b48241", "value": "3100120000016-Proforma Invoice.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84502eef-90a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617033042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033042, "uuid": "f5b138ab-6e14-4dbc-a7cf-5bf03fc80b41", "comment": "Malware payload (IcedID)", "value": "e9ccb698f40782b140028d589addcdec", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033042, "uuid": "37b3ecbc-c5b0-4fe9-abeb-88cde0716564", "comment": "Malware payload (IcedID)", "value": "0509c2db06fdbae73497f92f5941c7c391f78fbec4b9dca79fbb57eab6df188e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033042, "uuid": "9ca0dc72-ddc5-4534-8134-3720ceb1aff1", "comment": "Malware payload (IcedID)", "value": "697d34a74ac5da154426b6ee0fbed43cd37bedd0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033042, "uuid": "831c3efe-4406-4cf3-b821-a67677cd0bd4", "comment": "Malware payload (IcedID)", "value": "44b8f5e9a76dc3283610aaed62f42b2dc202d4355342e96fbd81cc970d73cfc12b1880e29606fba33285097d9e04dabf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033042, "uuid": "208df1bf-4731-4913-90d4-73ea89daadc1", "value": "4E04122DC0568D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033042, "uuid": "116d5600-0f1e-40bb-8b10-8f7c500dea71", "value": "3072:Q3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:QnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033042, "uuid": "5fcfca75-344c-415f-93ec-b6c63ed8cc56", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033042, "uuid": "74aa94c0-033b-4b84-9aee-d6939d7ef540", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033042, "uuid": "aeb76a8f-2a71-4342-89be-5a35620f1628", "value": "Claim172979626403292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecd5d3e-90ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617035502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035502, "uuid": "9cb48b33-eadf-4271-b35b-aef39671eb19", "comment": "Malware payload (SilentBuilder)", "value": "7f82c7bfbb002ebb4f48580be9cb1429", "object_relation": "md5", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035502, "uuid": "9ead7592-a778-4674-83a5-30a539dbe4e1", "comment": "Malware payload (SilentBuilder)", "value": "05c1cc24508fafe66b32db07e2d31818f8a40c1b64e5901a84c8514b7522dab6", "object_relation": "sha256", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035502, "uuid": "974dad82-25b9-4812-9cd2-0c95e17061ba", "comment": "Malware payload (SilentBuilder)", "value": "ef59f7aaf99a3e9c6976304df81534130f688b8b", "object_relation": "sha1", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035502, "uuid": "22f3d150-3beb-4d13-b773-7e8b86160f74", "comment": "Malware payload (SilentBuilder)", "value": "14092f41d308a2cbb9ae7af7f6ceba1c6707c1d41d67c912c01a8ec8bc9cb4819180969a164d028f60db6159ce59a6d1", "object_relation": "sha3-384", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035502, "uuid": "0fffc0fd-8eaf-4058-85e1-b3622cc81814", "value": "30A412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035502, "uuid": "42a2d031-94aa-4585-bd14-2a14b80012be", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7B:dEKXJ0MDs8QTjVJVf4k4ZiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617035502, "uuid": "89d0f689-eeb7-4ccc-bf9b-1453556d6e5c", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617035502, "uuid": "fc49457c-4fbf-4bf9-909e-b60336c432f6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035502, "uuid": "a239abbd-1116-48c8-9aa9-1911cf2813ca", "value": "inv_1218166094_738270248.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3db079a-9073-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617011298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011298, "uuid": "da376104-a6bc-4321-9fcc-c135bee88e4a", "comment": "Malware payload (Loki)", "value": "95c2868130f4b1adace964c678c1600a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011298, "uuid": "fe2220ff-4003-471d-91d0-2b0d3171eb9e", "comment": "Malware payload (Loki)", "value": "05fde892732b9dc4d7e78ef54fd7d2ab28caa582afab008a4556909b47c831e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011298, "uuid": "e267edc6-0e62-426b-a568-e474e6343f65", "comment": "Malware payload (Loki)", "value": "83fc7e24dede4052d4af49da80fc45a0f4eacb7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011298, "uuid": "059232bf-ae4b-4a90-b805-dc891b472dd2", "comment": "Malware payload (Loki)", "value": "dff392f274c37a5c2cd26e5aa6b73eb8a86a1c787608ab14a0f0c0d8c6998f2ffc006f8fc06408b1fc47ce04c6592712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011298, "uuid": "2e56a615-f158-494f-8639-39a658fc6a0a", "value": "7AD48E63B7804C37D0671974AC1B4AE5EC35BF103D28A89B6BE86E0C5F7835179392A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011298, "uuid": "da36d2f4-f5e0-4910-b7ca-7581067d1bd0", "value": "1348df303efcafad50a6f5b8c3aa3e4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011298, "uuid": "eeb2669e-df5c-4cc6-be88-ae8e20d33d75", "value": "12288:fsOKEbAY0nluh0T5ZcxSO8Al/RbV5pg+s9GUsWx7YV:0FE30nlu+T5+fHRJODsBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011298, "uuid": "46bdccb9-c54f-432e-a93f-1849f4cbb949", "value": 633840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011298, "uuid": "b7cca0f7-2a40-4c0c-9cb0-d2a963f15747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011298, "uuid": "c25de9bb-dda1-4c1a-977c-2db3b03e5070", "value": "Order list 28-03-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e138c4-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617033373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033373, "uuid": "3152bc2f-39b6-41a1-a99e-930968f37421", "comment": "Malware payload (AgentTesla)", "value": "3e50c1003066a16e90bff64c6a1fab1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033373, "uuid": "3054f6d5-944a-439d-992c-e0c2681d6adc", "comment": "Malware payload (AgentTesla)", "value": "06c65dcbe23474e984fec25f7bf3c51b2f3b65939d793efde136184ccde2a746", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033373, "uuid": "8558676b-01f8-45ff-94a7-32bdd4a4ed36", "comment": "Malware payload (AgentTesla)", "value": "826b9e8db8010107a1a2afbec4c98d60d159f121", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033373, "uuid": "426d2722-fbeb-4e67-b234-63c02483958e", "comment": "Malware payload (AgentTesla)", "value": "ec9d71d4664a528fe2f0fde0dda91ade2b9be235d7dbd121a1d419402b52b8e4c91e181551b7fc9466dd919208a2bc2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033373, "uuid": "52a16d25-3f2d-485e-8ba8-5a79b30ad308", "value": "96D4235C372D8D94D5501B90F1EAE63185A98AA3A87CC84DE2CE162D4243D378397AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033373, "uuid": "ba890d0f-02b7-4196-9832-ad21efda662c", "value": "12288:D4P+H/ETBvUu9JopuXNGa1jKsItgyYGhl1VHcGHwXRA/h2m24oLG:D4WfETBjApv+FQYMVg2h2m2rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033373, "uuid": "2913e4f6-eea2-44c2-bd12-ac32b8fb4d0b", "value": 617857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033373, "uuid": "b590ec44-9147-40fb-9edb-068524bf7e0d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033373, "uuid": "9207b5cb-8fcb-4cb8-b5d0-040376abcad0", "value": "ECLISPE SUPPLIES-1212009300,pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2ce99d-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617029458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029458, "uuid": "09db70da-f12c-4887-94a7-e5af882236ba", "comment": "Malware payload", "value": "2fb1d85dcdc9b171dc34fe88ff77c7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029458, "uuid": "757b8808-3aa1-4f65-b0a5-55017eddad94", "comment": "Malware payload", "value": "0710672dfe6af0e591ebe5e06e4d1956bff1220455b8abb8a1b7d5cd644aaef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029458, "uuid": "f702987d-c036-4fc3-b0eb-bb69dafbc47e", "comment": "Malware payload", "value": "b8f7ddc8349c4187cf2cd8a85350589c0e3f321f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029458, "uuid": "d8ce6e7c-2129-4fbf-902b-4f697718e5a2", "comment": "Malware payload", "value": "d864a4a48547d969867196d6d7166e68fab2f56ad988cdd6875b79a32d857029eb47775f42801a048f4a1415ef3048bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029458, "uuid": "c065e40c-3701-4a4d-ab1f-6e41525e300c", "value": "1474ADD83AA9DFA5D97887F6102120550BF9EAEA1013DB8C4DC5F4DA2479F4C0EC9B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029458, "uuid": "6e2da5ff-e7af-47ff-8504-0fdce746c3b4", "value": "6144:fD2iyoddl1w+kI2LkF+7kLXk96SIA/H0zIcpj1HSlD:rddII2LkA7Uk90h3hHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029458, "uuid": "b6843563-8f43-4eb2-8809-305231194349", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029458, "uuid": "e469402d-c74b-437f-a5cb-935f406c0d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029458, "uuid": "0bdfef94-eb34-4a9e-a3d3-6b093a0ff6b1", "value": "FF&E Items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334e207a-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002412, "uuid": "612d4275-aa08-4355-b15f-8265fd4357a0", "comment": "Malware payload (AgentTesla)", "value": "6326460682d8dc3e0c2b9fe277582c9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002412, "uuid": "ef24e701-7811-42fb-8d88-d19722e730b4", "comment": "Malware payload (AgentTesla)", "value": "080c09578412d84fbe83dc59549d764c432c3f3b518b6b1d2d52d8d524cdb047", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002412, "uuid": "266dc7a8-eb60-4966-aace-7e183a2210cc", "comment": "Malware payload (AgentTesla)", "value": "19df4f42aaee0288b5aa9379f62c02193484b03d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002412, "uuid": "da4d00f5-8799-408b-ae82-f948757d5940", "comment": "Malware payload (AgentTesla)", "value": "621981572d5fc7d123ecef6217dadd8cae991e1fe491d380423d83d8a53b046650cd5d1e85baeb3568eea0143fba48de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002412, "uuid": "75c5aef4-a42d-4247-88a9-49b4b3ed12e2", "value": "BC454A8C1E99C2CAE2794BB891DDA49943F55EF38F22CC79BDD547CBC130B41E606622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002412, "uuid": "d9e8cebb-3af2-440d-8d50-3d0a9dcb6d3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002412, "uuid": "646a6b64-d13a-47a1-aeb7-632e9e74131e", "value": "12288:n/orBp8G+9FriR9wrcmvN5f8CxjfB/JENT3dff2VzlNPLB40hBDrPRFWTL:nCEcm3dpREF36zDTmEvPzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002412, "uuid": "d8e5d44c-ed6b-43c7-8c60-049b75b3340f", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002412, "uuid": "98048d12-dc8b-4be3-9315-025686028117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002412, "uuid": "77ae31d5-c6fb-48fa-83c1-c2f60aa66295", "value": "6326460682d8dc3e0c2b9fe277582c9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0a1e8b-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028193, "uuid": "40fed9ca-d834-4f8d-b03c-d6f26e266b28", "comment": "Malware payload (Dridex)", "value": "8e8be38c47af6f36fecaea41fa158372", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028193, "uuid": "35e35d8e-7516-45b5-981a-926c43bb11f3", "comment": "Malware payload (Dridex)", "value": "0851ddd066a8326000b9a9cde14c89d9ba628810c77dfe97a4712efad06b6ede", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028193, "uuid": "1098ae00-249d-4cd1-9a0e-096099ca6ecf", "comment": "Malware payload (Dridex)", "value": "4be70384378b012cdf76c749c6acb131debd0c82", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028193, "uuid": "8cb5f12c-4291-48be-865d-a4c517a58c01", "comment": "Malware payload (Dridex)", "value": "b397a88acb87a2c34719fa43427b84aa381bcb3e191c260e936453db80422886ab984c6bf58c3c59777cceb89f371a24", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028193, "uuid": "c4039583-3447-4a1e-91e8-cc4930ff3d77", "value": "D214AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028193, "uuid": "84bf39ac-3530-47ec-8974-cf1a06881c3d", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028193, "uuid": "4d26e757-2157-47db-9d21-9e292cf26ec5", "value": "3072:0pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:0BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028193, "uuid": "13382954-e171-4f1e-8e1f-33def3c2c8fd", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028193, "uuid": "ba3ce3ce-8e17-450a-8165-5bca48ffefdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028193, "uuid": "c6ae7525-af51-4473-8771-ed22654a2520", "value": "0851ddd066a8326000b9a9cde14c89d9ba628810c77dfe97a4712efad06b6ede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5420f2e9-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031243, "uuid": "9fa6fba5-df4c-4eab-a104-b1b06a6565ca", "comment": "Malware payload (IcedID)", "value": "95fb8debefd95e8a277efef9084cbc03", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031243, "uuid": "d3f7d59d-d27f-49da-9ca0-637c24bbeb5a", "comment": "Malware payload (IcedID)", "value": "092de9bffe7869c9b69fb09a26bf4b1b4203c1c76e93bc2cc195f3833a64f8d4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031243, "uuid": "0bb4233a-0918-45da-8cf9-c9f127b0625e", "comment": "Malware payload (IcedID)", "value": "eeb855a3b14b33c55414d75aee035d8566f5c042", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031243, "uuid": "4524910d-2f8d-4a39-a987-4343850d2517", "comment": "Malware payload (IcedID)", "value": "97797397bc155462b6140d84744a0f284397be48be8c37c69a04a9a805b3a3376bcfb47e33de105766f52b092180068c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031243, "uuid": "a64a2301-e8ac-400b-b776-ee174ecc5e2f", "value": "4DB3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031243, "uuid": "47692df3-93af-4757-9084-553967ff5397", "value": "3072:W26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:WLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031243, "uuid": "bcc66082-6155-4652-bc51-198a335e4c14", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031243, "uuid": "7345cbe7-36f6-468a-8ff3-d743c7071ff7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031243, "uuid": "98515c77-5c7a-44e5-8693-c01675fad468", "value": "document-1569269334.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82aa5a2b-9047-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616992237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616992237, "uuid": "e6aa1092-dda4-4b6a-9503-2058f4be9932", "comment": "Malware payload (Loki)", "value": "d963238b58f9a7e112ec6b9b18b6fbdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616992237, "uuid": "cf83d91e-8390-4816-b05d-b74e95094877", "comment": "Malware payload (Loki)", "value": "0aff6ce901818fd3fcb6797407af1815c78556d8e5e958ce991b4fcc0f273cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616992237, "uuid": "c30a23e7-5a26-4d98-8dd8-0ac50f1f4006", "comment": "Malware payload (Loki)", "value": "31ee8e5f8e42bff784e62927128efb6b85c7d142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616992237, "uuid": "8b99ac9c-edbb-4229-9221-1eef84502204", "comment": "Malware payload (Loki)", "value": "277d8c192543121b1cf059d063dbe10eea1b8701cf4892707224527e945b08574b2ffb83942511e9f95c315683f2426d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616992237, "uuid": "8ab070df-1b28-4922-8279-681b7c822e7d", "value": "39C4719C4C99C0E7E6350AB846CAC4FB46EA4FF30F11D8B9B9C687C7E161346E606536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616992237, "uuid": "bab7c367-d265-4715-b987-cf0205445ff0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616992237, "uuid": "88eab8b1-d8e0-482d-ae51-c6651ae47837", "value": "12288:9FE4Ol8R0TF9KF8aKzAfzi0FRDBRoCDrTlOA:9A8Ry/aKz+FtzZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616992237, "uuid": "fd81b3a0-1300-49c6-aaa7-046e83d900a0", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616992237, "uuid": "6c033b7a-cc0b-453a-929c-075ef08e3c84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616992237, "uuid": "fe044930-1cf3-4e65-b6ee-a273124d303f", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395ca66c-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "abb88249-25d3-42a9-a945-ef115c0a2641", "comment": "Malware payload (Dridex)", "value": "f50281f971c9169ba4a20289d3191ed4", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "b49a0864-6ddc-4361-ab7b-834f5dcb4ad2", "comment": "Malware payload (Dridex)", "value": "0b697bab63f4e4f0251c19ba149f95612e59b4b320159504adf02a741170f103", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "1286ca6e-74a6-4085-9870-9fdd5be624a2", "comment": "Malware payload (Dridex)", "value": "a470af2adb2931bb8ee2b2e2bc3a5ab7285fc455", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "b3405454-30d0-46b3-9abf-ea504309a664", "comment": "Malware payload (Dridex)", "value": "b4fc2a10b76174740480da1ddcfce1bf21d3cd7d27b67e7657d7926475e94a42a3d662d41bb0fc138934bba06aecd093", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "17db8064-a281-4371-9f41-695e4030e74a", "value": "C584D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "d61cf19b-c732-48f0-b3e1-c09401f668b2", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "e48797ed-16c8-4b67-aa90-883b42e70822", "value": "6144:XbazNBbycfmKsyUlVXMdUFIk1KyHNwoAJpFp5xMxC1h:GzeTlVX/7HNGp5WxUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033346, "uuid": "9e6dc011-4c80-46e9-8a4e-e4e0db90464e", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033346, "uuid": "de0af431-25b5-437f-aa88-aeda41de9912", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "3b61753e-cdf5-419c-b45b-6c8ac8c6b06a", "value": "0b697bab63f4e4f0251c19ba149f95612e59b4b320159504adf02a741170f103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbcf597-9078-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617013193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013193, "uuid": "8034adb0-5818-4ce2-9f48-4d1dfcedf968", "comment": "Malware payload (AgentTesla)", "value": "a68837fec0524a590828c7fd4a04e423", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013193, "uuid": "8d94705e-8fd6-41b8-a359-995f1e988987", "comment": "Malware payload (AgentTesla)", "value": "0b89017f439b1fe8feba98eb29e1ceb9b8c6d39b24e07c127bf9b56055d3465f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013193, "uuid": "8233b425-cce9-499d-9f18-0c7925e357f2", "comment": "Malware payload (AgentTesla)", "value": "0ef4c8ac9f4c47131b05d7c78dd41b3350514b60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013193, "uuid": "ca21fe82-1353-4bea-9be5-c71dc21184ff", "comment": "Malware payload (AgentTesla)", "value": "77b244028c172a14f1e92e05475907132e85f9f42407ec33248fcae72b889c4fe1757178bc7a6642f937a5620b2908d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013193, "uuid": "b9cdba99-5dca-43fe-8621-2f0903e1abd0", "value": "50E4F04A23A47710EC7D33F80825D605C3F1AD596273D2BB5A95B8CC39BAF1C86B14B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013193, "uuid": "a06231b2-ff83-453b-9a3d-79e4ec0568e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013193, "uuid": "de4f6414-b713-4345-9a37-6a45965d6cd8", "value": "12288:VNj91vLG8tEpivDXqtZaCxJ74BrGfGiIud7HchbKcHGF5C6G+B2o:njGHiXEZaIasfGQg+cmFV8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013193, "uuid": "57a2c6dd-85c6-48f1-b2b4-88045f348899", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013193, "uuid": "a1b47e24-ee1f-4b9b-a179-71810bc3f390", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013193, "uuid": "40a13396-22c4-48aa-9c57-fe3175ddcdfa", "value": "Proforma Invoice No.42037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de97596-9092-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617024280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024280, "uuid": "dbf81d23-929b-4163-bd88-0217b0b4769b", "comment": "Malware payload (Dridex)", "value": "6105be746df1c1830dbd3b228141cb47", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024280, "uuid": "b00cfc97-a7df-4f8b-9498-bff6d0207db5", "comment": "Malware payload (Dridex)", "value": "0c457e25af1fdfd6118cce4811e3a041c4ec2cd6768df7b9088fbaf6f2c6c64b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024280, "uuid": "48f7903c-e2c5-4474-a834-8bf9290f0c55", "comment": "Malware payload (Dridex)", "value": "420134f9896be810de4e13c217b0f5f5218092a1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024280, "uuid": "9e420985-18f9-43d3-b28e-f48b0c99966d", "comment": "Malware payload (Dridex)", "value": "db8616d6ba9e5b0c2ffa1a7c456d034afdfcff577dbbece20387583bdd9fce1845ee54c623766ac602457a0b835a31da", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024280, "uuid": "ec1e1117-8200-42c8-9655-f48f4031b6b2", "value": "B214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024280, "uuid": "a444f698-9e55-42c3-b7e0-c3be4d3273d8", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024280, "uuid": "c0953551-20a8-42f6-85b8-f2728ccd55ba", "value": "3072:d1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:vi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024280, "uuid": "49afb3e5-d1c5-4b5d-a4b5-4ac597b01896", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024280, "uuid": "a4873ffe-94a0-47ad-9b47-df62f22f9e22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024280, "uuid": "2a7a5ac1-6d63-4e08-9a8c-d58ac1fa3728", "value": "0c457e25af1fdfd6118cce4811e3a041c4ec2cd6768df7b9088fbaf6f2c6c64b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037dbd5e-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031537, "uuid": "535ec7db-7d0d-4705-a8f6-768de783815f", "comment": "Malware payload (IcedID)", "value": "edec63affae1792e97b9dd9cacf933a7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031537, "uuid": "32c64cce-48cd-41d8-8230-b46a392c8142", "comment": "Malware payload (IcedID)", "value": "0c822ef78ae92f06b871a94f7171c60cc06464f40df19ecff79f11be51808ddb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031537, "uuid": "ddc6ab2f-1124-43fd-a726-2d1856e5efad", "comment": "Malware payload (IcedID)", "value": "61f3e9106b3a5820aa0c8aa963e8edb135d8d198", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031537, "uuid": "1adfbcf5-63a1-4a63-a7d8-3a7bd747d3d1", "comment": "Malware payload (IcedID)", "value": "9b271d29f195dc8bc9926144d5f26515d24db4ac18854698c435b859af7052b5e35b4867dcb4ccfefe612fdaac7a6a74", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031537, "uuid": "1c1dc1eb-24df-4427-84b0-c0e1f6581f19", "value": "6604122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031537, "uuid": "e206de1e-6cc2-49bb-b2fb-477ddcb24445", "value": "3072:A3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:AnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031537, "uuid": "be05d70a-8a6d-4348-adb4-89a5e291f9fc", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031537, "uuid": "91343e5e-2089-45fc-9d42-e132db9b23f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031537, "uuid": "b926459e-d154-49bd-af31-977c02ef18e4", "value": "Claim170826527103292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1cbf3b-9076-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617012364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012364, "uuid": "3132ab35-12cd-49b5-96a8-78223cf18597", "comment": "Malware payload (Loki)", "value": "2098a1b19bb107be4037dbc1780c5c10", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012364, "uuid": "3ee325dd-2698-4c84-b90b-b1baf94151a9", "comment": "Malware payload (Loki)", "value": "0cc1bf56e366c1e6ce18ad1637927c43448c2b7a626b790b8ae2ced284d032ce", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012364, "uuid": "5173fa2f-c993-4b19-a0c6-2fe9ab67c447", "comment": "Malware payload (Loki)", "value": "c43553832604bf2e2a02f03f11deb1a2cdcef7b2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012364, "uuid": "6419a4a0-4745-426c-9d37-1efee9c3f40b", "comment": "Malware payload (Loki)", "value": "a37b0596ebc5560beeab6f02d65cb23f814417321628ac619bd50f047545a58d781d44c4ccf7c6c5ffe2d7a1c83c59d0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012364, "uuid": "99555734-1a04-4cb5-81a0-290dd0682bc2", "value": "5AF3023AC0E0D5F7E6A25BF12EB756B8F7B681110221474787741E793E219CB8A1E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012364, "uuid": "8e4d66a6-ec43-4563-93a3-20ae5599c7ba", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012364, "uuid": "fef94eff-93dc-4424-b23e-9f251c7a73f4", "value": "3072:s3jqjLX1DLPcnWCqfR1YK7DoIbMBQ651R96d4jocGugGd9uk3XC3JomaPK:sTqjFYnqfRGK7xbHdyymi3JXaPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012364, "uuid": "b1a97cfe-74d6-4f34-ae2c-a19c7638c686", "value": 159474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012364, "uuid": "d43bed40-9972-4a8b-9acc-c877620341db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012364, "uuid": "8758abc4-dc0f-470b-b773-8dbc629ca4c1", "value": "PO NO5532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e246687-9081-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617016979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016979, "uuid": "ac8a7ab4-2b02-4995-ba34-b7268c3ba0b7", "comment": "Malware payload (RemcosRAT)", "value": "bb3a267a7efb3a4657c3da7b88e5cb00", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016979, "uuid": "ff81ec3f-735a-4146-b849-647bb5859d03", "comment": "Malware payload (RemcosRAT)", "value": "0d0faea63b6f798f9bb022d8cda8b8c07c68303fa6eb21f873516dfed168802b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016979, "uuid": "c5a8f89a-6171-4f84-9c69-e14d34851283", "comment": "Malware payload (RemcosRAT)", "value": "58d34bf6a4d741080d2db9a7fe3bd5daeb837d22", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016979, "uuid": "8a3c9572-8ec0-418b-8ecf-60d1289fede8", "comment": "Malware payload (RemcosRAT)", "value": "5d9e549d6c31ea0472bfc715f875e78a51bdae53f8b19b7f74e36ff5f59e9ef278839252edb1f01a0d1d521a7a4342e6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016979, "uuid": "628851f6-3b9c-42e4-b976-ebb58c54d3ee", "value": "68831297102917D8EF2A605C592F786C7BCAB713C53BD4825DA2E94443E5C2E10E7BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016979, "uuid": "c0e12eb2-98a8-45c9-8803-c1f965554028", "value": "1536:VbRUDjG9k7Fzb/HrDvlpy4mDDSQhvkw05phk2DTJPxM8EnUy8jbf:VEjG671r/lpzOeQSw0zhZ/JPa8rh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016979, "uuid": "19255d3d-cd10-4a2b-b3eb-d7a47988c145", "value": 81316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016979, "uuid": "8895bf20-440e-4ae5-9dd7-baa7a935b713", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016979, "uuid": "0cc5f0ca-152d-446c-8693-791f71176ee1", "value": "FACTURA609080000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7421b1-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "2732197e-81ac-4fbc-a500-8eb604a2bedb", "comment": "Malware payload (Dridex)", "value": "28fbbc3212b101a0bf3acbcf5794b9cd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "95b8c60c-e791-49ec-942f-ec980cd6dbca", "comment": "Malware payload (Dridex)", "value": "0db0f5b075b047f814cca8e273ff83236401093c59649e49fb00ec04a880f0c9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "6f3d69a7-7fc2-469e-aa76-6f5d001fa645", "comment": "Malware payload (Dridex)", "value": "183775f0c263e5b107e043af9f2c94bc848e3c02", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "78f758b3-643d-42ee-93f6-86487d4e6eee", "comment": "Malware payload (Dridex)", "value": "d8de79855ae6d6279278ff6823fcbe9a0c17efa027bafec7163cacdccd125614db58d5db12c6bce14b827b8478457627", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "acf9be8b-ef7f-499c-8574-c54c4d93a007", "value": "5114AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "47b4011d-d436-4940-9c14-2e3bdca0999d", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "67209df4-87fb-400d-ae7f-614b0ca13589", "value": "3072:ppRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:pBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028195, "uuid": "d4cd9cc6-0351-49d8-904b-0be3a5bc90ea", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028195, "uuid": "0da1e212-5341-4981-9729-95bf474124f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "24cbbaf9-1cc6-4288-9df4-a3295878a0c7", "value": "0db0f5b075b047f814cca8e273ff83236401093c59649e49fb00ec04a880f0c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0203b2a-9063-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617004366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004366, "uuid": "b862f3cd-9c86-4911-a9f9-7424987f4c5c", "comment": "Malware payload (AgentTesla)", "value": "c5365957e78123aa002c7bf98e274e30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004366, "uuid": "2bf8a193-2005-4ce9-b2d7-1bd790cb2dca", "comment": "Malware payload (AgentTesla)", "value": "0f0159c20cfaa92f53f75ba6d3c934629359ca805f595d1a5d2247ae2df88737", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004366, "uuid": "88e7a775-88ff-4ea7-ad2d-086d5a7b8fa0", "comment": "Malware payload (AgentTesla)", "value": "8091b9071b947754e851c0fc786987f30b08d68c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004366, "uuid": "352bc30f-e24f-4b98-9f43-a471956d51ce", "comment": "Malware payload (AgentTesla)", "value": "21f0df9e2814a7b1213211c0ffea87f63e10621d17a6db860e56e3157999a4f7a7905de2e48b4ef75ebf3446b035827e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004366, "uuid": "b8c365dd-545d-46ee-9d63-985f367fdca2", "value": "932409D4664804E3C96CFBFA82C226416275A5B72952892F49CE53E3DC12B931DDC2FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004366, "uuid": "16dc3c99-0092-4102-8b63-e10c65798163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004366, "uuid": "fb041bc9-d4db-4db4-bb81-a3b6b755b81e", "value": "3072:M2BfZTQACXUrRYyA8+lNh1s5gIdczHJj8oApJ3n5H5KGX+KI:/fZTQACQRv2XhCo4XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004366, "uuid": "77ee036d-0edd-465d-8470-cca8c3584918", "value": 214760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004366, "uuid": "cbed4ca6-4a2c-4bf6-9a36-1af6354f86e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004366, "uuid": "f592e819-de7b-4d85-a684-282d82200fac", "value": "R ALHTQ19-TYPBLDGP0401-940 GR2P5 -NASE FERDAN Q0539 NE-Q22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855cceb7-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996107, "uuid": "bf11f757-fc8c-4698-8f11-d0f6bd066e61", "comment": "Malware payload (AgentTesla)", "value": "52516db41b1bdcdde1b36c4bbe0dd527", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996107, "uuid": "3c666990-52db-47a1-86b0-efb203e431d4", "comment": "Malware payload (AgentTesla)", "value": "0f22a0c19896549b7d1f6fdcfc677392d1950190bfeaaa1ad00e291c7ee65e97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996107, "uuid": "91ecc00c-95cf-4027-a86e-133b3432f71a", "comment": "Malware payload (AgentTesla)", "value": "0b3f6f2bf1a5fb8df62af902dc86b9de99d84c4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996107, "uuid": "3133bafe-1c1c-4c66-a354-f8fecf293a7f", "comment": "Malware payload (AgentTesla)", "value": "72a9462d9c254c4673feda602d0f05b7fb77ae770bb1b080ff8e815e9ff2e87f9e31dbc57cde10608d38e2432c9c212d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996107, "uuid": "11bf867a-e3f1-40b0-a04c-b8aea8aaec80", "value": "8E454A8C1E99C3CAE1794BB891D9E49943F56EF38F21CC79BDD547CBC220B41E606622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996107, "uuid": "7cbeb785-49f3-4a5c-ae21-650a843e58b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996107, "uuid": "682ae4f1-478a-4a72-8d78-5394c9d26cff", "value": "12288:+Q/NtLKByvwYR9caA+nSdRgFu4DQz6cCY84dhOFBljnJKaaR1Mbrx8qbBt02CI:+0RC6nbFu4DQCYfOBl7gtjMbrWSt0dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996107, "uuid": "dfbdd13c-db59-4de0-99ff-13291a6b8cc4", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996107, "uuid": "1eefd86a-b373-47fa-9127-354335e2f1e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996107, "uuid": "5b97caf6-5af9-47d9-8677-0cb994be0cfc", "value": "VdBuldh8IqttyDD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41335c61-9073-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617011025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011025, "uuid": "05db11e2-5d1f-43de-9413-a911fefa4e60", "comment": "Malware payload (AgentTesla)", "value": "cee5b33c0719879caa13ee5295ca52fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011025, "uuid": "8a4d5bba-26b2-4e8a-9348-142d165c4b0f", "comment": "Malware payload (AgentTesla)", "value": "0fc6d6629ca1b970a92cd0347565d91c5c8b0061507f7d2470539de5c3e2c6ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011025, "uuid": "fe9972e3-ea8c-4907-b68e-429c30097c03", "comment": "Malware payload (AgentTesla)", "value": "8b8bec6322521ca431bb41a4c3ee613f58148da4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011025, "uuid": "606682d4-38d6-4bb2-9d84-34660909cafe", "comment": "Malware payload (AgentTesla)", "value": "6ddadca362ca051cee828afe030bcb8bde12a12b48fa4b10c4a23ef2df3042779b48c30fde89c03be73b5335125c94c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011025, "uuid": "5b7338bd-3c10-48fe-bef4-397a28d33537", "value": "A0E423299F1AFD73DAB51852A4581D589DF3FFAF23809299B121F381935C785C8B380B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011025, "uuid": "7efdd1a4-7ade-4d39-b182-2af34137fcc3", "value": "12288:lt534yiazeJ5fYfxx4x8jopIO/UetH2WzAtCqprzH7Dtu97qt:ltOEU5gJKIOMettAoozH3tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011025, "uuid": "9c3e2de2-497f-44d7-9e59-0f2a6fc5ce36", "value": 687076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011025, "uuid": "9f33bd1f-aa38-4ed5-b498-75d22861dc6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011025, "uuid": "6f92d7a6-59e5-4e11-90b7-35e8d557e9af", "value": "SDSC-1100BYA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061b485e-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031542, "uuid": "26083654-13e7-4960-b4e9-7b79bf01201c", "comment": "Malware payload (IcedID)", "value": "136261d4160e9b8f29a9e5ef938c9fc2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031542, "uuid": "34409929-6135-4250-a80d-29ae5831bb4f", "comment": "Malware payload (IcedID)", "value": "0fd36e2e26fe312ceb7d787aa2920ffa677f1efcda07877facdb5c2c0ae0f33b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031542, "uuid": "1e93c13b-386b-4bd4-a3dc-0f7b9bf82e19", "comment": "Malware payload (IcedID)", "value": "642238a1fb880e9b8300d6ebdc78e8782e56a69c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031542, "uuid": "ed71690d-9c00-4e50-a258-9b82d5331c62", "comment": "Malware payload (IcedID)", "value": "764bae47ec75f2834d78781eb25abf75572723061375ecb26603b42aa8f9e9049dfb459423add445f8617f26c3a6094a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031542, "uuid": "d5bb3def-0a9e-4ae1-8c2d-f457ec1a21dd", "value": "C804122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031542, "uuid": "63ae1ec5-88ef-4b62-ac45-f41b20cf0dab", "value": "3072:u3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:unE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031542, "uuid": "c6691578-a25b-47f7-bb43-d2f4d4c858e0", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031542, "uuid": "fca88a7d-66b3-4c02-a5ed-fec673b2b320", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031542, "uuid": "71087acc-63c4-48f5-be54-bd59d7795af2", "value": "Claim67513454903292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d73318a-907a-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1617014133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014133, "uuid": "efde0cd7-f811-4ffc-a1d0-ff77966e042a", "comment": "Malware payload (FickerStealer)", "value": "b7d90c9d14d124a163f5b3476160e1cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014133, "uuid": "c3dc60ee-dd2e-4b30-8837-4c2b16f4268c", "comment": "Malware payload (FickerStealer)", "value": "10192ceb4aa066216989c2b83dd3b460f0264d6672f64d1dff2addbe07fb1a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014133, "uuid": "3cb1a9e6-320f-4a95-9563-0a8769c4100c", "comment": "Malware payload (FickerStealer)", "value": "684e0fc52a883091957f65c0d2ff59fe1499bae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014133, "uuid": "c7c849e9-b0f4-4793-a457-5bad37758f42", "comment": "Malware payload (FickerStealer)", "value": "2c4c9f880eb223a6fdace5bc302028b1f403aef2ebf65941470f09f924fb0c79d1f4a59ac401cd59e924def144479f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014133, "uuid": "b8e1bd73-1a59-4616-9442-8180cf2aaa16", "value": "A154E00172E9C533E25619760951C7264A3AFCB59B324BCB7B902B6E8E323D18F36747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014133, "uuid": "4cc4317a-cb4f-4ff0-9edc-6673a99ac2bf", "value": "f2b79ad44db55e1b164ab787681beb97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014133, "uuid": "cb3d3594-f989-40fa-8212-676ad0113e9d", "value": "6144:NkS+S96L1H+2f0jCm628nD+SQB89VtrxQW0jkeAXNz6gyiW2/:z+e6xtKCj1WqVtCNjkeKz6/G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014133, "uuid": "8d1d4ef6-825d-4fb3-8efd-4d5ca038b18e", "value": 284686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014133, "uuid": "ffb3cc39-377a-43e9-9974-8c0d751e53fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014133, "uuid": "6d7a1c1d-e919-4fcf-85d4-95fee191df6b", "value": "B7D90C9D14D124A163F5B3476160E1CF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b8535d-9091-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024016, "uuid": "94d4e41c-6714-4ef9-99f6-7982c8e98caa", "comment": "Malware payload (AgentTesla)", "value": "0461e520cf22891ad0ce03158585dd8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024016, "uuid": "69f1256f-0223-41c2-a558-ba8c314c8cf4", "comment": "Malware payload (AgentTesla)", "value": "10495df99a18c97ac180cf29b32dcaf92bb67146f5e927f89c2c75432976e379", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024016, "uuid": "3ed16ebd-3c58-446e-aa5d-fdc33cc5649d", "comment": "Malware payload (AgentTesla)", "value": "173dc23ae16b6007577fcb65d5bc867c65d5e593", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024016, "uuid": "fad1db3d-5267-4baa-93cc-9cfc59d7e4d8", "comment": "Malware payload (AgentTesla)", "value": "3355ceedb6343d12672237475dca3fc7b3f80b99eefd70e5c9b7810e2958cef296552b95a4209cef383c0cb2a4004ad0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024016, "uuid": "354f2089-5324-4e16-9e27-50d913ffba23", "value": "C2C4DFA53194DF9AD53C8BFB5021104017F9E7EA1113DB88DEC5A4E718AAF0C4ED6B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024016, "uuid": "3c7a778c-fea3-43d1-b93c-4ca62718e354", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024016, "uuid": "36fd87ad-e4c9-48d7-a57f-59f826d98638", "value": "12288:yK82IhOgeJny3efOTkZn8l5xCXKvv0bNQ1FUN4UT:tkhGAkneHA4spSFM4UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024016, "uuid": "fbf1f17e-cc26-4677-81af-0460d213a02f", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024016, "uuid": "2ffa4345-62c9-46e0-9489-868664886bff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024016, "uuid": "745a2637-78a8-49d3-926c-1207131d31b8", "value": "NEW_PURCHASE_ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b5d021-905e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617002307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002307, "uuid": "8c17a190-2e84-4093-bc71-b7e1f5a8f39b", "comment": "Malware payload", "value": "41a9d14c7415467cd4e317fcf0179a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002307, "uuid": "3a893233-b1c3-4539-abde-744df71aa8e1", "comment": "Malware payload", "value": "105273685d5807fa7d0f49f02a9d0ea6cbd48d8c19e67705cae2633dc75a9731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002307, "uuid": "56101503-4eb6-4d26-bc5e-8d037ce5e2cb", "comment": "Malware payload", "value": "adc417218545127c0db0957605575bd55ce1ce88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002307, "uuid": "98d98878-694b-450d-891a-6ae68e28f9f3", "comment": "Malware payload", "value": "b94a0626964bb5f21032451c75210bd45da5f5af0d14dafedbd68d03642b95af93cf20c6aaa630a082ccd760b4069745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002307, "uuid": "eea17939-4ec0-4e55-8150-54678d91ee00", "value": "CA752225BDE30D16E0FBDABE1CD94E3599AE38C70B3452BF325EDA6D06182858C6D40D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002307, "uuid": "902c00df-e2c8-4493-be9e-22b83cdfc835", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002307, "uuid": "c1e32c6f-a060-4c71-a73e-c18af932d6b9", "value": "49152:9r5V0+1X8aY0kIWxtTUfoUR6p6wxwiRAZ/WYMO5z:Z11HY5IWxRUfvYRx3qzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002307, "uuid": "911209be-0603-4e39-9f67-cdaa9fc9f196", "value": 1690579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002307, "uuid": "19be8f20-47d3-4b64-b9ff-7fe3e3e46506", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002307, "uuid": "14a6f0a6-25c1-433b-9987-dcabb5d0805b", "value": "QUOTATION SCAN-COPY-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36051e06-904e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616995115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995115, "uuid": "1930778e-0198-47b7-b39d-82fc20240a34", "comment": "Malware payload (Dridex)", "value": "39bae120da8509cf4a9a4a035f42a593", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995115, "uuid": "2cc5e635-5110-40fc-beb8-41185d6fc425", "comment": "Malware payload (Dridex)", "value": "11795002d6f3c47951a4d37afddd5d53d4366b602b183ef08e022510d8466c6c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995115, "uuid": "f7e1c341-78b7-418f-b932-33502acdba1c", "comment": "Malware payload (Dridex)", "value": "ef8b92dd3b9b42358be14ceaa52edc1760cbc966", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995115, "uuid": "703394fd-21ff-4c71-a7a6-50b19aa8f3d8", "comment": "Malware payload (Dridex)", "value": "03f76fd5755172f578f7166b9ce1b10e83c7718c57c8ebe61ceb2574c1f8fe77dc26eb1e7e73c4232b4c0b41101565f2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995115, "uuid": "d02229f8-a14d-44d0-89f5-9a5d1bea6497", "value": "E414AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995115, "uuid": "5913d584-7f0e-42db-b42d-268cf15b2592", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995115, "uuid": "3d27e424-9882-4d30-8002-a6396976f707", "value": "3072:n1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:1i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616995115, "uuid": "5976bbb5-ef21-409a-a1fa-e4c2b332f3cf", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616995115, "uuid": "f22692b1-ee72-4475-b0cd-fb31233fbc92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995115, "uuid": "9d8f32f8-8893-4a3b-913c-35b2ca80a517", "value": "11795002d6f3c47951a4d37afddd5d53d4366b602b183ef08e022510d8466c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8127c10e-907b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617014568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014568, "uuid": "1b1ae74d-3626-4c54-a88d-b088af6acc07", "comment": "Malware payload", "value": "7b9d892521c40f9e1d3fcc2ce595b43b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014568, "uuid": "936ff72d-f11e-4cf0-9732-5735ff090c42", "comment": "Malware payload", "value": "125854694e9b63244520776e650ab0c12f34926db6d3e2e2077c0d44ca71f67e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014568, "uuid": "89fd8abc-5e9f-49c1-bb90-c721261dce3f", "comment": "Malware payload", "value": "b16792eeb81b151b6ceaf1a079689cc892060702", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014568, "uuid": "4bed6b50-1f15-4b00-a0f2-82465d6456cf", "comment": "Malware payload", "value": "91083947c484ee46dae5c96f7799d4c6d1e5128dc6d61fb3a8232b70c1d1997844f6cd8d0e09cfde39d4e11b74e47fc5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014568, "uuid": "98ab5a4c-fecf-4677-8e6e-a839478166e5", "value": "A0B423A2233DD070C973D22652E9D3DDD61B963F55C6A9DE914F8730AE7BB403A8B048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014568, "uuid": "70ad4423-0320-4166-91e8-fb9fbae9bd03", "value": "12288:Z6X9vpbYU8bBUi54ZCTToHW1lMssQLh6RmD:8XRpSJ54ZCTT0onsxRmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014568, "uuid": "ee6a31bd-e977-4ffc-9229-118038c2d3c8", "value": 499291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014568, "uuid": "e6191e90-5442-4cbe-ac9d-88490e333db1", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014568, "uuid": "95bac63a-07e5-4e57-86b3-81091195fd2e", "value": "Invoice.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8869a6d7-90af-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617036914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036914, "uuid": "95d3f02a-6a33-4190-9cf4-f75e8e7185c0", "comment": "Malware payload (SnakeKeylogger)", "value": "2caa8d123cdaab7146a698d83e02f838", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036914, "uuid": "0ebdf4a1-7f52-4bf6-a971-22247499d65c", "comment": "Malware payload (SnakeKeylogger)", "value": "12a7afdb688a1d96f6627f30696ad911f4dc45528e7848b3c71f825181e5bee1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036914, "uuid": "32287095-def3-467d-bd05-d7227f390ab3", "comment": "Malware payload (SnakeKeylogger)", "value": "e7f6f600ee8d1ed73a5f5cf8ab85dfb47562f0fd", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036914, "uuid": "9fe56621-d1e9-46d4-8f0b-dee7e205a2dd", "comment": "Malware payload (SnakeKeylogger)", "value": "aa6a6700a9ad7af3c0b6ed5d671f036b2cf4037e6faafa90f4c9f35ba6037f012aa2fda9515b72e25b9a67e1354a60c3", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036914, "uuid": "6a6a5de8-c41f-4077-8d1f-de4e1c865552", "value": "42D570C5BA28F1B0A39FDAED6CFA495434C2C85DB16E51D676C8638A1C01B17C2FBB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036914, "uuid": "708189d1-421c-4605-87d4-fe2e0c802eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036914, "uuid": "b5f3b3b5-16d9-4aea-a6bf-130cdd2ed3b8", "value": "24576:2+Mh0u1mJtBNk2E1WKiLbvdTO9Gh76E2y6yRm0dL8xEOX3WQbzXaV5X:2+Mh0u1mJLHEIK6n5N2y/ATXavX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617036914, "uuid": "c0c467bf-fa93-422c-8483-085e5cbd8ed5", "value": 2753536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617036914, "uuid": "9c029389-19c7-4f53-a7ec-f9c26afc9227", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036914, "uuid": "8e065ecd-de76-4b54-b3cc-2448691733f7", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c620c7-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "9eacf853-516d-4c7d-be44-cc937caa1136", "comment": "Malware payload (Dridex)", "value": "21cc9043c0c7cf0aaf8d0c8d1434d9a0", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "3f6fc38c-d5e6-418a-9aaf-ab1e046b9ca1", "comment": "Malware payload (Dridex)", "value": "12fbac65b7994a683252a8dc9601cdd16f26b9fd353d8348cad2c074f6c98d08", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "4a0cb996-6698-4006-b101-a3b49a06a326", "comment": "Malware payload (Dridex)", "value": "c0fcc28643e3f81a86595f289b443b1ba22ef710", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "a981f6b4-5886-4954-a8be-cddcc3879d6d", "comment": "Malware payload (Dridex)", "value": "a0c38f906a7d52bb6ee49c69ab80a7e3dd7df2ed54cb91eac3480ec82a101cbe19cf03e9ad5aa60f2ce5113719283d7a", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "35766686-145d-4a68-8a6b-15a3383f1568", "value": "B9C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "72d8caaf-758b-4b0c-bbc8-1f0f1219b913", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "54ba57fb-3bc6-4217-96bd-6fe5631b4af4", "value": "12288:Gt+D1yz/1SXpqDaoWmDsFZHk3eBWIcHd:GcA1aLoBYgeBjcHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040399, "uuid": "f2f42e3d-eb90-4ff4-996e-de9bc454de6d", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040399, "uuid": "c9426d84-910f-4853-8279-7b0820aed316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "754b24ac-0508-490f-b2ed-f8b22a99bdce", "value": "12fbac65b7994a683252a8dc9601cdd16f26b9fd353d8348cad2c074f6c98d08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc21e1-9093-11eb-abe1-42010a9c0039", "comment": "Malware payload (RevengeRAT)", "timestamp": 1617024882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024882, "uuid": "43cc62b7-5e7e-4a32-a4cf-73da906e6590", "comment": "Malware payload (RevengeRAT)", "value": "c0cad88b7c89fc09c05229097e13a939", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "apt-c-44", "colour": "#AD418E", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024882, "uuid": "88afc8b2-7286-49f6-807b-9e0f7daea48a", "comment": "Malware payload (RevengeRAT)", "value": "1366d835a5675aae88bb713125b1fe9f8ad327172fb648ed0aec7acc7701cdf0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "apt-c-44", "colour": "#AD418E", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024882, "uuid": "f758b69e-daac-4b9a-95a5-2cab790c2ce8", "comment": "Malware payload (RevengeRAT)", "value": "ffd48addf9aa0c2e8a8d02bcea68f47b0c95f504", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "apt-c-44", "colour": "#AD418E", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024882, "uuid": "d55015e6-d55b-4a3c-812d-c69f8626c1a2", "comment": "Malware payload (RevengeRAT)", "value": "8ee01988e003cfa71fb8dca54902e697237d3b1f3929c1a8be5da7f76d6924439ece75c125829de3cb7093a46240499a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "apt-c-44", "colour": "#AD418E", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024882, "uuid": "9cee1a98-9a42-4f2a-9bde-6ad272769ae9", "value": "ED6612B4B48A8071F3564631F55EBEB5A13239C7F7DA2D1623A9AD009BE5F622F0530C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024882, "uuid": "1fb03790-6b54-43d0-98bc-3f4ea1837a35", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024882, "uuid": "1b37a126-fc5c-4f6b-9519-bb6fcbd2e9f8", "value": "196608:EtdZ/pUKc6qT8VkNGdD28b9qcT2JQwKrogqMWndemFf:+Z/pUKPVkNu5T229kWMemFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024882, "uuid": "13637f32-6f55-422a-9e89-3e21f76adcf9", "value": 6744433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024882, "uuid": "02a0a836-a087-4676-93f0-fe2b90b13af9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024882, "uuid": "f4129dd1-7e36-4774-b0ff-1b992df6c79e", "value": "mltqanainst.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa98589-9085-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617018807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018807, "uuid": "b9000ef5-9b0b-4086-9a4f-bbbb6127b9cf", "comment": "Malware payload (SnakeKeylogger)", "value": "5cbd431d385c54f7e75deea8d1bb4a6d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018807, "uuid": "c0744be7-dbbe-470f-82f5-ecc65e8d804f", "comment": "Malware payload (SnakeKeylogger)", "value": "147577a5356065dd61844f0c80148d32a623734717975d33fd3a854e06ec0993", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018807, "uuid": "53b22957-179e-480f-a48d-e57905b3fe24", "comment": "Malware payload (SnakeKeylogger)", "value": "55339e72ad0df35fd3b3a10c677bb5e13f9e797c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018807, "uuid": "798a6eb6-137a-4457-894d-be7c57569c64", "comment": "Malware payload (SnakeKeylogger)", "value": "5e116e183f362d35c87b9e8acfa5e2f9bd99bbd9434a5329208b3673d14f5fba8ff0a5b29b2de2cb1e55122e5eec8982", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018807, "uuid": "7d2d0a6b-dfc9-451c-bfee-ae188b20f150", "value": "EA15D29224ECD190D422BDFCC96BD7E23716CEA78B80A74631BCF4566277B9BD11240E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018807, "uuid": "e276287e-8181-4ec8-bbb4-660f7820dfd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018807, "uuid": "a28d0499-c902-402b-a6b9-c131172da6d5", "value": "12288:IhIsdAtBP0wCuLYKBTQQc3bJ6vAuGaJCU4tiIti8UR43eY5NtgfjA:I3WtJtLYULc3NcAuGaJn4tWzC3Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617018807, "uuid": "640967d1-08f1-412f-86a9-9864f8afdad1", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617018807, "uuid": "5d728915-cdb5-4f01-97ac-cb65945e249d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018807, "uuid": "8e2bdd0b-b195-485c-9be4-0b8b0dbf815b", "value": "ASB swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45383a54-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "39b27c49-56e7-4286-8bef-6231088591a4", "comment": "Malware payload (Dridex)", "value": "24227a19e6d7c3bc6254fc54e7484f58", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "303b3fd5-0dff-4b1d-b1d0-d35f1fe101f1", "comment": "Malware payload (Dridex)", "value": "14fa645c198d002b005640503337ae9b454104832b14dc76ca6974b7b180b4a8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "e958d6ce-419b-4a6c-9cce-9ac42d87f455", "comment": "Malware payload (Dridex)", "value": "bf165201eaf7b678766b322acc67155ed1f18cb1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "964e50bc-3268-4e56-bf83-a583514180bc", "comment": "Malware payload (Dridex)", "value": "5dc956fe82487e4e3511cec813d6422bd662e11512eb72d71ae84d89fd78d26c70ab73bb97ee7e4aadc76596015218f7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "8c6fbf10-0671-4b42-b25a-e6ebc1d4adfb", "value": "0814AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "0adcb147-63d0-4ce3-a615-be191cb25779", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "338b805b-22d7-49ec-9993-ca985deb7b07", "value": "3072:rpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:rBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028212, "uuid": "e2c61b0d-6079-43e1-8471-e33e393b55ff", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028212, "uuid": "8680fe60-9e2e-48a2-8875-a80f50dd2ac8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "a4ef15e8-9c93-4577-9394-c1770389438a", "value": "14fa645c198d002b005640503337ae9b454104832b14dc76ca6974b7b180b4a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e3d17e-90a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617032875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032875, "uuid": "3cbbe8fe-e952-4d0e-b28c-2bc6a385d285", "comment": "Malware payload (SnakeKeylogger)", "value": "35f6cf45ce6ac3ba4412467c72b18a1a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032875, "uuid": "76b5dba0-12ff-44a4-9cf5-b590f8937174", "comment": "Malware payload (SnakeKeylogger)", "value": "151f09906e990113abffe8b39ad81f9a17fa744373d8c66a073f7ec2137b7a61", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032875, "uuid": "28821081-9ced-48d2-9721-da4a7ab3ddee", "comment": "Malware payload (SnakeKeylogger)", "value": "7cedecf3b9165c00e6da39b958aed40945390c36", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032875, "uuid": "9d4eb8c6-dab2-4f40-8267-55dfb0e22920", "comment": "Malware payload (SnakeKeylogger)", "value": "3c9b0917d13010d9a84eea68c037b2c83a73611181abcc21969da24cc5bf7444e62aa1545a76e4d98e32be423a51e31a", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032875, "uuid": "db862b17-9552-4fc4-b5b8-d8ffbe088be5", "value": "0105EF303AEA902DF1B3AFB85AE47596CAAFB7733707D45D1491038A4723D81DE91239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032875, "uuid": "89efcbc6-e620-4206-92c3-7f7f117f4d95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032875, "uuid": "53f57eb4-0b9b-4c62-a1bc-591d184ae7b7", "value": "24576:axC8fe3egPzapRoZH2NfBMg9Sejbjsm8:axC5ugPzapRoZdg9Swsm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032875, "uuid": "e295bf18-30e0-44cc-9ae4-2cf21a8d16ac", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032875, "uuid": "45d538d4-8e59-4b46-a2b7-23fa67976d92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032875, "uuid": "136e4fc5-c511-4f2d-b52a-2df073ee2e8e", "value": "INV0000075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e25e14-90d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1617054355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054355, "uuid": "c3246bcf-544e-4318-b086-7760620f880f", "comment": "Malware payload (Pony)", "value": "e1c6b779020250debe764925e1c966e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054355, "uuid": "f1d29559-d995-42e2-bec1-0ab43856ed17", "comment": "Malware payload (Pony)", "value": "161516f819327d2d1f5266d2c83200421250ef83423f84a36faa145489ec8b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054355, "uuid": "a8d2955e-0f2c-4311-ab76-d570c081c6ed", "comment": "Malware payload (Pony)", "value": "df8291512f6fac30e8b2c7bef274f55937acad12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054355, "uuid": "24a436dd-f4b5-4b7d-9481-84579dfa4654", "comment": "Malware payload (Pony)", "value": "7fdc649e1c89f767badfae833ca4cb681a2d019f1fe1da705e0a4c0639d1cdb7729c198b289fc98ee63d9a1a20f6dec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054355, "uuid": "22ca3a6d-9648-497d-a21d-403158ddd32a", "value": "73930903F481A0F1C0A12B7177C117A0E7FD9E79BC7A8D5AEF8C48856DE268B7B16452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054355, "uuid": "56d321de-2a6e-43c6-b32c-b0c01371f485", "value": "4d0b5436f93c4c8d3e20d9d3d7320939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054355, "uuid": "6916f613-480b-4c99-99ba-5779434930e9", "value": "1536:2sfMgkqTjEwL1EX87KDQ1k2E5TCP8YACoSuvO0dITvAE+cjkzmy:Xl5081E5TCUvOi1E+0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054355, "uuid": "87b26f4c-3b86-4632-a95e-86fe4d26d021", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054355, "uuid": "4770c921-9646-46a9-a39d-9b1381dd93c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054355, "uuid": "5685b14f-5636-4e80-b019-4d325b1687ab", "value": "161516F819327D2D1F5266D2C83200421250EF83423F8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df735de-9093-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024924, "uuid": "63bf7e9e-79fe-4985-b37c-58d90c17b346", "comment": "Malware payload (AgentTesla)", "value": "6d25d16b5032ba21876d1be70ca00c9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024924, "uuid": "d3efcf09-c15d-4d51-b3c2-a4e4db3bbf6f", "comment": "Malware payload (AgentTesla)", "value": "163246175f83c4d792101d0ab91a7ff2a8661e8ca1bd250ff5d82f04cf208b61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024924, "uuid": "d06a3cb4-6b33-4116-89d4-f3a53deb683b", "comment": "Malware payload (AgentTesla)", "value": "07060207201c88887c195978db0463b30c81ea05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024924, "uuid": "eb6a1451-7ce3-48e6-860c-e8345b3bdc3f", "comment": "Malware payload (AgentTesla)", "value": "a6debdf22714081497c94875bae68806ee18c51f931cf4c1b25b302d58c3c4f1aaf50ff863219ac4e30f9074068d28e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024924, "uuid": "64c7623a-fd01-4a13-b9ee-a9078e5c8e56", "value": "C1E4918C5D9DC1E6E6354BB842C9C4EB46EB5FF30B22C879B9C68BC7E020746E516532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024924, "uuid": "a18748e2-38e7-4cbf-9735-c69947133a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024924, "uuid": "bf82610f-50bb-4fcb-b3c9-2bcf51afb8fe", "value": "12288:+lgwXkVNO90CvLgEdfWX6n10kUzosxCEl3:+lgwXkVCx7MX6qkU8sAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024924, "uuid": "b7292626-231c-435d-958f-12548ef84b72", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024924, "uuid": "b7a4cb83-7625-464c-9173-bf0e27de0fdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024924, "uuid": "92f27b34-d260-4993-84ea-0a4a9d5efbf2", "value": "YQbQBf5liT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398b0529-9075-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617011871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011871, "uuid": "8d5d5987-2bfb-4633-9682-99197ff85b9f", "comment": "Malware payload (AgentTesla)", "value": "f6df345b62993cf6edb4c0c5a1d33fe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011871, "uuid": "85e20925-0204-4365-b3e6-337e62c29693", "comment": "Malware payload (AgentTesla)", "value": "1669c62bb2b8e4716de4c0a925424d44e31bdb0e27ba2ff442f5a057122b8314", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011871, "uuid": "37709edb-9c7f-4c06-af5d-7a633b77ae4c", "comment": "Malware payload (AgentTesla)", "value": "600cf25aac8a503fc03978fc57b01180e947aeb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011871, "uuid": "2df5431a-7a3f-4215-bdf8-44e4a902749c", "comment": "Malware payload (AgentTesla)", "value": "3af36b27e32ed151cf6119e17d38a192e42362a8e3e95fefc7ee7e8cd7faf6204033b0910624aff5a3590a2d062c7dea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011871, "uuid": "9d8ae489-c903-406e-b265-8a27820f55d2", "value": "931533AB9D80A29B7F37AD1265CFA74D1B0F351D7D1E91829CC13815C01662B83C9FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011871, "uuid": "16b3fe69-e2b7-4e49-8045-68ca7c106366", "value": "12288:68tGFHUa0B3LxV2S9mkE7Q0wx1qvYmn5hYIyzEuCxtRdiTkvztaTmSsPrI0x7JPO:68gg3LlYp7Q3mn5hYAuCxtTi/tsJWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011871, "uuid": "dd8cd9eb-1d41-4d13-8eb7-ec1cadd8b15a", "value": 875599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011871, "uuid": "80cdaea9-c14e-4a72-8ea0-022e7b8ec313", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011871, "uuid": "288cc400-099e-489e-ab88-c38a5b226243", "value": "NEW PURCHASE ORDER.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ac99f4-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001740, "uuid": "7098464c-7eb7-4270-a4df-bc97175324be", "comment": "Malware payload", "value": "e60a3661d72d0ecb83bc254dab127227", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001740, "uuid": "ceaf5fbc-cae1-4c22-8011-1d2a9ca40f97", "comment": "Malware payload", "value": "1688a5d18382601fb6cc692f38d748d80662ef99609062d4a34236d1f15bc58f", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001740, "uuid": "1bd0d5ed-c2ec-43a9-9914-39d657987010", "comment": "Malware payload", "value": "727139a2cad0de9a65d1492f1b4105317866bc5f", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001740, "uuid": "ea87fbac-1ced-457a-a0b6-d73176f05ca7", "comment": "Malware payload", "value": "f1460965d597a582c83b3e0d4b7d955a799e230f034c5b4184daac6699140277dcaf211165caf49939ebe470da98c8e3", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001740, "uuid": "74d1dbea-1af5-42af-86cf-3f2a72ca7d8a", "value": "13C5D032F2A28873D2731E769D4783914576BF183F34A49736E91F0C6E782817A272D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001740, "uuid": "c2841a17-6200-48dc-ad84-1cba935dc419", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001740, "uuid": "e16696d4-c6cd-4690-b668-aa397acb65bc", "value": "49152:ag6rPO37fzH4A6hanqNCTBS0wp/cFWw9BZ:D6rPO37fzH4A6h09Ii59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001740, "uuid": "09c768f0-69b4-4591-a0f5-f0d402db3dfd", "value": 2664672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001740, "uuid": "9af24a86-0a50-4ac5-bb4b-67f41087c98d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001740, "uuid": "b7fd116e-3118-4b47-8015-d6252bb6eef2", "value": "1688a5d18382601fb6cc692f38d748d80662ef99609062d4a34236d1f15bc58f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4b5df7-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031529, "uuid": "5af48307-df29-4053-ba02-851f493c1984", "comment": "Malware payload (IcedID)", "value": "7bdd1dc783219c78b1c46da6bf4585e2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031529, "uuid": "2142ac9a-0582-4e86-adf7-7c9f71f65199", "comment": "Malware payload (IcedID)", "value": "16900b08c1ccc531a07342ee518402ba949feba18ca6c4a36415e66c24b63542", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031529, "uuid": "6e38a540-126f-4b92-aa1d-3338b5048adb", "comment": "Malware payload (IcedID)", "value": "97c7b3190c5aa60cd15a993eef3e37ff5b3cd3b3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031529, "uuid": "ff85a21a-5b68-4cf3-be78-6e384edc5589", "comment": "Malware payload (IcedID)", "value": "93bcd7de76e20f96db06da266aee22ce8e56a6a8e78bd28bf5ca2915321d831b55a666e7d1c961c7f97276157a15d73c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031529, "uuid": "d8a76b3d-885c-4605-af2a-9a988424bb97", "value": "46B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031529, "uuid": "b1efb747-86d1-4eeb-9612-bc14d82ab330", "value": "3072:M26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:MLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031529, "uuid": "21638e0c-da12-4288-b2cb-8cb4ac91280f", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031529, "uuid": "64416231-b600-4dda-ba47-b70fe6d3cf9a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031529, "uuid": "bcafc7db-6a43-47ef-b182-6822b2fa0791", "value": "document-964515738.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53645514-90e1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617058300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058300, "uuid": "be16bda0-47ee-44de-8ac5-693c5ebe403e", "comment": "Malware payload", "value": "72321b7f780c872db32676f0c6f07f18", "object_relation": "md5", "Tag": [ { "name": "#celesty", "colour": "#8609F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058300, "uuid": "d4095ae7-03b1-4826-be10-d3ba4d84fb8b", "comment": "Malware payload", "value": "16c7cf994304398b39fa2b082295255c6af88299abdc8afa5895e41da5fe59ad", "object_relation": "sha256", "Tag": [ { "name": "#celesty", "colour": "#8609F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058300, "uuid": "5265493c-a329-48a9-b24f-b8e740940cc1", "comment": "Malware payload", "value": "ba4afd8206b2d984d31faed68b6932e8783633ea", "object_relation": "sha1", "Tag": [ { "name": "#celesty", "colour": "#8609F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058300, "uuid": "debbce31-680d-4b22-a277-cf1bd757d43d", "comment": "Malware payload", "value": "d52a644d257c0dbcd0580ecc3bb977b878fd523e596f9ed1f383fa37012ec9301780fc567bb02a16ee8ad8f9d5822bbf", "object_relation": "sha3-384", "Tag": [ { "name": "#celesty", "colour": "#8609F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617058300, "uuid": "56013fd0-913a-4bc8-9938-e770b6542af6", "value": "C865336CCAE1B423FD6400C980535B6D2232EF471EDBEA919C9123AB987B645C45FE37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617058300, "uuid": "6e410d34-740a-4a19-8f47-ce08ccb84baf", "value": "24576:w/hWS3VH5LrRp0HP7EzVm2Msjp7YW4+nrivzxCRgltq/Nbb24:w5ZruPcVm2Lx4+nrczxCRglt14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617058300, "uuid": "1f142125-984b-4c19-8110-fd9da64931db", "value": 1488575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617058300, "uuid": "775a654a-7469-429d-8c38-f437f46a6d45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617058300, "uuid": "00629f87-e276-424c-a45f-18c4b086f6ec", "value": "Celesty.bin.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a740858-909c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028542, "uuid": "b5512de4-462f-4f6f-9de9-be967f66509e", "comment": "Malware payload (Dridex)", "value": "2fd1517fcf1f56f5115acbc25d7ced91", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028542, "uuid": "72f1586f-8bb1-4858-8e92-ab8fe69ea67e", "comment": "Malware payload (Dridex)", "value": "170957cafd600ab54966d956316cab76b2afe768146d753df0e54165aa74025e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028542, "uuid": "d85123d1-ff0f-454c-9d5b-ae7fc2270cdf", "comment": "Malware payload (Dridex)", "value": "a54cb9f0ee79ae56767bfb00a7ee67e1433dba36", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028542, "uuid": "924f14cf-bc4d-46e3-91c2-5b561b74ecd2", "comment": "Malware payload (Dridex)", "value": "53f88b07a00db2a751a737d1e7504f42cb514abf22c60a500ca8903ec43e05bb28dab7eb629af1b97d5f756d69fcf0c4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028542, "uuid": "6fa63705-6783-49bd-8d6a-3252dae58138", "value": "E714AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028542, "uuid": "56ebe400-0b3e-4b4e-b029-bf3549a67315", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028542, "uuid": "e310cfbb-712d-4cfd-8e7e-6d4d284dbc0b", "value": "3072:dpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:dBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028542, "uuid": "bc075749-879e-4c6d-afc8-ec51b9f5727a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028542, "uuid": "d09788ee-feea-498e-8919-17d6c1c337d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028542, "uuid": "c171c392-a087-48da-9665-54bf01d85ae5", "value": "170957cafd600ab54966d956316cab76b2afe768146d753df0e54165aa74025e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30113e98-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028176, "uuid": "b9636870-ba6c-422f-943b-929341e7de64", "comment": "Malware payload (Dridex)", "value": "db37f1143eb3268bc742d773ba5cf4c7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028176, "uuid": "d00874da-b664-4ac5-8b69-d82ace5ff6f3", "comment": "Malware payload (Dridex)", "value": "171315ff56f7e56bdf3d6ee61edf832aab8fa3e6229fd4f7c73fbb1c1046f537", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028176, "uuid": "3b4a162a-4fee-46e7-aba5-5b428b3829b9", "comment": "Malware payload (Dridex)", "value": "1cba1283f42a5af3e38502851ad143a04c6fc2d0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028176, "uuid": "6b9c3a5c-63f4-4e34-a00c-9d3783612c0e", "comment": "Malware payload (Dridex)", "value": "529e7da5684bbd17a13a8e8adc4d90dec1376063f87619f04fc81f4aa73a906204a3fa53f079e67410a04ab0c7753efa", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028176, "uuid": "3cdf62ab-6d9e-4e4a-bcb0-2899881fb250", "value": "7514AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028176, "uuid": "eabf37d0-bfb6-4eae-9cab-27bfcbdcd05e", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028176, "uuid": "cbdb6208-9c77-4e5e-a6b1-807930e9a9a5", "value": "3072:5pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:5BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028176, "uuid": "39b84a2f-6b06-4d53-bdad-780ac51a5899", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028176, "uuid": "132c55c6-430a-4171-8e84-22c50be69c7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028176, "uuid": "a81dcc00-9ae5-496d-89e8-3828094c027b", "value": "171315ff56f7e56bdf3d6ee61edf832aab8fa3e6229fd4f7c73fbb1c1046f537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28516381-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005829, "uuid": "16d0db81-61c0-4ac0-be7a-a06310474ee5", "comment": "Malware payload", "value": "eb23ded8126b43ea056ff579aa69ea52", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005829, "uuid": "4cd5847f-4b73-4d55-a2f8-76432730d13a", "comment": "Malware payload", "value": "173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005829, "uuid": "b7a37d5a-c8b4-4fcd-ac53-686ffa5a8ccf", "comment": "Malware payload", "value": "483c6f2db50afe23b0632e3341fc843caf0249cc", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005829, "uuid": "b342eeb6-5c32-412d-b71f-f8e8d8292f2a", "comment": "Malware payload", "value": "94a20d003724df307c0eb66d5514840b9680738a23135de9a0be7beea214d806ea7141e2d0b2222a7d42f54c8210fa3f", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005829, "uuid": "a5de5c93-9d68-4bca-8fb8-2dbe3864b11a", "value": "0BB60201EDC19573E8B2013552BBA7BA593AA9242725C5D3E7C438387D207D16E3B3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005829, "uuid": "2d17fd9c-3d67-4a70-9cc5-03b36dfc45c3", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005829, "uuid": "ac6de902-4259-43f1-a04b-54de30d30e2c", "value": "98304:x9Yyb5er5PTIHykLIbh9vIsUPS2KTs9g+za3oIu6YadST15/jnu7YTTFBWODv:x9berPbnLq9gia1J8BdjuWTDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005829, "uuid": "a4d23f77-0426-4aa8-8f77-3d96e1217485", "value": 10908352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005829, "uuid": "227eb068-8197-42d9-818a-305f9101d7d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005829, "uuid": "fb4a4287-62dc-4751-b746-f0dfb2ef64f7", "value": "173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a12633-9093-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024907, "uuid": "c7358389-ab28-4c41-9cde-8a1dc9bb98d7", "comment": "Malware payload (AgentTesla)", "value": "5ed1698ac9d6c2913674622e10c7c805", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024907, "uuid": "c532aa5d-ae97-4301-b0aa-0c6c1cf5db41", "comment": "Malware payload (AgentTesla)", "value": "177670c17a33f87af87939f9de506e94d15389cf90baad25eebe8b0962c62b57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024907, "uuid": "cebc102f-07f4-4ea1-8452-90c72917b1bf", "comment": "Malware payload (AgentTesla)", "value": "9a0585fad03e4e6df25a41417ba2fbd35cb9f9fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024907, "uuid": "f7a8c440-6449-438d-97a2-5f5551aca234", "comment": "Malware payload (AgentTesla)", "value": "321b834fa818918fca26a01e6a89e0cdd73b00c6a8c692decaf1c2f7420a5635df4f619218fa5e8baab98b1fa9d90470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024907, "uuid": "ccc04cf2-358b-4aaa-ab0d-4a1c4f35f95d", "value": "979423F3B7D74BC61B5054E4E06E6981E3697206DBE494E8D28C3A5E641C0A31B3E7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024907, "uuid": "78c87546-78a9-49ac-9ec9-1339df10ba75", "value": "6144:kwxh29GFX4VRJjI/LdTM9QS93VYat2VsLpJyZC/zcPCu5Ju0RmWvqUpxmtyzBEg:T3aCLIJ3V8sLppzcPx5RQfmmtuEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024907, "uuid": "daf85488-9ea2-4389-b737-c43090793958", "value": 438778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024907, "uuid": "cf77cb95-fb65-4c9b-860e-ec6fa7cf7be1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024907, "uuid": "8524e7d3-8069-463c-b885-981c32b89473", "value": "YQbQBf5liT.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef5d93a-90ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617036066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036066, "uuid": "95ce7074-f45f-4a0b-8d44-4c501b6383d2", "comment": "Malware payload (AgentTesla)", "value": "0307160413dc9f1a5678256bd015198d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036066, "uuid": "3581379c-64c1-4e27-a0ad-f9cfdaec8180", "comment": "Malware payload (AgentTesla)", "value": "185d309480ed01098f32cfef4807255ffa6834963bd38ec6a89468e49ddc29d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036066, "uuid": "b949726e-b639-4da3-998b-e7024bde3b87", "comment": "Malware payload (AgentTesla)", "value": "a6992a9c4d1dfe63d4ac03b503531c0b4bf645b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036066, "uuid": "ed1b51c7-4e79-47dd-bc5f-81c2713efd09", "comment": "Malware payload (AgentTesla)", "value": "762c8453365ba0c661b5eca1d3e8d419287b1646b1a563bc9c2b4a2e4805f55e9969e089927574e2eabba03e85bc1367", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036066, "uuid": "21865cad-2d34-49bd-aa5b-31a10bef5c3d", "value": "48E4818C5D9DC1EAE5354BB842C9C4BB46EB5EF30F22C879B9C68BC7E020746E506536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036066, "uuid": "d2dd202f-e99c-4fa0-871e-628637e27ecf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036066, "uuid": "916fae2b-8176-4274-9219-004aa05323ef", "value": "12288:mI7yf7Rpsp5OPFzROVXXE0utdqbZRvc4:mI7yfNpmsFzROVXX0Yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617036066, "uuid": "4f5fa5de-d05f-4b83-af3f-2017c43a2c63", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617036066, "uuid": "9893db72-0c26-4584-aa66-0560b30d08b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036066, "uuid": "3deceee4-9abc-4ef1-a56f-47b61ae50e48", "value": "DHL AWB522947284...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe47785-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "a0332471-8758-4fdb-9a06-990c0a40a1b7", "comment": "Malware payload (Dridex)", "value": "a4324d2ab3b6bb2e5eae55488df488f4", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "33221541-7d4c-4cae-8b85-ab7d4e56a4cb", "comment": "Malware payload (Dridex)", "value": "1889e4dad95d3e1c99afda0b5f3d39302c869df3abec6af9043732e8adcc05ba", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "8036e067-9f53-4a64-8d4c-ad7d817d5c1b", "comment": "Malware payload (Dridex)", "value": "fd6750d6a0ef2477bbc04d9c15bd016c59d47acd", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "e1c7f032-ad0e-4248-9b21-8df2f3327777", "comment": "Malware payload (Dridex)", "value": "ea40cd37ab3a35a6ed082c488faa33d565fbf836a06dc31a364365293468c891e6b3d2a69291b0d32e29d262e4248a67", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "d8fb2bb8-da84-4c4f-bd65-e0bad5f76c7d", "value": "FBC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "46f707fd-1704-4c74-ac5f-ecc1d1aa7e7e", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "fd22cb30-c1fd-47ed-be2d-039c5ea4d4c2", "value": "12288:Wt+D1yz/1SXpqDaoWmZsF1Hk3eBWIcLd:WcA1aLoBqseBjcLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040410, "uuid": "5957ad40-70b4-4f8b-bba1-4c4a40fb2154", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040410, "uuid": "0013aaff-3ae8-4cdb-9768-21d9bfc05a3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "512c49d7-841e-4d68-bb0f-d573c305c542", "value": "1889e4dad95d3e1c99afda0b5f3d39302c869df3abec6af9043732e8adcc05ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f53944a-907b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617014619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014619, "uuid": "08ca6174-1c36-4350-84ef-eb2e47628c0b", "comment": "Malware payload (AgentTesla)", "value": "283ebf143882c80ebe4f5f1d906546de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014619, "uuid": "6de18a89-47c4-4919-930b-3562070fc936", "comment": "Malware payload (AgentTesla)", "value": "198cbe11f67751709a6b18d227f7ae768cb163186407f6fd82a04bd7e8546829", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014619, "uuid": "aea7dbcb-65fd-4654-a313-3f7ccb36c72c", "comment": "Malware payload (AgentTesla)", "value": "8363dca43d44620e4b00a78687e91cdd33da466c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014619, "uuid": "57ddebf1-02f1-4822-9b17-3b4e5202fa1b", "comment": "Malware payload (AgentTesla)", "value": "23688d64083898c1c4f066c19c25919718703051232d6896c13a1c6d2063118842f0529d8c92b9e23b861854e246afd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014619, "uuid": "ffee065e-237c-4b18-a3c9-60f9ac88c76c", "value": "C0E44868EC029ADAD9340AFD543553041EA29DE50933DBECDFAAF5D5913EE081F8DA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014619, "uuid": "e5652753-a892-4dbe-8815-b9cb436262cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014619, "uuid": "b678ff0b-13c2-41c9-8bf4-8552ec0658e9", "value": "12288:5Nsi8Nb97CASYPB5xTEzBxSLy75xkJyHlP0XfdDQwWFUXiQ:5Oie9lS+vTxLmrkJyHlcWuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014619, "uuid": "061deacb-7e2f-4ea2-b1d8-d5bd348e3965", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014619, "uuid": "f15c091b-9181-4f10-baf3-06aef09bc919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014619, "uuid": "5b09ab15-b6d6-4694-9f8d-f87271794add", "value": "SecuriteInfo.com.Trojan.Inject4.9732.3006.7249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aab1813-907d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617015443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015443, "uuid": "d9826ea2-10f0-47dc-8700-d08312499def", "comment": "Malware payload (RemcosRAT)", "value": "a47fc2d608827d939cb40c356eb753ba", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015443, "uuid": "5f3b19c0-5f56-4689-b8ac-688f38de1f6a", "comment": "Malware payload (RemcosRAT)", "value": "1b75de1d83ddfa01f1c49382da5ac6a69f96e437d6feae8694ed70fd62e1dcda", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015443, "uuid": "f866296a-4c02-414a-b2eb-82e01123fcd1", "comment": "Malware payload (RemcosRAT)", "value": "b58993a64d82035055a51f2c3551d37a916dc36b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015443, "uuid": "82b62547-f30f-4580-89fe-0e5b6651b85d", "comment": "Malware payload (RemcosRAT)", "value": "190769d32b01acf96e1d1c292e0378524c17ee5119bdf2b16654900cfe9924c34fa6978f668fc05341db8368775276cc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015443, "uuid": "024705b7-4617-4cfe-974b-34b1301eb6a3", "value": "CF04127122D084A7DB6388B13AB5EF7BF7B56756126806A71B216F6D38108C7862350B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015443, "uuid": "e2721009-a252-4fe6-a6ab-7e1a92997698", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015443, "uuid": "10334aba-1af9-4e12-8f02-b882b8f386ae", "value": "3072:HTs3BxJNmJU+V0ZbSdD7F+7mkXM1gc8TpY8NzQztVDO9h/8ot4f5PNzR1CzL7c:HAP4cSBw7RTlY6209rtK5PNDo7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015443, "uuid": "b71d6d15-0d9c-47c3-84fc-3ee4b9f064de", "value": 180066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015443, "uuid": "c0f587c3-23cc-4a45-8f6c-f8e758f6c2c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015443, "uuid": "491ff563-76c7-4d0a-8b96-c2035dd362f0", "value": "REQUEST FOR QUOTATION - PR30016810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba60373-9066-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005513, "uuid": "98f33bda-9882-4255-8218-dd861d5304c9", "comment": "Malware payload", "value": "307cf83afc07a789f7b8976bb9fbb607", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005513, "uuid": "5a399d47-ac69-4e08-be48-b2bb4e902204", "comment": "Malware payload", "value": "1bceb4e84115eabb8bf3df704b5cc014834ca08b126451ae95d60a968e66d666", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005513, "uuid": "603ce8b8-8e39-43ef-97d4-5534f20087d4", "comment": "Malware payload", "value": "47bf1b47a8878636bd2044323b30379e907cfbb6", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005513, "uuid": "3ee23d45-a4ec-45e9-a71e-6bdb559f44e6", "comment": "Malware payload", "value": "26343639d936681a22f53467d7ec7a8155b3531bf482a381236b5c5ad3a97c5fcba7d2473c14bf6c2cd49258ffc82f0b", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005513, "uuid": "e6409113-65d0-47fd-866c-f6e49a301821", "value": "31A6F101A9858573D8B3013552BB9B7B593AA9202725C5D3A7D43C387A707C27A3B3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005513, "uuid": "923307f5-9d25-4691-bc28-ce640e2318ea", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005513, "uuid": "e7d19e88-3223-4715-93fd-fe3d07331756", "value": "98304:B9Yyb5er5PTIHykLIbh9AGsUPSQAurV6gehA6Zwr8uqbZpddiZRwp1y1UdMly5hB:B9berPbnqEAWehBZruc9dQ/UdWy5hB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005513, "uuid": "38ac1fc3-b159-4eb3-b208-17dda025fe6a", "value": 9988808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005513, "uuid": "51fd9062-5036-4837-bbca-2a489748aafe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005513, "uuid": "aa63ef41-8da3-441a-ae5e-4cfcfb20ee09", "value": "1bceb4e84115eabb8bf3df704b5cc014834ca08b126451ae95d60a968e66d666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097d5dbd-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617002342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002342, "uuid": "f1f90b09-a2fe-44f1-9881-ef1aaca9f3a4", "comment": "Malware payload (Formbook)", "value": "7f675ad4beeabb7fd62a9750a499570e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002342, "uuid": "c8c32190-13cf-4ea4-814b-9307b3d4b8c1", "comment": "Malware payload (Formbook)", "value": "1c13ac6991e35e6948e4c926f79bac0a0c669f8c2709eb1e5fcea146e5a4d3ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002342, "uuid": "441a77ad-0b65-4eb2-b091-dde39742e7b4", "comment": "Malware payload (Formbook)", "value": "a08c9b2ec02a3626186bc6e306951dc63f3db1ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002342, "uuid": "22492370-d14a-4ce1-9de5-6a1850ea2e3a", "comment": "Malware payload (Formbook)", "value": "8654a2c573c6f0d946a5c81f9fb1f6de9f3eba4342af04d5bfb1bf2427da654bd4575335a7dba85dc8fc87dbe1061d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002342, "uuid": "fef7db16-c422-414d-938a-05e541a77250", "value": "3024122A53F1844BF59B067019FBC53AFEBD961201711E1B2B790F7A3C25293CB2829D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002342, "uuid": "9447278b-760b-40c5-9ee1-3ad5ee6cc11f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002342, "uuid": "ddbb5dc5-e764-49a0-afa4-a2219f908df7", "value": "3072:vTs3BxJNmJpxFcKOUxgMPeQRYetFk9v3inHGeOlg1EJr6uXsAGMAuzyL2Y1cCjz1:vAPYFHFxgmRzIiHGhSqMlTMBG6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002342, "uuid": "83b928f8-e634-4fc1-baf1-c68568ad52bc", "value": 217380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002342, "uuid": "b38c2175-8719-4607-94b9-ae52891c2002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002342, "uuid": "47f12926-7c02-49fc-a909-acbe1e297d04", "value": "7f675ad4beeabb7fd62a9750a499570e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cac494a-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617001488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001488, "uuid": "35f12ffb-1690-4ddb-a95f-a3e0f1a8c4b3", "comment": "Malware payload (Smoke Loader)", "value": "874bcf36482b83f3df470655e985e29b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001488, "uuid": "f26d37e5-a614-4504-9a54-2e1738708e60", "comment": "Malware payload (Smoke Loader)", "value": "1c259208bdea5d896335c7a22d7a3048e4cfe0c7578a466f8faad880446f4e02", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001488, "uuid": "a2e07716-e4a5-4c3d-bced-d4efcc410255", "comment": "Malware payload (Smoke Loader)", "value": "bbcfeea3e3b437680cbf14c8016b3954cac1398a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001488, "uuid": "86cc3c16-82f6-4c46-9456-83dd13b2d9bf", "comment": "Malware payload (Smoke Loader)", "value": "7ddac397e28420a148904a7de6016ef7d3cad1ca0099d5ae2de8b34e8d3a45ad4d4d8e469bb007d4ebf27544f268ba5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001488, "uuid": "dd91917b-cf40-4da3-ad04-e7254380b6d3", "value": "F6F39D1039D6C873E6A229755874C2B1162AFCB64F2156C77BC43B6E6F352F28A35B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001488, "uuid": "c6b2e97f-ceb4-4942-b9d0-f97087ebb966", "value": "329808ce6524a70205bbbd7f156d646a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001488, "uuid": "14f2aba7-f39b-4ab2-a7ef-5bb84899219e", "value": "3072:ckiSUwRUam6zL86j3bNvgrESQ1HgI/Urtm6M5G7+u:LiSUwbmeL8AL5gASWAAUR1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001488, "uuid": "f2ea4531-9d4a-48c6-a33d-8961e840b956", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001488, "uuid": "2d008228-b6fc-41eb-ba81-13ca04daf7dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001488, "uuid": "b5e5b651-f706-4646-bc12-f0b6075d5204", "value": "874bcf36482b83f3df470655e985e29b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c97086-9079-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617013688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013688, "uuid": "0056fb1c-ec40-4c06-a82d-3a2f63686b21", "comment": "Malware payload (AgentTesla)", "value": "6df035b321ff06ad4c5b8738972c5c09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013688, "uuid": "5cd2731b-a083-4d2c-87d2-2a04787dee4a", "comment": "Malware payload (AgentTesla)", "value": "1c50bc041c96cb7488f70ddb93b90db4e321ec87be0731655834b36f06e09d68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013688, "uuid": "fa4757a9-bd05-4db5-bdbd-5b8d307fa865", "comment": "Malware payload (AgentTesla)", "value": "314ac128a68b502e74def6ee0202eb7a5de5f218", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013688, "uuid": "f08b3548-1bc4-48b4-96bf-1920a9469074", "comment": "Malware payload (AgentTesla)", "value": "3ab5bca4774621a8a880be51e95f31f87aa3c462259fe167cd76b801cb14858f04f2b1d4b90e9923ab15f8f260ade5a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013688, "uuid": "439c6e7a-2df0-4a9e-850c-95a4897fd3ea", "value": "650533682425BF67E6F95D1B00AD35CB38C2DA247C4460735CE0615E25EEAE4FE0EE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013688, "uuid": "62bc6c35-0e12-487a-8009-f880d051371b", "value": "24576:2hooJXJ6DTRQs+pGvErWUwT3nHzd35FX9AeM:2hkQsLvEr5wDHzXFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013688, "uuid": "ae779c07-58e4-4bc7-8067-fecec48ddc8c", "value": 868063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013688, "uuid": "065d933c-07b7-4fb1-b374-91573f617cb1", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013688, "uuid": "c8eb4130-4e54-42d2-a4cc-49eadca94ee0", "value": "Payment reciept.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac688248-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040411, "uuid": "aa27263a-bc54-44b0-9ea1-6da5675c7d7c", "comment": "Malware payload (Dridex)", "value": "c7cf15f4150c9c074fd4308b26cab72b", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040411, "uuid": "2a3c6d33-d193-47a6-be9e-1d55f1dfef0d", "comment": "Malware payload (Dridex)", "value": "1c59466ebeb76f89beca6ada657b94b9db51873b427a6e7fad65626f8f317818", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040411, "uuid": "bfb81710-17a9-4090-8c2a-f22eb6c0ed1b", "comment": "Malware payload (Dridex)", "value": "a795584cf62e2c7a32b40ab88cb672d7303d5175", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040411, "uuid": "4097077c-b51d-4bbd-987a-38f2380a7838", "comment": "Malware payload (Dridex)", "value": "59d26cbd26c15e0ab52da83588db802a9ecbd0b34339c1594d1fa97d6e2ef1cae5465a73d1704fca63d2a19feefd3929", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040411, "uuid": "0716c406-5eaa-4a62-a359-88609b9fc6a8", "value": "39C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040411, "uuid": "1390b31b-b05f-485a-b882-2e6c2fefec53", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040411, "uuid": "90827edb-f7d3-4a93-99b9-c2a773dff5f4", "value": "12288:Ft+D1yz/1SXpqDaoWm7sFVHk3eBWIcpd:FcA1aLoBgceBjcpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040411, "uuid": "9b8be0bf-6cd3-4e9c-a3ff-7b55bd973194", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040411, "uuid": "7cb8154f-87a0-44e0-bad2-42768b3197a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040411, "uuid": "996b3153-6c7a-410d-af58-6d3b7139f6c1", "value": "1c59466ebeb76f89beca6ada657b94b9db51873b427a6e7fad65626f8f317818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7671649-9069-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617006928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006928, "uuid": "baf6b8fd-46bd-4808-9f23-41c8a2c024df", "comment": "Malware payload (RedLineStealer)", "value": "1cd3d2f0acc740fc1e999e6c2cb26224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006928, "uuid": "adccee4a-0137-4953-ac9d-96d96613e68d", "comment": "Malware payload (RedLineStealer)", "value": "1c88f5a9499a54522c8338fb93c326debeb890fb08251ce29fcf19ae7441d11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006928, "uuid": "b1e767aa-8913-4d68-9e1d-65925abb7540", "comment": "Malware payload (RedLineStealer)", "value": "38f5118c561adfb100b1a2a57ac4f60bc15d6a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006928, "uuid": "155f5fe3-98b6-4d78-9fd7-35f062ea86a1", "comment": "Malware payload (RedLineStealer)", "value": "cc515fde7e45061f658de81fca7cb55b36fbe8f9eadd7c0a06ba1461779650f8a449e413133ffb661df7e0b40ab1f8e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006928, "uuid": "d7565bb8-599a-490a-b8c9-d4ae8af37a38", "value": "CA8412713652F82FCA025D37C57987390BA62F111CD46A137B207B9F7E7A5803D2B2A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006928, "uuid": "530a79ef-0572-4379-9349-68879b4889ed", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006928, "uuid": "4d414a8e-1a94-480e-b6e5-826c764921e7", "value": "6144:wY8ikhaBECtZevULVZOOOx3jLn3jOhaJhbO6jCoUbZ5WRHe6:6IBdtMtRTDTOhaJ9O6jCoUbZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617006928, "uuid": "a1334da8-6742-466c-92e4-5fe0b8671ea1", "value": 382894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617006928, "uuid": "4b4f67ac-cd50-48e3-a334-e47a80c84d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006928, "uuid": "ad986bf9-8edc-4ff7-a6cd-f2b3cd79a52c", "value": "1cd3d2f0acc740fc1e999e6c2cb26224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905e56c2-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617002568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002568, "uuid": "9322b597-d23c-4d5c-8b77-f1dfe07600c6", "comment": "Malware payload (SnakeKeylogger)", "value": "83c01f327b9dad9768ca0e9703d4e34a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002568, "uuid": "6de8899c-4af8-420d-a113-d98d44a35097", "comment": "Malware payload (SnakeKeylogger)", "value": "1cda725631a86c3edc66c82eada1dcf0d469d79f734312424ca29bdba0129373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002568, "uuid": "b3a71dc8-9e0b-4a23-8ff3-5976cc4816b6", "comment": "Malware payload (SnakeKeylogger)", "value": "1231d3d4888991e3f798009343982c02f5cbcb0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002568, "uuid": "9921d082-2b50-4277-92be-9dd0101bf390", "comment": "Malware payload (SnakeKeylogger)", "value": "658334381e7aac5968d1403d985e1dd25c766ca6557ed4d59ed594b17e6047d5f796482cc227e0bb2cd26e133e2bcda4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002568, "uuid": "d4d3eba4-3ae2-4939-8ea4-151b47df8301", "value": "2374A293797CE4E3F98CBEB50251678511796DA22A31E147CA8F3DE7E933213C8910DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002568, "uuid": "1fc1ec0f-a716-4180-ba9a-1d08baef5aee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002568, "uuid": "71a8f8e6-c591-4f5c-bcea-19b6f449e92c", "value": "3072:vDvg56W0zmGJGPIB0r6MQXbr+NvNNzj1Rr9u8oTwE//:vDvgGzmGJGg7XbrQvNNzj1RrVoUE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002568, "uuid": "55cf4de2-9e72-49a1-8255-742aa878bb15", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002568, "uuid": "f2decce3-81b4-4dff-b47d-d3bce3163756", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002568, "uuid": "487b853c-c294-447b-9b43-f0d0f72b5aee", "value": "83c01f327b9dad9768ca0e9703d4e34a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae5741e-903d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616987822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616987822, "uuid": "8c214b23-de4a-4716-a350-68afb1fec057", "comment": "Malware payload (Dridex)", "value": "a012b3009133fbe3fb3e953e3bdd4a09", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616987822, "uuid": "c197099a-367c-4166-a7d1-ca66b120b57f", "comment": "Malware payload (Dridex)", "value": "1e119ac85c4391a90cef835b30a0ca7d8cc0ddb2eac84a768f5a89e761d767d1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616987822, "uuid": "04bc8720-9cc2-47c9-a5a6-91b8f3149f6e", "comment": "Malware payload (Dridex)", "value": "a1ae76c1e6f85d9068ad618d1bba69ce10ec2d81", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616987822, "uuid": "d0daac82-a98d-498e-971c-22b3ceffef2b", "comment": "Malware payload (Dridex)", "value": "99b684d4ab3651660298b865e4af2feeb060b18f413ca10f4e8296a727465e6ad062139f4eca8f599cf6ca710be9aa17", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616987822, "uuid": "5cdd690d-223b-4d57-8c6a-0df032cde4af", "value": "D614AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616987822, "uuid": "9e8626e2-9bc0-4914-95e8-6480d323473c", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616987822, "uuid": "0d511c8a-4c06-4466-86c0-ee1c2e622f1b", "value": "3072:o1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616987822, "uuid": "27cd8930-dc49-489d-b4a0-66f1b93b7267", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616987822, "uuid": "f097dcdf-2ccd-495a-a7b2-28eb03aa2ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616987822, "uuid": "9340427a-35f2-4007-83b2-2b2cc07543c4", "value": "1e119ac85c4391a90cef835b30a0ca7d8cc0ddb2eac84a768f5a89e761d767d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4729b761-9094-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617025208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025208, "uuid": "92832ba1-279d-4a68-949e-0ea64b093d41", "comment": "Malware payload (Dridex)", "value": "66c742042aaa43ebef2a44953ac9fe45", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025208, "uuid": "f8e2819a-8f5d-4fec-a57f-7031a35000c3", "comment": "Malware payload (Dridex)", "value": "1e553da2063c5773de05bd541cf8a3ec1bdd8d7153003b18b53f2a45c61df6c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025208, "uuid": "a21a4f82-c549-47a2-a364-7fdbec1bb994", "comment": "Malware payload (Dridex)", "value": "d9bd5b1ef320045a48a25100984dbf82cbb9f32e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025208, "uuid": "c1249d4f-bca2-48f3-bd9b-c033acb6831a", "comment": "Malware payload (Dridex)", "value": "600342b9a0bd31959b2a3de9f582d52b3ca9f9a09ca9066f41b747d6bb1e6d5c4c2f5ac830c672efd7aca0b98bc06863", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025208, "uuid": "15c69b1d-32f2-4a8d-bc37-23f3f08f63a8", "value": "0574D013B2E64432D2725B3808B7D6108AFF79D09AB4D4EB669D265C2B277C05B3C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025208, "uuid": "47cb7571-eaa1-44dc-964e-2e9341bd298e", "value": "e7e490e0da58e39dbf299858321fb1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025208, "uuid": "2554cd0b-3caf-4386-bd7d-e8d12860cb20", "value": "6144:BNcVrVDdp8+t1yTdawJZ1b9b7Q79nP+ymljFmbol3Wuh:ncVZdH1gxZHE7h/mjsb4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025208, "uuid": "1d897169-f5ad-469d-890e-45fb8d499085", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025208, "uuid": "17ce3325-47b3-456e-a9bc-c9f59cdc890d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025208, "uuid": "19d47d7b-3b95-49cb-8726-6bc1e649a35a", "value": "g38ufhf.zip.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a205dfa8-9056-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616998732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998732, "uuid": "519cc022-ea26-4654-94a6-5c9e74d3af71", "comment": "Malware payload (Dridex)", "value": "a0c0299fd46b7119c0a8bdf262c5da96", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998732, "uuid": "e2473c85-c825-4239-9920-53b806b80c42", "comment": "Malware payload (Dridex)", "value": "1f76ea3453dd95bea37412b579f48dc8effaffc48326e3efbfabb092b369598e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998732, "uuid": "441c81b9-d6bb-4038-b832-cdd46604bff9", "comment": "Malware payload (Dridex)", "value": "9e1d01cc0ff0b9ddea81b666fe091f0a7bdecacc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998732, "uuid": "e151b7cb-5ff2-4b76-aa4d-45543498152f", "comment": "Malware payload (Dridex)", "value": "e2daf6b6ba0510f230b3af3ef12bbf5b80c94c2ea28a03f4bb28c305e30c268fadca320e24130634a0f589d9a25e9d27", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998732, "uuid": "aac63704-0d70-4d08-b47d-df182324b915", "value": "5B14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998732, "uuid": "e484e3b6-7601-4017-8c23-a2fae3c98223", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998732, "uuid": "98df6139-ba79-47b1-a762-45e897472629", "value": "3072:11i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Xi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998732, "uuid": "8bfa2ca9-f1a4-483a-a8a8-a5cca211078e", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998732, "uuid": "ffe61645-fe1b-4b57-b319-90f3f13431a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998732, "uuid": "1b7693c4-8c09-4c4b-9ddb-bc4b5d209653", "value": "1f76ea3453dd95bea37412b579f48dc8effaffc48326e3efbfabb092b369598e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c04b45-9021-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616976025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976025, "uuid": "6b0db134-6531-40a3-9fa6-ea3a2cdf9943", "comment": "Malware payload (RedLineStealer)", "value": "33ff620b79f226c361dff097b9e6818e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976025, "uuid": "833cf553-d1f9-4f68-9c26-9ef6f43692c6", "comment": "Malware payload (RedLineStealer)", "value": "1fc72b95ac7bdda31dd61e99a6e559552dffab03a545a04946909c9dd68bcfa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976025, "uuid": "07245634-2421-4296-b299-4617a372f1cc", "comment": "Malware payload (RedLineStealer)", "value": "fea71d4b5159babed268a1ecb3bb488d317e6b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976025, "uuid": "8a757c86-b3dd-493d-9ecb-22d39e6936d1", "comment": "Malware payload (RedLineStealer)", "value": "46a4fcd8c6295ffcc7630e74b3b592b77b93f18267ab5e37119be9e7895c542577450b3582ab8ca09b14fbb5fa5a48b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976025, "uuid": "5e298009-3715-448c-813b-20fef056e031", "value": "276572137D4CE311E5E05E3791EE6D3823E559CA8633920BBF05FDA914B2242ACB276D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976025, "uuid": "8d6d6b44-9545-4069-acd2-d5174180f856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976025, "uuid": "67568ed1-57dc-48d1-ac37-0caf9b5171b1", "value": "24576:G7csj8nz2dCM/3Z/mNyRP60thr4Zu28qA:Gwsj+2dCMR/LRPHtCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616976025, "uuid": "e0ece6d6-130f-4f23-be01-ab6ba51d2bc3", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616976025, "uuid": "ca09fdff-21d8-4507-99cb-e12064c029fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976025, "uuid": "3878f22f-34a2-4ac5-a0ab-ba5f468d836c", "value": "33FF620B79F226C361DFF097B9E6818E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1d3ae4-9046-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616991904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991904, "uuid": "572067fc-6fb5-4043-87f1-76819fcbcdf0", "comment": "Malware payload (AgentTesla)", "value": "89627cf0bc7affdf7190a7b6f2197787", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991904, "uuid": "a72fda96-b9ef-47ab-9012-b05246e2a691", "comment": "Malware payload (AgentTesla)", "value": "21653598ac22c20f0feb208086815ec218a77eb0b1b5c0a688b0693debbe87a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991904, "uuid": "284eda02-0141-4271-916a-61dcb6fafbca", "comment": "Malware payload (AgentTesla)", "value": "67ee4555e210ffec296dd669dc1fa44889fb6096", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991904, "uuid": "2dc5547c-8ed6-43f6-8d13-62d33eceb374", "comment": "Malware payload (AgentTesla)", "value": "3d17ce6609990c6b2e15625447830c4b95473962ca8f0afd90e47ceae2ae59740796d95830683e086a6391af249ac6e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991904, "uuid": "08b70abd-950f-4d0c-83b3-1afd21f04fef", "value": "B60523A55C6B829CC3A21EB75F2F5043C79FF95362B32466CED4D303F46A70A1822B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991904, "uuid": "84d9d746-5971-4ece-9bb3-6e88a90b6707", "value": "24576:kw/caSmon7XID/FRzBNs+atRqx7CsYJ0cqInvQq:kwkaj7nfs+aLVsY5qIvQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616991904, "uuid": "b15cfe60-4543-4a13-984e-fbb527de8638", "value": 832588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616991904, "uuid": "0489885b-1bb6-49a0-a8cb-6e7dcad86bbd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991904, "uuid": "d02c4d95-4c3c-446d-983b-d915cd189852", "value": "TT Swift Copy.pdf...zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd66ad04-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031527, "uuid": "4f09746b-5596-4a2b-8ae7-219c04f52149", "comment": "Malware payload (IcedID)", "value": "03e09c2eccfa491640202e45dffd0bfc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031527, "uuid": "44aed119-cb40-4065-895e-e091c36a0234", "comment": "Malware payload (IcedID)", "value": "217f2fe4d2f9062dd6e8d8817cd54db5cc44e0ad507df79cfe2a340fbd0795c7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031527, "uuid": "591581aa-3169-4047-a376-e7ba12228dff", "comment": "Malware payload (IcedID)", "value": "470d1f82eb4326f3b79cd63c5a042094b7232a78", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031527, "uuid": "c36a7741-2980-4fc3-b800-c276d184cc94", "comment": "Malware payload (IcedID)", "value": "a3d13c9d66bae7e6dd34a70710e03869289f47174e59aa146706804af70126bb3d6d7b6b358f454a0bdda4a37dbe4059", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031527, "uuid": "a1eecd93-ff48-4aec-8897-5870191c26e0", "value": "6AB3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B159E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031527, "uuid": "c0f3bcad-b88f-414b-baaf-c40295ba1368", "value": "3072:U26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:ULTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031527, "uuid": "0b44c0de-c0d4-4823-80a0-918f8b37af24", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031527, "uuid": "532f3644-3456-44e1-8967-bbf5e92a8985", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031527, "uuid": "a45abdb5-d82e-4e0e-84d8-2a8e5dc4df41", "value": "document-616669222.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9b3606-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028222, "uuid": "42ab8439-e1b4-40d1-a624-2dba6bcba884", "comment": "Malware payload (Dridex)", "value": "fc89e5fdfbc09ff30eb13f610610f4a7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028222, "uuid": "fff5f5c3-5b79-4732-a2df-8b94f170a1d0", "comment": "Malware payload (Dridex)", "value": "21a025542d23aff300dcdb4d15527e1b074b895657fcdc1c91ac6da9e9fda42d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028222, "uuid": "cfd9bf67-fcba-455e-b234-0697467eb2aa", "comment": "Malware payload (Dridex)", "value": "d31cb0b1634f3f4168ba2dc95997b9558085f9ff", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028222, "uuid": "92d2e451-154c-4a7c-8f84-a34edd9bb26b", "comment": "Malware payload (Dridex)", "value": "804214dc5cb12fb283bcf54a58643838833ddb88ab983349b66096e3be677f0d2d8f340fffd2061b5c6c0f54f575119a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028222, "uuid": "d922373b-a804-49c4-a779-ddc99a72ad9c", "value": "1B14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028222, "uuid": "12e065d6-4eb4-4764-a6d3-95ebf6418180", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028222, "uuid": "561804a7-9ef7-480d-9f26-26630d5ed20f", "value": "3072:ypRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:yBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028222, "uuid": "be92685b-d5f8-4db1-bc42-46f1a8d3f169", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028222, "uuid": "abee859a-da94-4b04-87b6-4c3c9e81fc90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028222, "uuid": "31ec433c-5429-4c54-ba97-7aeba6f1a1db", "value": "21a025542d23aff300dcdb4d15527e1b074b895657fcdc1c91ac6da9e9fda42d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0007c6c-90a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030941, "uuid": "a6dbc9cd-2d3f-427a-916a-d6da62cfc079", "comment": "Malware payload (IcedID)", "value": "4ba0b0628efff08dfac7e4c8bc2a49c6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030941, "uuid": "db343da7-2b8e-4298-bc3a-d6dca50544fe", "comment": "Malware payload (IcedID)", "value": "235549a4bd752f8448214cd22f58062a8bfbfe8cffa9096be6ecbd1b2582b715", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030941, "uuid": "dd80dffb-f452-49e1-b7f8-759d94c346f9", "comment": "Malware payload (IcedID)", "value": "48ca5fc4fdc794b0c07f9d1d764942197a1c6bd4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030941, "uuid": "32f7c72a-5ed4-4a2d-9bb9-27a0958761aa", "comment": "Malware payload (IcedID)", "value": "34d892827e33c0189a0aeb934f1032ec4d37e49c16f963d0d35040d35fa9402e7bc79c32f0cb3f7682e9090f8d679484", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030941, "uuid": "e8dd2fa9-fb6f-44c9-924d-969f856e81c7", "value": "0AB3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B159E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030941, "uuid": "74bd3997-123f-4906-91aa-0cf1ade29c9e", "value": "3072:Q26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:QLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030941, "uuid": "6fa03025-49d3-4298-99d1-b9fe57917494", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030941, "uuid": "7bcddae2-b624-41ec-a06d-559f93dc35f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030941, "uuid": "27102608-0c7d-446f-8955-0eceb0800ac6", "value": "document-1619777432.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee13767-90c1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617044710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044710, "uuid": "efe9d06a-5653-4fe1-923b-9b923ebd949a", "comment": "Malware payload", "value": "b0ecd2ea44061fbf817a3a31dd225b56", "object_relation": "md5", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044710, "uuid": "b9213459-4e28-4841-80df-c0c6350b1f4e", "comment": "Malware payload", "value": "23afe02886a4be603a689fb2cda3044fade0ef03a16a9653bdae8c0b734dd759", "object_relation": "sha256", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044710, "uuid": "733a716e-d1b0-4e78-a9e9-4dc2bc8adb35", "comment": "Malware payload", "value": "52fed3f3680239c67c3914acc55fb6381a9fb0a6", "object_relation": "sha1", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044710, "uuid": "ee669e98-040c-4594-bae6-b0d45f25c945", "comment": "Malware payload", "value": "1edc97d6521c7047d9c6bff12ccf60cf85fe7d75a56f4c70856b0a017aca7b103340f8f40d8e68bc05540717772a18c2", "object_relation": "sha3-384", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617044710, "uuid": "23a36996-d23d-4eeb-acaa-7fbab012ebac", "value": "B8831295A343581B4AB502EB33A318C2F6F3A6A8A687539B4A6C0D777D63781C3707C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617044710, "uuid": "9c25e822-4c37-4b52-8bf8-4c13c2adafc7", "value": "1536:lym9pjZJFIBdBf8orsBA/eannj3mQNv4Wgb9gJH6IGLq02V:lymLZ7IajZyj2L9Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617044710, "uuid": "3f1ea00b-1f1b-4714-91e8-d8eff824e2bf", "value": 82683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617044710, "uuid": "896b4465-24f8-48c1-bc92-9124c85257ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617044710, "uuid": "d2301813-a3f7-47c2-849e-cf185ce6cd85", "value": "catalogue (74).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28a1269-90a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030945, "uuid": "706a75ae-d49f-4578-b42c-ace6feb404fe", "comment": "Malware payload (IcedID)", "value": "22e6606abc748b790d5929eaf182b428", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030945, "uuid": "2eb5e218-7400-4e16-a27b-82e2399476bf", "comment": "Malware payload (IcedID)", "value": "24012398916018ca77d6584b097b9f7203b73f8604958f70b69fe81dc978b1d8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030945, "uuid": "33225272-40e9-4ffe-b2e0-1b40f6ffb34f", "comment": "Malware payload (IcedID)", "value": "c4a514c7fdc904f35f179e13f83a1adeebf20cc2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030945, "uuid": "d67fba78-8636-47eb-995b-acf5823a8ad0", "comment": "Malware payload (IcedID)", "value": "42c852610fe5008d733120f6708ae4b2a3cfe1d5b6ca0d78e73679646ef84f7f9c32dee8a44846e79890ec17eb9fa23d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030945, "uuid": "c425e9c0-cafc-45ce-934a-2e34779b2fde", "value": "4304122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030945, "uuid": "5e38d562-693b-4d0e-b6fa-4689aadfab7f", "value": "3072:m3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:mnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030945, "uuid": "69557fd6-903a-4a9f-8af9-30671e15aee0", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030945, "uuid": "ca1fc3f7-4613-4fda-bf90-2a5fed381251", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030945, "uuid": "b252b64f-818e-4a3d-9787-74a796a61d1b", "value": "Claim139203677803292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b55772-9058-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999485, "uuid": "d336b2c9-b516-4a35-bc61-9b8f7fae7135", "comment": "Malware payload", "value": "326a3f3fa92e9ff9b4e8e57aad40963b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999485, "uuid": "30caf2dc-45ca-4cf5-932b-28495085a30e", "comment": "Malware payload", "value": "247501d0a023c7e1d8de3fcde1f49cbe0933f8047daef04c2ad7c20f8479676b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999485, "uuid": "c0ac59da-6060-46ec-8173-baebb69c301e", "comment": "Malware payload", "value": "777ec7873e8f702c44c6d956f26f39ab5e7c4832", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999485, "uuid": "839a885e-f79c-4b37-ab14-47abf17458a3", "comment": "Malware payload", "value": "c6a3447199632539384777580ec57d1ec30ed6e3399757e904dd94aa535a3006e250d4466d417f51080e2099be261bd7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999485, "uuid": "734a69dd-e143-4d8a-8b21-c73fdabddd31", "value": "2365288630ACD1D6D02AADB9C85BD7F23396DCAB8741E74730ACF65A656739AC10310F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999485, "uuid": "d163887f-8123-41e6-9e7d-743619c21eb4", "value": "12288:iI8oM51Hx5w/ScRKx8KNc7cjnJvs/TdRAUPc1AZs8/mJEdDCQd/KcVGYot8Z+ZOj:V8YsiQnt2Td9Pc1AZsSmJE5TbZ+glDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999485, "uuid": "895e18f8-3f60-43fc-8d25-8f8747e6879d", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999485, "uuid": "8d1f5f88-ad06-4107-aab5-800d5a18637e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999485, "uuid": "78f1d26b-e1b5-4bb4-b616-19d3c71975b0", "value": "ORDER CONFIRMATION OC CVE6535 _TVOP-MIO, pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b247f0-9075-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617012029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012029, "uuid": "f6826c09-c6bf-4c50-9bd3-c5274df1c707", "comment": "Malware payload (NanoCore)", "value": "a9f4fb75da0d6dcdd9fa424b55043539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012029, "uuid": "74b92234-92ff-4321-8718-46178a9e3591", "comment": "Malware payload (NanoCore)", "value": "24873a34409486481c4abf374e2b5c07095e5f95427553ec9a81d7e7551fbbe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012029, "uuid": "92fd5d2d-ae06-45ed-8542-0da1fb64fea9", "comment": "Malware payload (NanoCore)", "value": "fe9daac7ee1d95b604c4b916c7916d31798b1ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012029, "uuid": "c09e63b9-e521-4340-9e0c-6800cf6ab0cd", "comment": "Malware payload (NanoCore)", "value": "21ff2820d69398c447051976067210b7aac62645b4259b13dd25fdcadecbfe996fbf95d5bb6526ca7d53500947baef18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012029, "uuid": "b5f14700-a375-4a89-b7d5-e757b33f6291", "value": "6E35917C2EF9D2C6C5350A7842C9C4B946E91FF2CF52862AF5D40FCBE121BC5A50A52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012029, "uuid": "b216ffef-a54c-4a6a-bc36-2ed3a14156d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012029, "uuid": "4de24eaa-75d2-4d09-8a7c-bef98354ec58", "value": "12288:OngMhlt6TfFwI+pJ2iNd/6YtWe5asRpGanf:OgMhlt6TfFwI+pJ1vyY55aYpGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012029, "uuid": "d626b34f-25d4-46e6-a14c-5687f95633b0", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012029, "uuid": "42152b4c-6a9e-49b8-a745-59902f4ffb86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012029, "uuid": "b74f1891-3699-4cdb-ada9-5dcd25d3f2a4", "value": "Urgent RFQAP65425652032921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f9a08c-9079-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617013692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013692, "uuid": "5c1d62ac-9834-4276-b953-ca5c61877cca", "comment": "Malware payload (AgentTesla)", "value": "206bbed7a45f5f288cbb777325d81197", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013692, "uuid": "a6cc9be5-9b9a-44ba-a099-9ecb27e8c018", "comment": "Malware payload (AgentTesla)", "value": "24b155022c6a55ab70117fd111edd5143f371a566f421c3952d38a182ed05050", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013692, "uuid": "19e5e800-3c52-4ab0-a9ab-c88893b4c577", "comment": "Malware payload (AgentTesla)", "value": "1709ba47f36fae9659310a3a235482e0c40b1feb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013692, "uuid": "9c3b29f0-5193-40c3-b819-943c1d0b4261", "comment": "Malware payload (AgentTesla)", "value": "910497a622377689f53624a7e4aaa636b1959084f27bdae3022fb6ced1df6f4c5272864b3ffa515513d933cf2cd4950d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013692, "uuid": "c5bfdda3-0e5d-4a60-a433-970c18f53265", "value": "E515022522A9CB61E07DAB381472520427F4BC02F312E74EBEE531ED1A76F95463B763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013692, "uuid": "0f323e4e-3591-42bd-b25b-0ba9d770fea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013692, "uuid": "0fdb0c43-bc5f-4015-8bab-521bf576fae5", "value": "24576:jvUF7Dxj74gylihd9QtlGZIXpuzREeq5+L8:LA7Dxjsvliv9kQeWREY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013692, "uuid": "4d963cd1-9b9f-4141-b69d-0a7c5a318847", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013692, "uuid": "320b327b-9f44-4a1a-b502-9caee117cfef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013692, "uuid": "670abbce-754f-481c-aba7-33c7276b4186", "value": "Payment reciept.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869e9a15-906b-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1617007705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007705, "uuid": "6c5498b3-e0b1-437a-a22e-4fd2655f73f5", "comment": "Malware payload (ZLoader)", "value": "4582a6687cd04125aa1cd3d47a945962", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007705, "uuid": "35033cfd-4ed8-4040-a95a-7b24cef30344", "comment": "Malware payload (ZLoader)", "value": "251d30973e7859b193cc753bfad7adcd3e1ae09952ea7af4896ca6d11d0a9fcf", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007705, "uuid": "7c9bb434-f4ad-4ab6-bcc1-827c196bbc8a", "comment": "Malware payload (ZLoader)", "value": "5193478f8eb809cc2c1d0b9d9ab77910051fd8d4", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007705, "uuid": "b431fec0-db5b-463e-9bb6-f2eb13ef941c", "comment": "Malware payload (ZLoader)", "value": "6217685f90e169685dd9ff0f2073248b4f75eccaa949fd0fc3115d50b73d21793cc71bd954524bf1595661d3acfdc273", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617007705, "uuid": "4125a285-3f13-4867-9757-2524e1c500e1", "value": "A092C02E5112582AD23BCDBF105802F4764D9053EB83BBA67404A66F7EC8AB362D6447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617007705, "uuid": "eb7bbb0e-9a15-4f12-94f1-54bf0514785f", "value": "384:ZSpFZjRSpsZ7uC+yVw9cEBi7tRrxGa/UAun/76UlM9zeJG:kb6y7uC+yVwrBi73rEa/U16xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617007705, "uuid": "93fae94e-1de3-4e76-95c4-6040689da844", "value": 20461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617007705, "uuid": "bebca15d-6eb4-4127-8c78-002d0b7ddd8c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617007705, "uuid": "cf09947e-6579-4e39-abab-296d05c5cb02", "value": "7428d.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4535d2cb-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "8f9542c2-8124-47c4-91f9-d5820cdaef41", "comment": "Malware payload (Dridex)", "value": "03a529d2b9ca3e1f6beb822ca409acff", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "9d66c7e6-30ca-4741-bee4-1e8e28e04063", "comment": "Malware payload (Dridex)", "value": "253147b6a2f7fc662c94303fb247ae6b3370ad23d078b59931938eeae4463166", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "18bc77a3-8b07-4941-b20b-1be65d64fe6f", "comment": "Malware payload (Dridex)", "value": "988032c20a3f71ccdc9f6ad107e62fffb741a420", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "484ec1fa-5211-447b-b297-6184143ec382", "comment": "Malware payload (Dridex)", "value": "a6edb5bd50fac343816f37014bfdf1ee0a0b5379fffcc3bd8e7868e9a576f52b0818fe8b5b0d3aa2f9f7db5c5c1a997c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "2f0542b5-eb95-49b4-8dd6-6769dce1e043", "value": "8A14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "c5853057-228f-4d94-ae06-e5a0d7f62104", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "b8708678-15d5-45ee-aeee-c40adb015e0c", "value": "3072:TpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:TBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028212, "uuid": "eb6fef78-9b02-4596-bd43-39f2a15eee99", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028212, "uuid": "3ce91f26-321e-423c-a969-23de14c5df32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "4b426bac-6491-42bb-b9bd-5377909cc2e5", "value": "253147b6a2f7fc662c94303fb247ae6b3370ad23d078b59931938eeae4463166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321421ab-90b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617040635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040635, "uuid": "fafcf906-830c-4144-a497-e4664c7d3881", "comment": "Malware payload (AgentTesla)", "value": "94476bc039d28fe2eff7ded726b30ff7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040635, "uuid": "d2f69f4d-3238-49e9-a3d1-ca92b8541d4e", "comment": "Malware payload (AgentTesla)", "value": "26ca530b9678cc03a3a794162ee7c5d0b96f6f389f0f97c98efd4ad10d1e49a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040635, "uuid": "ff5b62cb-ec9b-41ef-8bbc-110b035739e5", "comment": "Malware payload (AgentTesla)", "value": "e174d10d6ccf3c67965393e9d96194c5177e7f18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040635, "uuid": "552c6547-76e1-4578-907e-d90b89e1571c", "comment": "Malware payload (AgentTesla)", "value": "c37c2d9af9b806e87a2ccdc00c955a1ff224027a9476997cc263d7a8d7d80233b76ced086abdde667f170d5d6d60b461", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040635, "uuid": "e05214ea-228b-410c-a62d-e86c890fc285", "value": "97B423A5B3A30F63C6BB877A93283448EF2AAC54AE15CE13D18D7519D530BE70CD4267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040635, "uuid": "a6098de6-6c84-42b6-bcbd-22b3538345ca", "value": "12288:Vu9DR1jYvQemu/tZWA965eWcDguwwZCZ/hPjr:k1j3u/tZTEcDgMZCxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040635, "uuid": "6752fc9d-d20e-4264-9bf0-1d9517b627a2", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040635, "uuid": "e9d8e907-4530-43a9-8849-5a441e08d39a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040635, "uuid": "4454f296-74b7-4913-b5c0-f2f25e373315", "value": "NEW ORDER PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61981ec-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001745, "uuid": "d30abd5a-92cc-4493-8b77-bf72a27c5424", "comment": "Malware payload", "value": "eb437902ca11790f80408c93b9a9f527", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001745, "uuid": "2f52d6e9-33d2-4826-9234-29b897191800", "comment": "Malware payload", "value": "2793bbaba9d12a4a740b6c957143367ce1fb13bb98ecb122e2cb41728bed525e", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001745, "uuid": "c29f653d-1101-40e2-a04b-241ea548e34a", "comment": "Malware payload", "value": "7f429010a3006e9b39255d0e152a5c07f050d051", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001745, "uuid": "fc07c8dc-77bc-4df1-a74e-1c3caa0a3ebd", "comment": "Malware payload", "value": "615a493714cecc44f475f2d11d1ccaf183d61c54d2b4d9c65d37b543d5a913bebbf470c9a068ff3ed66bf93d6e51c9b8", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001745, "uuid": "268097ac-46a7-462d-b87d-b0dfa7c4caa1", "value": "4CA5D032F2A08833D1732E74AD5792955936FD103E38A8A777F92F4C4E356817A272D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001745, "uuid": "596fcd72-f12f-4a3b-8e05-2578ca661c9a", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001745, "uuid": "14ef5338-c7a1-42bd-abb1-899bd3ffd461", "value": "24576:7IZg+uinrPO37fzH4A6haDzcUZEIdT9TagtzCNYqtyxlQB6vxJcMw5GlHD:7g/rPO37fzH4A6hanqNu+BX5UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001745, "uuid": "e09d0950-0031-41a2-b333-6e3875cb6eb8", "value": 2182880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001745, "uuid": "3d950858-8820-406d-aa50-05be6bd6e7d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001745, "uuid": "dd348957-2c6a-48a6-a0b8-9811a87cd1f9", "value": "2793bbaba9d12a4a740b6c957143367ce1fb13bb98ecb122e2cb41728bed525e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a63c6b-90c4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617045953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045953, "uuid": "d1a22979-b02d-4d71-b868-f67c3b287208", "comment": "Malware payload (IcedID)", "value": "85c663c631e6283d78fc1a37323cf1bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045953, "uuid": "e30819d5-8baf-4328-9ad4-fa8259a10809", "comment": "Malware payload (IcedID)", "value": "286707e2bb83a6c40652e6621556895dec756bc7b8ddb16518e5942d6ec3665f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045953, "uuid": "f1d0d79e-ad3c-4208-9d48-154cec8fcba0", "comment": "Malware payload (IcedID)", "value": "c40d0c6d69d4b02b50c7c3c1a2bd0889d5e29d32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045953, "uuid": "27aad054-dd17-4902-a8cf-134954563942", "comment": "Malware payload (IcedID)", "value": "5bbaa3b87525963a766b25fdc56678af9bde7e3a3f0f1d2e8a2723b68569c3d8fcd88cdc95c74af2a4b12088514dad22", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045953, "uuid": "4abf4ae2-efe7-472a-9ad2-206833af3328", "value": "70135DC506310B33CA7566B2D4F26F18C22BF740B79398F7C15C7BA9C582588DB729A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045953, "uuid": "3fc34097-0cd7-4fc6-bf2b-0dbbdd7c6eb0", "value": "768:VZg+ZrV9rex+ublbcPyYo9mbBwhc8vCVK1SsOVpzhy:oieQub7Yo9m++8KVKwpNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045953, "uuid": "2b80353b-fe91-446a-a55a-29820ae92244", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045953, "uuid": "87147352-e5e7-40ab-8a4d-142606b54998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045953, "uuid": "2a2884a2-8fef-49d8-89e5-8a143f9e1997", "value": "286707e2bb83a6c40652e6621556895dec756bc7b8ddb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7348891c-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1616996506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996506, "uuid": "ee072508-4da6-4a83-bdca-554a768bcebc", "comment": "Malware payload (GuLoader)", "value": "8c21370f8d697a4d9ef0e8082fd0fcf1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996506, "uuid": "c4b99991-d09e-4208-abbc-21578b1c304c", "comment": "Malware payload (GuLoader)", "value": "289a5a8e60c4e17adb394e772163ed32d1a7a10bcb7c7526c65161f7ddd99d68", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996506, "uuid": "62958a6d-6b4f-4a43-958d-59d748663468", "comment": "Malware payload (GuLoader)", "value": "cae0ef2422b2fd43bf210ddfe5a45badc519fc44", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996506, "uuid": "9a5958d6-27c0-4f37-99d0-7c713fd1e5b8", "comment": "Malware payload (GuLoader)", "value": "37463d95a30a1f452069690b8396dcee99531965e20c316cc362bdef69c74b41c84a5ab86294f051329ef08143642633", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996506, "uuid": "7c9223e7-571f-4ff3-8873-167c1b7ae12b", "value": "05F2F15B5DC79A17050CCEF18D9C82ECF4BE5E486C68F3774A97AFC16D78122036A0A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996506, "uuid": "13412c05-b958-4de5-983a-a47788de659b", "value": "768:6QsrQpE7bhSqK12wkPcQsOBaFP08QOjYdq53qQw:p0XfhSb1BZQsO6nQEY0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996506, "uuid": "40432e28-cd25-4c66-9d2c-05a115a1ce46", "value": 35181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996506, "uuid": "9814c67f-f9ab-4466-9065-beda2cb20628", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996506, "uuid": "025211aa-33c9-4575-b040-92df72a3130b", "value": "Specifications Of Products.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259bd847-9057-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1616998953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998953, "uuid": "b04853ac-645a-4a1a-aa9c-db544b72643b", "comment": "Malware payload (AsyncRAT)", "value": "fce2aebcb9fdb8936037b5a39fd59e4a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998953, "uuid": "904ff335-94f5-4261-9447-e562ca567564", "comment": "Malware payload (AsyncRAT)", "value": "28a6a7005c318453d585e6ccb5b838d932263d2685d7002d572ac42fb5b5bb85", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998953, "uuid": "d9cc813b-f5ce-49fb-98bb-678b5284c163", "comment": "Malware payload (AsyncRAT)", "value": "fc79fee76bf73a21317360366bee67e82bb42611", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998953, "uuid": "7c13a954-9c52-43d7-b84e-d9026cceffda", "comment": "Malware payload (AsyncRAT)", "value": "5f59db007ddba82adb94ae1a75cbad8798191931f0a51f88842d7610f62a1ac0ac517b394e6ee7fa177091437e2c3e5e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998953, "uuid": "cae36bfc-2f6b-4bed-a9fd-3920c549c6cf", "value": "50F07DAC5948D0257A165CED929F510C5379E1B7E0BCC15550430C3B21A2FF9566F683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998953, "uuid": "6d8fc748-2dbb-484b-bd0a-80302dfc12e3", "value": "12:FFqJ4/17WmH29meCgtUt9WtkapJssCiJaKOZDzlMB3JFTrRUC:U2ysMQIlJsWUKOllIF3mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998953, "uuid": "1c64ac29-d888-4484-a37d-2552713bfc75", "value": 644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998953, "uuid": "e8ac4e98-6748-413a-933c-bdb69459d913", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998953, "uuid": "700b9bed-1ae6-42ad-9756-5ca64b0a15a6", "value": "Statement-ID344821730767169.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7618cd-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617054264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054264, "uuid": "8e032e87-3f60-46e3-ab95-0ffb27704c6d", "comment": "Malware payload", "value": "efa4b2e7d7016a1f80efff5840de3a18", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054264, "uuid": "71903510-d8a4-4838-bd5b-245846d112d5", "comment": "Malware payload", "value": "291c573996c647508544e8e21bd2764e6e4c834d53d6d2c8903a0001c783764b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054264, "uuid": "4426601c-f81c-481f-8cfa-96601a54d1c2", "comment": "Malware payload", "value": "04606786daa6313867c7ada1f0c9c925d9b602fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054264, "uuid": "c070c63f-1ea0-416c-b864-d3089efa9b8e", "comment": "Malware payload", "value": "da6d1de56bb0bf3fb5ab60957cc85635cd23453b8be74ca0b45565542f3765aad6610b9181dd01c720479513442d8d28", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054264, "uuid": "323e75cd-d33c-4bd1-a2d4-257ec188adcd", "value": "2E34AFB875143CD2E67F577BDA96BCDD23B63722998BA8CD806477C30163726EE12804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054264, "uuid": "19629105-cf2d-43f0-820c-ec71d9ffed86", "value": "787151c6bef6ee11d1d73736521d9ba7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054264, "uuid": "d5ef3cb4-a05c-4de5-99ca-ffbd2faa8965", "value": "6144:NgsO6Xkm0RsQNCR/JG+z5nLGcKYp05dMgSsXMH7/wrtKHRAwrcKxN:7GRsQ6RLhLGO05dMgrXwTKtKxA5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054264, "uuid": "bb6093fc-b1a4-4655-83a3-452ea31a79cd", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054264, "uuid": "02c73ca4-0f5f-4306-9336-0a54c7fa311c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054264, "uuid": "b156e7da-ae33-4249-9f9b-1b5fe0d78f5e", "value": "SecuriteInfo.com.UDS.Trojan.Win32.Injuke.25486.6608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be100621-9022-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616976445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976445, "uuid": "f7c265c9-dbe2-4a40-9bb0-17ba53453e2b", "comment": "Malware payload (Dridex)", "value": "acbe40f60f3f32b8aa5e640f8aceda80", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976445, "uuid": "b7afc87a-532b-492b-a9b6-971864497b99", "comment": "Malware payload (Dridex)", "value": "2938bf66b2597eb76926b60a97b4b7190c564c3ca549ff58dd7b0a29891d7ead", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976445, "uuid": "75f89c6b-86c2-4c09-8832-6980cf72cc69", "comment": "Malware payload (Dridex)", "value": "2b6eb8b9ab0741537c6029a1f57e7cff5e7d584f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976445, "uuid": "bbeabc22-d99f-4d9b-91f9-13b7d3c32fe0", "comment": "Malware payload (Dridex)", "value": "582cc31c2dcacc4c8c949cd1e14a79fc716b8b6558099e52c15467617309553699aa964381ee66476b0777ff806db1c9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976445, "uuid": "05e962cb-c313-4a11-8bf4-624a17cb3a35", "value": "E1249D2DD762C249FEF3EFF11356C22966A36C81091ED48DBAC1243F867F84E2149A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976445, "uuid": "0ea14c23-4009-48c0-a97b-1d39e2008df2", "value": "04422b9f28d0390e2369bbd1aee3e144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976445, "uuid": "56eeacdc-25a6-4a84-9640-723da207598a", "value": "3072:j327royJT4NB3NZ8PDF/fJf7EcOoWrrsq7rVUN/qwHe+b2YKWJt3Nm:jm7syEhX8Ppxz+P1epHmYNt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616976445, "uuid": "cb80d2fe-f752-43c9-a460-28e82bd9b1e3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616976445, "uuid": "0108cfee-9a0a-442b-9c26-d5a7abd6c6ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976445, "uuid": "3126fa28-474b-4ec2-9560-e5dcaba2d6dd", "value": "2938bf66b2597eb76926b60a97b4b7190c564c3ca549ff58dd7b0a29891d7ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6a7c26-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "5d4ddb03-bee6-49fc-b260-7c40301aaab0", "comment": "Malware payload (Dridex)", "value": "c49365d1a4206ec8b91af63bc4669932", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "fdef6d06-054c-4fab-848a-5c087e71cc97", "comment": "Malware payload (Dridex)", "value": "2988663b5818467c0dba2782da548133df2fa852728cb67fc6c297bb8e076fe8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "e23d0f56-3b3f-42a5-9ecd-1328f07fa1c5", "comment": "Malware payload (Dridex)", "value": "71a2b4a337c680201db96150ed94febb783d0b18", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "7fe88334-8552-4c3d-b5fd-2e333aedc8ae", "comment": "Malware payload (Dridex)", "value": "af5866d0cd27c67c1b5b4cd866bc38534551aad887ea601f7d23cfa8d2ead40bd5c633f2b3a4ee5b84b4ed586e1dd4d7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "612cba29-63bc-4029-9599-bf2d05516983", "value": "5214AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "b6c7ede0-4660-45e1-b966-32876d6b5cae", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "244b1212-f2b9-4de0-a357-87d53385e904", "value": "3072:QSpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:QSBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028195, "uuid": "6f1e3bab-1b6a-4ed5-93b6-aaa4ba4f3018", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028195, "uuid": "1674b936-a5f5-4fb6-af8a-ad0b2a03f4da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "47d6cd7d-cece-49a9-87d2-9e5cdde2b6ab", "value": "2988663b5818467c0dba2782da548133df2fa852728cb67fc6c297bb8e076fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefdd84f-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996230, "uuid": "4640526b-48bc-46a5-92fc-b10f5f257108", "comment": "Malware payload (AgentTesla)", "value": "8e84684a095359526eaee1140bd84c50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996230, "uuid": "5d341831-3f68-4b83-8108-dcb46a1efc50", "comment": "Malware payload (AgentTesla)", "value": "29e43219dc1b9239dab0ec49bc6e8c5d8790e4b049818f3abe6cf26bf3538e85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996230, "uuid": "bd890f16-ff3e-4cd9-b0f3-b126a0c8711e", "comment": "Malware payload (AgentTesla)", "value": "45a9fe8bd8e883824a18de547f44ac5dc29a3e76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996230, "uuid": "a6468b88-561d-46dc-83d6-73f4452eae60", "comment": "Malware payload (AgentTesla)", "value": "9460585d17a17370e5c829e134086a9c2a3f4f3d33a6359562cdd8e9d182e53a393d52632e089197ad8136435e6eeaf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996230, "uuid": "ddb21ce0-37fd-472c-a933-cfdeb7229d6c", "value": "573527AD1D49C8EBD2BD0AB842CD96D981E94AF31B11DC79BDD00FD7C1A2788FB06521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996230, "uuid": "49fe6c7a-a668-49a1-a58c-5f258c72bc1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996230, "uuid": "b434aada-51e9-41fc-b6b8-6cd8c9c891dd", "value": "12288:ysJDzFSvW1hxTm6xemUVYCTImIswiEH9QV6l+yu6Rex0OKAu0npnKy6HC4JolrdY:/zbgTws7EdQV6UAC0N0JKy6HCrlZ2Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996230, "uuid": "3e5110a6-7fe2-41bd-8037-ba0f4c3440eb", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996230, "uuid": "c60d71e4-80b2-4288-b718-627b5f75fdcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996230, "uuid": "3898c836-2a65-439a-9062-a26cfd431d20", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7904cb-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "52a1c8bd-a00b-4a07-b11b-87b6d6c61535", "comment": "Malware payload (Dridex)", "value": "bb64d0a5ddae1140c5cf0510bfdc4149", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "d47c1985-29cb-471b-b21b-f8668e5037a8", "comment": "Malware payload (Dridex)", "value": "2b71953a6694c785669cddca6e2b8ee9b418dff8470f8b8f7f71ea726b563110", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "20d44025-6359-4068-bc9f-fc0af17e747a", "comment": "Malware payload (Dridex)", "value": "18e6a7676f2a5e8766dd9004f12d3ca748579cca", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028195, "uuid": "5460455a-f51d-4d2f-adfa-0bb97a908310", "comment": "Malware payload (Dridex)", "value": "0d311d2ccfa1ff0a13f56e7ee8b5cde0bd579333e08c6e91f99f8c93cccb52333dc4329c2cf531c3521b684a5c6e229e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "f1d9d636-6655-470e-8ed1-151c6250e0dd", "value": "D314AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "5e59f8dc-8242-4fd4-a529-6f61fd13a4c5", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "0d368e0f-656e-4083-9d7e-f02f441a4ff1", "value": "3072:apRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:aBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028195, "uuid": "8a256d32-9bfd-4e28-a55b-aa4e108c7578", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028195, "uuid": "a9c32065-49b5-4a65-986e-bceba49fbfc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028195, "uuid": "4069a100-737f-428a-91da-9de2155dbf18", "value": "2b71953a6694c785669cddca6e2b8ee9b418dff8470f8b8f7f71ea726b563110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311fd7da-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028178, "uuid": "3b80a9f6-22db-4604-a98c-982ccc418fe6", "comment": "Malware payload (Dridex)", "value": "c0eb431bff34379520c71c9eb2086c90", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028178, "uuid": "7b61ea05-2ecf-4e99-8576-20ba414e80e2", "comment": "Malware payload (Dridex)", "value": "2c4ce04e7914a445ee32b72abd3f6889ccc5ad327f13edb10fa8268421c99073", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028178, "uuid": "c5fc6956-c84e-451f-9977-353fdf8dd985", "comment": "Malware payload (Dridex)", "value": "24ff6d984dba1d7cd8ce6c595223f95136be1d75", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028178, "uuid": "4037b124-645d-46fd-b9ef-92609a25eaaf", "comment": "Malware payload (Dridex)", "value": "1f30adab0799b31e22445af33d11fd7a332863a3aeef4ccadc4878ba9db576771169b5a64b0855ace8043fed024cea8f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028178, "uuid": "810c5796-09bb-4624-b80a-1cb045cde2e5", "value": "8514AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028178, "uuid": "4159bf57-2b6d-4bf8-a985-5c466bcbb1ea", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028178, "uuid": "7567bb70-7370-41ca-95a8-5c2d2bc90465", "value": "3072:OpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:OBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028178, "uuid": "91ac1e8b-be0d-4d9f-a00e-8750b9d31612", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028178, "uuid": "d14c7dbf-3261-408d-8f7f-fbb26d63a5f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028178, "uuid": "8e17fda0-ca3a-4c38-9e49-19e109f98f66", "value": "2c4ce04e7914a445ee32b72abd3f6889ccc5ad327f13edb10fa8268421c99073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ff4f26-9078-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617013360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013360, "uuid": "361b5961-2e50-42ac-8e0c-8e2e3d02ff42", "comment": "Malware payload (SnakeKeylogger)", "value": "1212b697b296dbd7ad36b25279af21c2", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013360, "uuid": "d112b540-bed9-4280-a20a-ae2f54581c63", "comment": "Malware payload (SnakeKeylogger)", "value": "2c6dd9607a69cf8779d56198bffd4856ce68f72966afb97861e2d54d6136907b", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013360, "uuid": "beee91b6-d8b1-458b-a4ec-9429955d0388", "comment": "Malware payload (SnakeKeylogger)", "value": "6813af268075220213ed6c6f93a3e8464be32ecb", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013360, "uuid": "cac2e47f-1ad1-4b9a-a33a-634d4b0dbc99", "comment": "Malware payload (SnakeKeylogger)", "value": "1caa09273516864a3f2bad8e617aede3054f2f7c20026a9d035aa580d18818cfc3cff2731e5303bb5d732fc3e46db952", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013360, "uuid": "d621c6da-6d0e-4481-9e3f-210cf35db624", "value": "B325E29220ECD291D422BDFCC96BD7E23717DEA38780E74635ACF4462277B9AD51340A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013360, "uuid": "08116b94-d186-4b8e-aa10-5d7c0f296278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013360, "uuid": "c007bde3-5205-4282-83de-826d241f16a0", "value": "12288:Ozt/LE/PqUHGTW2XJwK36B0csEax8Doni2CJO9Q8re3hymjA:UtLE/wTW2XJeB7aWDonvjBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013360, "uuid": "55f0e47b-1cd0-4917-a650-9a6612d406c9", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013360, "uuid": "a61c007c-393d-4cfb-9c7c-d48e4f093732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013360, "uuid": "acdb0155-1323-47dc-98f5-ac3444fecf65", "value": "ASB swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad22ebac-9078-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617013354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013354, "uuid": "02ba1b27-b220-4f37-b920-9c92f8fc76c5", "comment": "Malware payload (Dridex)", "value": "1e0e0ca284327f1067fb01f2c86184e3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013354, "uuid": "be6db223-586b-46ca-838f-3ca0b26edc8c", "comment": "Malware payload (Dridex)", "value": "2d3c1cd753ffcc8ac20dadf70c0cb9078449d2c8149a01f614e4aa6be2041940", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013354, "uuid": "efef6d94-dc84-4c97-a2fe-2f457180f0dc", "comment": "Malware payload (Dridex)", "value": "1ee1d70fd08289bb73db3e07d2c74590b900f019", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013354, "uuid": "95cf8395-8380-4aa6-8777-b62f93de7891", "comment": "Malware payload (Dridex)", "value": "7e172075be419ee41f529075910c52472c753715e12474143dd67a03f9ccb7c13f4f3dbf69e3866b20f182f9ced2237a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013354, "uuid": "76bdf488-2c03-47f6-8786-cd6856250e9c", "value": "D914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013354, "uuid": "cf1d64b9-b499-4025-baec-c7917fa59662", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013354, "uuid": "4acd8311-5885-40c0-8778-52894a0ff536", "value": "3072:s1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:oi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013354, "uuid": "55ed5c04-b12a-405c-b060-e2d03958f325", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013354, "uuid": "7f7df3a7-203b-48f1-bf7d-8962cd921728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013354, "uuid": "cca0160f-6c10-40fa-a6f4-1d29b74a5b5c", "value": "2d3c1cd753ffcc8ac20dadf70c0cb9078449d2c8149a01f614e4aa6be2041940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360bc880-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033340, "uuid": "1c342ac7-b66d-452d-8fe7-acbaebd42cf7", "comment": "Malware payload (Dridex)", "value": "aff6fc8b390bee0892cdf49ee8a50813", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033340, "uuid": "8a50c1f0-b2f9-4c93-b603-7ca8836aa01d", "comment": "Malware payload (Dridex)", "value": "2d735fa797ea49a60fe797d032ffa5d2a2ceb4f8ae88bfe77e74ae62fb0bb8ed", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033340, "uuid": "942e6942-77a2-49a0-804d-47b308cdc948", "comment": "Malware payload (Dridex)", "value": "ceaee0dad91a9059313fd44a169f90c3ab856220", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033340, "uuid": "c6dfe76b-bbb1-4d6e-84af-96184debcc94", "comment": "Malware payload (Dridex)", "value": "14968ccd4e4882ede1bfd3c48aeb47eeb8eec6665965a6e91d80817f225e227a004b4e00488bd5cb47a3633384d92677", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033340, "uuid": "9f06ae03-b4df-46aa-bbec-fc04e81118ef", "value": "DC84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033340, "uuid": "d5aa6b2d-ec6e-4859-9456-375d5f4f8a3b", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033340, "uuid": "08bd211c-bb8d-481d-a131-1430dc710fcf", "value": "6144:ebazNBbycfmKsyUlVyMdUFIk1KyHNwoAFpFp5xM+C1h:FzeTlVy/7HNip5W+Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033340, "uuid": "d140319e-8eb8-4e18-a3fd-a1f010f5392a", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033340, "uuid": "4d4367de-3e8b-44ab-beb8-44bf8f4fe3db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033340, "uuid": "3a5d02c3-bb46-4228-ba12-1d80151ad420", "value": "2d735fa797ea49a60fe797d032ffa5d2a2ceb4f8ae88bfe77e74ae62fb0bb8ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04b155f-9091-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024204, "uuid": "cfd2f892-57bf-4ac3-8952-7d265cfc4ac7", "comment": "Malware payload (AgentTesla)", "value": "9ed4723c7ce8c3c1896f75c6a4d3046d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024204, "uuid": "f30ac894-e320-49ce-a456-94401defc16e", "comment": "Malware payload (AgentTesla)", "value": "2e9b167ba5785c97060f505f545dc339ef7f0a1825fee738f8613e59f9dce937", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024204, "uuid": "1b3ca59c-4887-4de9-963a-dbf6fc50ec77", "comment": "Malware payload (AgentTesla)", "value": "03d0a825bf1f8398f8459399063480c4bfdc5f88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024204, "uuid": "75177601-c8d1-4f2e-90ef-3f331e9bf1b6", "comment": "Malware payload (AgentTesla)", "value": "2817e2705b83b71b484cdc88f15000e06823986aed68cd7c16ea0d22337fef2d6f33d6961aceb904e572ce8986dba0fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024204, "uuid": "af89793f-fcb6-441e-a3c2-c03190592e93", "value": "FBC42334D6393E8610FD37316B149FDB82F57A65F29321B32AEBCA0C6F9C049046D996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024204, "uuid": "2f48b5ab-950a-4ba0-a9c9-5feeafcd28c4", "value": "12288:J/52MuQPN3N5W3Mr+YZ5ucDfbYdBsO+QThfGaZoXc4Pu/TnmiRZn3dP:J/57u965JYP3nkc42PRZ3dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024204, "uuid": "9b43d474-b055-4a49-b386-01c4ae3ee820", "value": 578949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024204, "uuid": "9c74f210-e01f-4be1-822a-9894274e346a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024204, "uuid": "65163bfe-515c-4974-8d6c-5592b90865cf", "value": "11032021001#_AWB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87409874-90af-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617036912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036912, "uuid": "c9863d14-df1f-4adc-ac49-1796ba5d4186", "comment": "Malware payload (SnakeKeylogger)", "value": "642ddb719f3fe05f1d37aaa89078ee89", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036912, "uuid": "f4f82c74-92d7-4996-9487-d461e6591bc9", "comment": "Malware payload (SnakeKeylogger)", "value": "3045f6d838bb9eaf1c5034b4f486934b25b4be394cc050f894ac90648367db0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036912, "uuid": "5d7a2bc3-5e77-46b6-a142-d777a5567998", "comment": "Malware payload (SnakeKeylogger)", "value": "f741ea7760cfcfa61ab4b643e9468a36dfcb65e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036912, "uuid": "31c6d1cb-51ff-4436-af6f-a62facb09191", "comment": "Malware payload (SnakeKeylogger)", "value": "c60393acc81b02bbffdcb8adc81091a254ed5984f7eabfde8e6d31dc459b95c24ca4fa8be82c555f205774658f1cad6f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036912, "uuid": "6b6e7a60-2e11-4cc6-b154-962057067fb4", "value": "AA15339D5D57B3D9E00362553E0EF29DC17623A8BF16E29CD226F7B8372D0E434942A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036912, "uuid": "03eb6a49-ec0e-4daf-99df-9967d8831f4d", "value": "24576:eUauVZgLN5SMEPQYxKGIFMzFo+o4i2EBYT9FlnyQT:eU9VZgLNfEIYxKVMzFo+opwNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617036912, "uuid": "593f61f2-6c25-4f31-bb4e-d94508768eb1", "value": 920432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617036912, "uuid": "fcdf49f8-d20b-4c6f-af36-1dcfc3c84e37", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036912, "uuid": "7b16d0ea-b9b5-47ef-859b-417773e1b49c", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d03ca9-90a0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617030337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030337, "uuid": "588f74ca-0666-4661-8922-6cf426cbb62f", "comment": "Malware payload", "value": "2309a6542f4ad91446f82156d707971b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030337, "uuid": "8c738cb3-e81e-41ab-9f03-3a9178cca597", "comment": "Malware payload", "value": "308287db74987b5e32cf4d9acb97ef4acf243db054836ad808fcaaa7faf191de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030337, "uuid": "a072c047-250b-4bcd-b1ce-f31dff55d605", "comment": "Malware payload", "value": "9ab907d579147b099142b5deeac7a917e8a99991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030337, "uuid": "33667fe3-81e5-4a35-9240-b9708e4c6b72", "comment": "Malware payload", "value": "51eeb97cbbd7a2988e34f897cf7c5b20567fd558bdee39b4e3fdbdf6efea979889e9452a5320ca66d2c17d1e29e63557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030337, "uuid": "f462a41b-2b72-4722-851d-7a0c67ce5b9a", "value": "FA055A1AB2D7143BC03706BD492752645C3B7E202A96585A5EFCBF4C0F392A33D36E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030337, "uuid": "d58af5d9-623e-4e29-9f29-2dfa0b340db4", "value": "c00b6ba7dbbc6abee9ace3a65a49ba24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030337, "uuid": "35dfe382-5902-462f-9e80-21ae7ec6bffc", "value": "12288:rwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozE7888888888888W8888888J:3NzCtUpQ9WWPBSSRMTEpXNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030337, "uuid": "5f1440c4-5b6c-480b-a1e1-b9507b970a10", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030337, "uuid": "25e5e3b2-94e3-459c-b25d-0f81bc74c48e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030337, "uuid": "6b65647c-7f8f-4a78-9e7f-ace48f4e5c70", "value": "loading plan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b71cd7-90cf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617050672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050672, "uuid": "d10d13d1-3738-42f7-b90a-0df133d3f298", "comment": "Malware payload", "value": "ce5dbb9fe4118147b8357f15cee98188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050672, "uuid": "d9b7d764-b4cc-43de-bb36-685b28effbce", "comment": "Malware payload", "value": "30a292327e2f65edf2c2cfbd07b60435b1845dbd504b15ad47116ad9d5fb1084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050672, "uuid": "c4b11ba8-2e06-4e37-a57a-211aefd771fc", "comment": "Malware payload", "value": "9485ced749354a0d2dfb8ff5d232657435d8cfba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050672, "uuid": "4b1b7d28-9318-41cf-9810-7d372fd115ec", "comment": "Malware payload", "value": "32d882dd497c13e40d252105c89495ae5a1047e701ae2e7adae2b3f3607f2eff8ee1993e0bfd1b54d55840c9a6dcf3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050672, "uuid": "63aabdb8-9d6e-4b5d-a3e6-696996d70580", "value": "D815F1E93AA8DF84C5B947F6112620510BF8FADA1013EB4C5CC9F4DE1969F0C4EDAA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050672, "uuid": "d983982d-8762-4ab0-a204-d045ee3482ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050672, "uuid": "c313c24c-f2e9-4905-9756-423588036cb6", "value": "24576:VzX+oHdonRzo91oyC8r61jyyO74mW/syvsoYGY51a6HhPh:Vx9cxo91o/8rCGF4kyvZs51auPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617050672, "uuid": "a35ca6dd-c31e-4727-b9a5-b10150457396", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617050672, "uuid": "d57aa434-626e-46c8-a6ce-4a49c453d50d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050672, "uuid": "6248df2d-4e97-4db0-b187-fcc1d6b9916c", "value": "bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125f7d22-90a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617033710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033710, "uuid": "3a5bf171-f5b6-4f55-ab5e-bf7d8619747d", "comment": "Malware payload (AgentTesla)", "value": "12d79d92491d4489f7a44e34ae4f2070", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033710, "uuid": "5b2484b6-6a49-4299-a6f4-423b98b451e7", "comment": "Malware payload (AgentTesla)", "value": "30a5fc4d00e258b8048994904987560c2fe84b1ac7a67d4cef3634a009aa8635", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033710, "uuid": "dddcd7a6-001e-43e2-8631-ede28f519f1e", "comment": "Malware payload (AgentTesla)", "value": "941a6e7e438066c211619bc2971fc3b083240bb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033710, "uuid": "dbfcae35-6374-4989-bae9-3c16f221eefb", "comment": "Malware payload (AgentTesla)", "value": "7b64714d0d19b33e6d0050605224d6a5474bc87af71e0385c600ff9e1ccfd999a3baa5bb3134d40794a6dbbe5e33f3cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033710, "uuid": "296ec4ee-8aec-4c28-9be7-61e6687cc6e7", "value": "C325013A43387B11E12D27368CE4A52552B98D0533A2D3F6ADC0BCDC799E79895F02B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033710, "uuid": "9de331b0-8204-4f3b-b17c-3ae78ee59faa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033710, "uuid": "c99b60e3-0d26-4d8e-a7fe-229652a52dcc", "value": "24576:4tBixi/ESsI+bGaOuyp3sjaKgYr4U2/o:4qxi/sPbGxu68v2U2/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033710, "uuid": "71cddc81-08d4-4c02-87d4-b1135145f5e4", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033710, "uuid": "7650cc96-014f-45fa-a88b-2b693cbafa25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033710, "uuid": "5b44014a-9441-4a94-8218-0131a8b5d7c8", "value": "PURCHASE ORDER COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852b370c-90a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617033043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033043, "uuid": "bfdc0dfa-e371-4a77-93f9-ea307f43748c", "comment": "Malware payload (IcedID)", "value": "fcb0da7511d43759a209ecf77766139f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033043, "uuid": "22f991b4-46e8-4722-8f3e-274d796f2c39", "comment": "Malware payload (IcedID)", "value": "31405497b5a9ac591cc1098d3316d74717e18fec00a4f584495bd38c0b6aaf14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033043, "uuid": "13191e8d-1f68-4bd3-9c80-9d0f3a254bcf", "comment": "Malware payload (IcedID)", "value": "a58307ae4441289504f97cbc82596f197070edf1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033043, "uuid": "cf257e36-45fb-4f38-9716-6a45bc88a4ce", "comment": "Malware payload (IcedID)", "value": "144cef57376fd17cf7d3c7133bf7daeef7865c47fa9eaa98bed5fdce0a0d33cf4497450b9835825bcf94523466fd40e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033043, "uuid": "81bbda50-8ce9-491d-ae77-b64c61f9612d", "value": "F4133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033043, "uuid": "a870dd12-f77c-4dfa-8fb6-17a04d8da399", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtB6xEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBhsc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033043, "uuid": "6dc91311-e9f7-4191-86da-f7bc7bf50a2b", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033043, "uuid": "703666ea-a1e0-4f6f-b3a8-4cb0feecb93c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033043, "uuid": "ea42af87-0fbb-4f98-9dac-8482ece28b58", "value": "fcb0da7511d43759a209ecf77766139f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d312f4a-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002401, "uuid": "bf4cbb93-9012-407e-9d61-191de57a61a6", "comment": "Malware payload (AgentTesla)", "value": "7f41d579f4cee69165e3cdb3245fb2b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002401, "uuid": "fbbd250b-c6a2-42f4-91dc-9c2feab11a52", "comment": "Malware payload (AgentTesla)", "value": "318e15f1e25f8748971df87dc425a80e7ab9e97e55c61f7dc62d17b1a037b496", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002401, "uuid": "da341d79-552b-4882-81d5-b97b2c273be8", "comment": "Malware payload (AgentTesla)", "value": "decff5e3177e524a5f3974d539f2d30c5fdea884", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002401, "uuid": "2fd6c395-b20d-4520-814f-6e1d1669c0e8", "comment": "Malware payload (AgentTesla)", "value": "a79757a0868ccfe0b704ed2721afc07833453d3b94d780a01769c79ef6efba245e58ad4a07e7e444b384178d2fc4a950", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002401, "uuid": "b80adf93-7dff-4f2e-9aa2-8c4c9821e052", "value": "A3455A8C1E98C2C6E2794BB891D9E49943F56EF38F22CC7ABDD547CBC230B41E646521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002401, "uuid": "6c462426-6b60-40d9-a2d8-181c0a42f7d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002401, "uuid": "009af62f-c223-43ca-8e0a-9e98e13a406d", "value": "12288:WjkWfnqIQKN0i9e8sN4rqGTfiaSCulyw4CB9YDQeaMwtSLtWyCqd4/Ds:WjRySr17iaSCdG/Ha3Cq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002401, "uuid": "de5f6be8-7526-45b3-853d-f7f2574639d6", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002401, "uuid": "6308d6d1-0828-4802-b707-f817c246f4b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002401, "uuid": "588122b3-487f-4167-b112-5751b4942dc7", "value": "7f41d579f4cee69165e3cdb3245fb2b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c0ecc-9088-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617020219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020219, "uuid": "9170530a-418e-4363-97ee-0b4d83e2e15e", "comment": "Malware payload (AgentTesla)", "value": "c12e2108d6bb92c35d2cda441f0465bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020219, "uuid": "c3255d90-5624-4541-b935-6723a22cf58b", "comment": "Malware payload (AgentTesla)", "value": "320ef88a7e07464ac67b3dad28a0cc6e2bf66300bc53ac6b293d7f14adf59e89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020219, "uuid": "1686ddbb-11e4-4ea4-bfb1-115c81009da5", "comment": "Malware payload (AgentTesla)", "value": "ac1d5cd377e635a772198f723c19292b7ac0f486", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020219, "uuid": "840a5cea-3e1f-4d04-ba7f-9d0b18f9a685", "comment": "Malware payload (AgentTesla)", "value": "e12bd4674550ff3755ce971e38a5ac3aa2433be95531299f9622cd489a4c83d1744803825a4ae2b26392ac8d66c3279c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020219, "uuid": "9f512e6c-63ce-470c-9a23-a190284da764", "value": "40355A5113271616EC263AF41010E371E7B0DEA5A13AB6678AD43CD7B8B1FCCA93AD74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020219, "uuid": "724af794-620f-4a7b-ae5c-8228be7cacb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020219, "uuid": "ddf7ac8e-3f42-4df3-9012-1b4524f4bdd1", "value": "24576:wHFxFMpn6Z4esLcnobsl76AfxRTCbJ9XQvA3W3:wjFMTcnoA7/DmbJhk8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617020219, "uuid": "5b19b647-945f-4bf5-aac0-c0dd8cf3695a", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617020219, "uuid": "7d4b6f7c-818b-47fa-aece-b27dcdecd14d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020219, "uuid": "dba57840-399a-4566-955a-2fb048c8cf7e", "value": "Proforma Invoice No.42037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab3d8e3-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617029456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029456, "uuid": "28c8cd04-8f0c-45aa-a6dd-a905e3eda30b", "comment": "Malware payload", "value": "16d3f6f137ae711bbeaabfecba9b4e55", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029456, "uuid": "ff6cd233-fee5-4408-b2ac-0a2ba8a68694", "comment": "Malware payload", "value": "323801ba5097ac4e2cd6a889e0281711fa59b02318883f112d27ac41aa144c63", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029456, "uuid": "69c282e5-e386-4755-b017-04f7792b759d", "comment": "Malware payload", "value": "38b24cae35f744ec40e93b772a77edbfbaa44222", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029456, "uuid": "f3138bbd-b8bb-4c75-b4c4-c01c1772ee92", "comment": "Malware payload", "value": "9a628a67566e1046ae8d00b31477766004a9fa4ab391923203775ac7fe8700d4d6d360136d5db5cb99f21e946baa2161", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029456, "uuid": "ea034849-197e-4021-95a9-a78c12d6f608", "value": "DC749DD83AA9DFA5D97887F6102120550BF9EAEA1013DB8C4DC5F4DA2479F4C0EC9B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029456, "uuid": "11df6ac5-15fd-44b9-ba22-e2c3af1ebc28", "value": "6144:2D2iyoddl1w+kI2LkF+7kLXk96SIA/H0zIcpj1HSl6:SddII2LkA7Uk90h3hHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029456, "uuid": "f2c01769-999e-4a4a-a1fe-bcc310fe165b", "value": 349720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029456, "uuid": "f6874e6b-5b08-499a-bcb5-da78f4de07c6", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029456, "uuid": "dae807c0-ce3e-4e42-bab7-39b7a1edc451", "value": "FFE Items.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9491883-9098-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617027118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027118, "uuid": "9dba3fc9-6468-4636-9384-a91cf78a3c5c", "comment": "Malware payload (AgentTesla)", "value": "08d87a6c271d851ae01e0c12d10bb8ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027118, "uuid": "c736d9f9-ce2a-460a-aa87-b2a6915767c0", "comment": "Malware payload (AgentTesla)", "value": "32c3ae8cd868f60dc052888ac37dda6e70a4e524a290b0e0aaf32967da7490db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027118, "uuid": "3e19cfe6-2288-4124-ac56-81570862ad0d", "comment": "Malware payload (AgentTesla)", "value": "5cecd888e56a477bd7e65325ae1c9dd78d4d55ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027118, "uuid": "07d32df9-73aa-4d31-9101-2e390a8c7792", "comment": "Malware payload (AgentTesla)", "value": "cba6354a82e718eafff6a4528fc7b847b1f7730cc0f6194072b1c6f80b37111a55a5348411c8556fff1c4794989461b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027118, "uuid": "db279605-61f5-4900-babd-5179f140978e", "value": "05C3F7FD6B1009EFD99EF8368042764A6239A4F72846941F488B41E3D93A7D72CD847F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027118, "uuid": "d8cc1196-ec55-410e-a186-eea59d6dc140", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027118, "uuid": "c586d5e9-48e7-465f-852e-4b949fdd02a4", "value": "3072:/Rrpm0xg6ZsGPHefNGhXcSWBwqPsQtleY7W:Jrpm0hsgHAN6wUQ7f7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027118, "uuid": "c8a77664-cce0-4671-af1b-dec847c02aa2", "value": 122400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027118, "uuid": "f2254d4a-3be5-4b44-94fe-c1d2a483044d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027118, "uuid": "b9d4e917-97fa-44c9-8307-dcffa11d96a5", "value": "STATEMENT OF ACCOUNT 290321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d11a10e-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002455, "uuid": "a8cfd446-5e39-4dbc-94c8-a706874471e7", "comment": "Malware payload (AgentTesla)", "value": "53cbb91272801963c8a1939f01533edb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002455, "uuid": "27c75567-64dc-49ec-9671-67b88dd24f64", "comment": "Malware payload (AgentTesla)", "value": "331279bc9c13817a232fe692d7e4dd433c48ef8066609d728914844e2e52adb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002455, "uuid": "b40e991e-cd0b-43ec-8530-7871fad6d977", "comment": "Malware payload (AgentTesla)", "value": "adfe0bbf2dc2ba6bb77302494702fd0d70597b82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002455, "uuid": "2339864c-0df6-4fa2-8e93-ee70a8dc35d6", "comment": "Malware payload (AgentTesla)", "value": "075e1cf6177678cb83cf7ce395f3cfcad436a91d3fabde4e395ac54f832ec3d461fdc0f4d93ae36a1315c894d0240cce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002455, "uuid": "30890627-63c6-4844-bff4-3e3b70a3eba3", "value": "BB45498C1E98C2C6E2794BB891D9E49943F56EF38F21CC79BDD547CBC231B41E606622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002455, "uuid": "af4995bf-b891-4cec-b0eb-7df58a57475c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002455, "uuid": "f96e1092-936f-4c38-9bcd-bacd9bc6d917", "value": "24576:qtinFV/0+G2t5zb6th7dPKxPtQmcZ500CJq:LFQi5zIPWPetZW0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002455, "uuid": "6cf92249-e085-48b0-85be-efd529126b87", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002455, "uuid": "3d696d06-2bb7-4908-826b-adbe55ba0ba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002455, "uuid": "b3f4d65c-603c-49e3-8855-d257820a6156", "value": "53cbb91272801963c8a1939f01533edb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9665210-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996221, "uuid": "3102bf79-51a6-4553-8fb5-874392ff7ad0", "comment": "Malware payload (AgentTesla)", "value": "907af9a8e65556158609af0657f4b589", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996221, "uuid": "80189a43-c1b1-4535-a27c-b079adc781f8", "comment": "Malware payload (AgentTesla)", "value": "34652beb65bfa2651fc5c64633f14625ccb5645a527f70169a100c46fb4e0c8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996221, "uuid": "b12e0c7f-7cac-4e23-9ad9-5046c75d86bf", "comment": "Malware payload (AgentTesla)", "value": "e5b18f6dabed93c1664e8ec4ca9bc92651278312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996221, "uuid": "abe005f4-600e-4d36-ba76-8a94c09c11d7", "comment": "Malware payload (AgentTesla)", "value": "349bffb03ac0d689b0c55d32c71f308f4e44a929f4e6f1efd1310cc56cadad2c70cf11891129c8b59ffbb159af61bacc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996221, "uuid": "6b19b7ac-eec4-4ac7-a31b-87363d201475", "value": "D2F4232A1655C7B45310C6906A97FFBC1896DC43C369C73E4E3A44F8B5E031EAA4B2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996221, "uuid": "e67455b9-6533-480c-805f-138fa6cc3567", "value": "12288:WoyV4qBZ5nod8cZ9Be1vRnFXNgbkDgPC/fYg+4mK9SMhSLu+INzT+pvLxx43uP/X:WGqBZt+ZerdukDgP5g+USVOzapvVx43m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996221, "uuid": "68326d4e-1229-40bc-b3c4-39fa52d270ed", "value": 751144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996221, "uuid": "1c135dac-09f4-420a-a52f-b6a7ac1595c1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996221, "uuid": "6a16e42e-0744-4e21-9339-d26f424c4ffd", "value": "DOC.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fef20a8-907e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617015774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015774, "uuid": "662c7f25-f23b-470d-b6b6-5f80736eca4d", "comment": "Malware payload (AgentTesla)", "value": "69e475205b7bde4acb57e800b901a92e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015774, "uuid": "0908d336-bb95-4fcf-919f-a54bae883c67", "comment": "Malware payload (AgentTesla)", "value": "346aa54aa87f2e7ac4bbc695905bb32b9eded49190efc84e3b610b443571d006", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015774, "uuid": "bddea7d2-4093-4dfe-a744-3e94b37c2748", "comment": "Malware payload (AgentTesla)", "value": "aaedd850add00e38f5b1564ef8096e066c281a72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015774, "uuid": "ba6572bb-0f5b-480b-ba13-11f00be23e20", "comment": "Malware payload (AgentTesla)", "value": "c6a71c5e2a7f14ba163028bc5daa30a18a6d71e74c8c17bcc025ecee6a9871a8d27a6737ec5a477afc66191cc97a70e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015774, "uuid": "572b0cb0-a0d7-43f6-be57-ed50b94f4a69", "value": "5515F78C5D9EC2CBC6350BA882CEC5E946DA5FF34F22D8BAB9C847CBC121745F506526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015774, "uuid": "c7ac9077-64ed-4d51-b778-80e76b7284b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015774, "uuid": "c25ecbfa-939f-4287-9110-6de714b579a9", "value": "12288:Mbr1JVF0Fa+WuEvJ1bmmc3df8LSDcvMYOV/gBqId/IN3kSPYWn:21JIIJ+YSDuvOVYBqm/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015774, "uuid": "b6e94b69-ab63-4455-bdca-7adbc6bd9f85", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015774, "uuid": "ffdffcca-2e19-400e-bd83-4f9dc64de446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015774, "uuid": "d2fb44bf-28be-4c48-a3aa-68bbd793da25", "value": "20210324000190100100.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232fd111-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617031590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031590, "uuid": "dc462fd7-85f0-49dd-a227-61f77b3a5440", "comment": "Malware payload (AgentTesla)", "value": "c0a88f82e73daa3829091ebc030dcd5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031590, "uuid": "3d3b3bf6-e84f-457e-bc6b-7e5893246d6e", "comment": "Malware payload (AgentTesla)", "value": "357788b8d4dde7db4ef4bbb0032c2eb439f52cb9ed03534f1cc8316cda7a951b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031590, "uuid": "c1a4b481-6a4e-4cee-8154-b65b76582a5a", "comment": "Malware payload (AgentTesla)", "value": "ef38fb21fec9ca63102e65847c409874f8edb006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031590, "uuid": "5b6cc935-8f56-44d1-b45b-e5e76b451050", "comment": "Malware payload (AgentTesla)", "value": "0ccde131b80c76af63c672f7dee2b3219826e5329cb02dc725d359114ea81133717927fac98874eaf96dfec031d0f5b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031590, "uuid": "ca70c8ab-a2b0-4fd9-a9ce-a4f59be8e5f8", "value": "7435CF0B3780BF8EC13F0F7794129600D3E1DAB38227F7CB6DC656DC66CAA598A1A155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031590, "uuid": "f3c6d914-37e1-4fa2-8b22-fc01f8dfae0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031590, "uuid": "84a1e6dc-55e2-4ebd-b814-ac0639046395", "value": "24576:lnID7be7HBkK1zlIH6fzo1vAz7hKxc1kmHB:lcne7F1ha6ro1vW7hxkmHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031590, "uuid": "e71b07ff-29ba-4872-aae1-bff518e8c01f", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031590, "uuid": "324e9da2-a03e-488c-b969-c2958d044ace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031590, "uuid": "971cfcce-c3ba-43e7-98f9-86a677b4736a", "value": "GS_ PO NO.1862021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0543e3cb-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031540, "uuid": "1227b787-d24d-4085-b1fa-71cbca560cdd", "comment": "Malware payload (IcedID)", "value": "57cba8e5051829696cea63f82969e749", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031540, "uuid": "412b18c3-d819-4bbc-aaba-1612eb27dd65", "comment": "Malware payload (IcedID)", "value": "3599c78976e7f97a61715e544d62ca6ff4d123f1e735b27991e8c548dd114c3b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031540, "uuid": "a8ac667d-69bc-48c8-9156-40759b6767e3", "comment": "Malware payload (IcedID)", "value": "b12ec173d9f83d3cbe884f2f232289cf839b8b0d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031540, "uuid": "df4c2d5b-abeb-4b56-a33d-6e8433995bfb", "comment": "Malware payload (IcedID)", "value": "30c154c238338bf8d8e2de07f34bae1ff9a534d11e075ba252e7a9b884137c581c5e22def966189ee7c41c43d97bc2b0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031540, "uuid": "5f815a89-1f7a-47b7-8e7e-31e7b5024fa3", "value": "7604122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031540, "uuid": "a68b8ae4-a0d8-4021-9493-4090d26a3213", "value": "3072:m3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:mnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031540, "uuid": "2cbc5cec-cd21-4266-b122-1fa9d7bddf61", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031540, "uuid": "b9d3fe92-1c36-47bc-8f92-50d48947d6b5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031540, "uuid": "ae556918-b60d-46c4-b71d-a8bbb7664962", "value": "Claim113481509103292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e02c985-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028280, "uuid": "33dbf4db-e0ba-4558-8af3-22d48cac2393", "comment": "Malware payload (Dridex)", "value": "ce6bf6cae1c612bf9fc307fd8d0f0a13", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028280, "uuid": "53fc2ef6-5e00-43c5-b5bc-787fef3c69df", "comment": "Malware payload (Dridex)", "value": "35f7bcf7f2de02f7f3d906b378e22cc985e60bffb88536b6ee3e035b5673a110", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028280, "uuid": "fd1a7c1d-be13-46fc-81b3-8ed6d1f5f389", "comment": "Malware payload (Dridex)", "value": "09ef502e48faedbedf774eb26b733ae9b975a148", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028280, "uuid": "e6ae9d30-2e63-43d6-9fe7-785602335486", "comment": "Malware payload (Dridex)", "value": "15fc3926cf1817a80f7132789908f1cdc58042029939d3bb3bca23f83f27afedebc08004022ba396460bf051e44548f2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028280, "uuid": "4d0c8868-e162-4547-ae9c-ae8404751b45", "value": "7514AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028280, "uuid": "5aa8c979-57e8-496e-bbcb-8b490c087351", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028280, "uuid": "4d6bb77f-2429-47a8-9fbb-6ac96a89d208", "value": "3072:YpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:YBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028280, "uuid": "c0f3a8f3-ed3e-4c0d-9b25-e3c954e86017", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028280, "uuid": "56093674-7ac9-4878-8e50-cdfb12c322d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028280, "uuid": "d68c421e-07da-459d-85cc-4ba6eec3d56d", "value": "35f7bcf7f2de02f7f3d906b378e22cc985e60bffb88536b6ee3e035b5673a110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d66f63-90ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1617035479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035479, "uuid": "979fa9f6-5911-49f4-b745-b86d6c60c4b8", "comment": "Malware payload (Pony)", "value": "0c39b9652b6052f53c93cd0ae23fe05e", "object_relation": "md5", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035479, "uuid": "3746e540-c604-4a86-8df0-e5909f68a893", "comment": "Malware payload (Pony)", "value": "36a2efdafea1d72bf9e33353814e92f43b13aa156b2c55150e268d7f98e2bf20", "object_relation": "sha256", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035479, "uuid": "df602249-424c-4be7-b339-cfdef6b26346", "comment": "Malware payload (Pony)", "value": "d2151d4319a9b6378e33b9043df63c7a5cab4281", "object_relation": "sha1", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035479, "uuid": "5f9c8e0a-1c1e-4ebc-9471-909495b24b17", "comment": "Malware payload (Pony)", "value": "38042f7a9b835b8cb4afed65f54a394677c9dbfde64f934c2ffb6cda8ef272c399930da18d9e77827f3db4b21106af40", "object_relation": "sha3-384", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035479, "uuid": "c5bb648e-e7ff-42b5-a500-2e3e871adf53", "value": "EAB3AD8338459700C3C828BB7D7DDB0E8FA2C8C53A3ABD9959FC6724A50695B2D3D574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035479, "uuid": "6e50c0ef-0fe5-418e-abbf-ed69e94f7140", "value": "ba78e32c08ef1499d6baf614f69577a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035479, "uuid": "d6286015-b555-4560-9337-af37a1807420", "value": "1536:zS3zpLaWcO9F1JPzHSCqPImk7H6aDWjeUtA2kmV0tZIwx:FWR9VBP7H6/jvtUtPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617035479, "uuid": "a67ad904-6aaa-4479-a955-cc2f5ff45759", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617035479, "uuid": "eecd0b67-7c3f-4084-be3d-313964814b66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035479, "uuid": "c0f4450b-0f67-4556-9e9b-9e13cd57b0d5", "value": "36a2efdafea1d72bf9e33353814e92f43b13aa156b2c55150e268d7f98e2bf20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406e1028-907b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617014460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014460, "uuid": "d5016cee-e5eb-4a38-8e6b-5dd900325372", "comment": "Malware payload (AgentTesla)", "value": "35c8473bc7e06228cf5c79279a0ff23c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014460, "uuid": "5bb92d99-1437-4372-ac13-39130facfe2e", "comment": "Malware payload (AgentTesla)", "value": "37b4554d3a1af6213496e3f45e36a7b7ac6760ba90671bc27d0fa5d9de2c3291", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014460, "uuid": "482b3aff-6759-413c-bed0-d5d2fa0dcd9c", "comment": "Malware payload (AgentTesla)", "value": "8b8a5b57c1feabf2c0ce5a1e62b4720c8d898953", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014460, "uuid": "41616c7a-ef76-47a2-85f5-c626899c7119", "comment": "Malware payload (AgentTesla)", "value": "b505dd2cd708361f490b02877f93302c621f30639b6d02f4394ea0bab6d997446db6bb37d164313607ae799b63994c8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014460, "uuid": "1f20a84d-57cc-4c2b-86b1-7da569928191", "value": "FB94232DBFE2601F75F43A6A1896A0FD56E69FCC45B9B2F0A065D361200B30C9CF466D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014460, "uuid": "efd93a67-fef2-43ab-83fd-a05716b55d0f", "value": "6144:XApgzfZvNEEPm4C8MLHwwYudzkRI7nfjBZKKCEy0eZeWQ+EqG6PEcWFPE7ZNiaeW:fhvNDmmMBRYofjuKCEy0e07qXNiap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014460, "uuid": "c660adc8-70eb-4a36-af41-56c7bd825dd8", "value": 420062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014460, "uuid": "b97f9a4a-ff28-43b3-8905-7ee8797e921a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014460, "uuid": "42d99b9b-06f2-423f-bfba-ec5c2334df3f", "value": "New PO.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d6223c-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617027939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027939, "uuid": "7a2f0baa-8e41-4dfe-80e7-daa9e57ae53a", "comment": "Malware payload (IcedID)", "value": "9c8f165dd13a3b8d4a10175472fde7fa", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027939, "uuid": "cc33abaf-3407-43ce-8ba2-53683bf7b388", "comment": "Malware payload (IcedID)", "value": "37bd2c0c290a4d2c9ae16551819e9ba92f86b66808c0ae1fc20a2e4e18c38d2f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027939, "uuid": "068d11d4-f0e2-42cf-a393-85fbbd39ae31", "comment": "Malware payload (IcedID)", "value": "4eb37eb52c499e390de2ae6c30df046ce0a2d21a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027939, "uuid": "30cf0168-34b9-439f-a98f-28ec4228a936", "comment": "Malware payload (IcedID)", "value": "ed23e86058325f5d36b22c619e24819660f850b4fadf39bf12c68492a43edb5dcd69d77b6a011df9d9dc46fad3dcb7d3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027939, "uuid": "2998b09d-519c-42c8-863f-2ea7e6a7beb4", "value": "77B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027939, "uuid": "acea3214-8a4c-4550-861b-9f77e6058207", "value": "3072:m26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:mLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027939, "uuid": "32418cb7-1b55-4734-9ac7-a39395545837", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027939, "uuid": "057e51e7-75fe-40ae-a41c-77ee3f19cf6f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027939, "uuid": "89281d3d-c917-4b41-8cd9-3524f9637c96", "value": "document-693432745.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0292dfc0-90b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617039267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039267, "uuid": "c21fa6b8-80a2-478a-969e-1dda54b58a63", "comment": "Malware payload (SnakeKeylogger)", "value": "53f1c3ca96c9024dd35e49dd5b26bef6", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039267, "uuid": "fcd2dc36-89fe-438f-be46-6749ec309b5a", "comment": "Malware payload (SnakeKeylogger)", "value": "3812844a9b34279cf4687649d6b4c4e06625d6ea043fc564ee33881fe29cf2f3", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039267, "uuid": "6d969c50-c7c9-48d7-b063-fd3aedcf59e2", "comment": "Malware payload (SnakeKeylogger)", "value": "7c2320a43d786b61b1e137a5cbc0f0c585cdb287", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039267, "uuid": "5665c7a2-87ca-4356-8b52-ef680252598b", "comment": "Malware payload (SnakeKeylogger)", "value": "dc8eebd5cbfbab231419121ed6fed32ec097fcf109296ef323e7b79dc5868c35582270ed455e9f6ca38bd4ba317b8298", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039267, "uuid": "05f4cb6d-0381-485e-b86f-a7ce6e4adaac", "value": "6F9423626F6983F24DB44C901D19E9E33B21E3D3449038AD22835E68E5DE91DBECF19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039267, "uuid": "e09fa7ee-ed8b-4e9b-9044-34ecc58ece70", "value": "6144:NutARqsNlwEbOCFpfOaM4+Co+/u6osKzZUy0oksSvw/KkP+hkpFyg:NuGqI9bOC/OacCF/T1m5KwiO+hk7yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617039267, "uuid": "f52e8de3-5837-461b-85bb-61312709cc07", "value": 434721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617039267, "uuid": "7c6161bd-7a78-4d10-b67f-ff728950dbaf", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039267, "uuid": "f24140ce-a8cb-44c6-a4cb-73f1d450bd6e", "value": "TNT express consignment.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbd5ecb-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005838, "uuid": "7c8c5944-77e4-4b64-ac53-f7760aa153e0", "comment": "Malware payload", "value": "c32880c8aab9d28e042f023cf5ed12ac", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005838, "uuid": "a2f17796-1c0f-4a18-bc4e-c96cf60e0e40", "comment": "Malware payload", "value": "3816722f95463c51bb6203427a2c1947332e231bea0cd1297abfb8b89d109326", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005838, "uuid": "d9271212-13fb-4558-90e0-ff89a461d31f", "comment": "Malware payload", "value": "9d0ea1c11ef3f6ceffc4bbb3c335d5e62e0d11ab", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005838, "uuid": "1eecf83e-6472-4bd5-8c7d-cdbe2b0d0919", "comment": "Malware payload", "value": "c3dd8327ce62e89b914645295e20a5b7d1a1bd8fe08ac4061322b8c64ca38d86626813c6683db945f17aec197b72616a", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005838, "uuid": "ec9fd0a5-c421-431c-8280-64425642c8a7", "value": "60B6F101EAC59873D8B3013416B79BAB597A69202725C5D3A7943C387A707C17A3B3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005838, "uuid": "994002d5-a6c6-4ffa-a7f6-55f2c224e7bb", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005838, "uuid": "c11434bc-4553-4c5a-bf85-eaa23e5adc13", "value": "196608:O9berPbnqDFirG1H/rVaSedU+IL5ABx4m:FnqDFtfYU+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005838, "uuid": "f06d80b1-3cf3-440e-9397-f0ace28a24c4", "value": 11315912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005838, "uuid": "1b33694f-1bbc-4e9f-a449-d77c2c0f649b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005838, "uuid": "c30aeaf3-fb33-4c11-9d4f-c6f7a8e34fc2", "value": "3816722f95463c51bb6203427a2c1947332e231bea0cd1297abfb8b89d109326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5052b1-908d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617022289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022289, "uuid": "0ca06b16-9020-4c4b-8b5c-50ccd5bc957c", "comment": "Malware payload (AgentTesla)", "value": "d863903f17f9ff92d34ea61debc1b935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022289, "uuid": "23a9cc55-b0a2-4f6a-b289-5326680d6737", "comment": "Malware payload (AgentTesla)", "value": "38bc355e686e8fa373e64148d848bb3cd744208335596916871fbebc8a030e30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022289, "uuid": "2a2d238f-de1a-40bb-9988-e5ccddbe62f4", "comment": "Malware payload (AgentTesla)", "value": "9e4b508a075ce76c4e93b095d8d7f6ea6c5d0df0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022289, "uuid": "8986c18d-1841-49a6-8936-e7c0d9900cb0", "comment": "Malware payload (AgentTesla)", "value": "dfba39ffb119081e60ea29295f0aeb1f32c3571ae9daeef1cadff89b07a315e661570a8738dd0edfa1821846cde6014e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022289, "uuid": "61450fd3-be42-4fa4-93ff-2fb98f2db555", "value": "C0258C21E694ABB0F03D73754432173043FDAD0A9626E6BD7D8831DA49B5AC085F7EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022289, "uuid": "9b62201a-8035-49b5-90b7-6182e1aea18b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022289, "uuid": "87e7ff1c-d8b7-4f35-a7f6-7d32fa58e399", "value": "12288:wIuTKQ/XG5ebv+3rwHZJ3up2Kfo8ssDubDazGj1:g/XGwQEJ3+fo8pgDam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617022289, "uuid": "cd63a417-1446-473b-abb3-7caf68df3425", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617022289, "uuid": "47845eea-5c14-4990-8c11-0f47354c6e82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022289, "uuid": "98216f34-f481-4229-900b-1214eae59916", "value": "New Enquiry.MORROCCO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50de1cf6-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028231, "uuid": "a2b94c85-d6b3-4b73-8856-d5309a38b7f5", "comment": "Malware payload (Dridex)", "value": "bce3d8f77b8af8a1ff1e02b0d5984ef7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028231, "uuid": "37d0c114-a42d-40d3-96a9-08b0de1b5101", "comment": "Malware payload (Dridex)", "value": "392abd1df81cfdc0c1c34ae224753531d57b10fecf01994afaa43304f2afc7d5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028231, "uuid": "2c58b133-fe74-4988-844b-862b454448ba", "comment": "Malware payload (Dridex)", "value": "8a96bbe469b8cb5b1894011f94f9b4393153cb50", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028231, "uuid": "73e57a64-8c9f-4172-bfca-fee6759e737b", "comment": "Malware payload (Dridex)", "value": "edb6e32688b95a171b9bee545adccc0e03a3ca3902f9724c2cac8a6810bc4b1a88cc9bba9b872d763408a72a7aa581ca", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028231, "uuid": "531dcdb2-4b3b-4153-820f-444bdce77811", "value": "A914AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028231, "uuid": "976fd4d1-da79-4aef-a6d5-9ec813300399", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028231, "uuid": "2dd3a8bb-5457-4b9d-a072-1558d575b664", "value": "3072:YpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:YBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028231, "uuid": "695db81a-487d-43ea-a6f1-db27fb0b9150", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028231, "uuid": "a9672a3b-53ff-4dd8-ba32-4e2525e0d25f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028231, "uuid": "164d7a8e-526f-4a18-91ae-7f601549622e", "value": "392abd1df81cfdc0c1c34ae224753531d57b10fecf01994afaa43304f2afc7d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30651cb-9080-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617016826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016826, "uuid": "a00386ac-8b1b-4e1b-8385-db3e2fd39401", "comment": "Malware payload (AgentTesla)", "value": "a227259a14f37f9adb1174e46d2fb992", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016826, "uuid": "78ed20d3-1486-4543-92f1-44b18601db7d", "comment": "Malware payload (AgentTesla)", "value": "393337a88cc9ee6d7f03fb62ddef86a0b1e087d7ec43e977a316493925caf03d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016826, "uuid": "3c3650b5-4b42-41bc-abe9-b7cd5bcfbf80", "comment": "Malware payload (AgentTesla)", "value": "9dee20b161b319ca3276b0f8013d9ebb0eb1c1ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016826, "uuid": "c6890275-5078-496f-bcb1-028d0a6fde47", "comment": "Malware payload (AgentTesla)", "value": "a7d628e25015a91cee82c5a1ca88c9dae9618b30050b09448d1f9cc7b3cde8069f993d38d8ce69b12690d8cd4f4129cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016826, "uuid": "e8b0adb4-defa-4dae-bb72-a56cb16ad908", "value": "9E35AE2D62501B63CA3C4FF1A8D6A206A37C9C2635B9C7458EC1B7D5277AF42388F54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016826, "uuid": "7163534d-a714-4af2-9c5d-742fef840dff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016826, "uuid": "2a5daa51-e7b2-46bf-bd5b-dcc734499fa2", "value": "24576:QqEca1LtnvUm5TsvdOQjmsqTmttgCjNlPqW8r+F2:sca1LtnvUm5U/m16zzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016826, "uuid": "08cae102-bc6d-41c8-abd2-d921e36ce8c8", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016826, "uuid": "75e7c617-3524-4d77-8388-2ce6edefcd96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016826, "uuid": "391cd241-740a-4de3-a51a-0b4068dc9c12", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8869e5-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "c6ca61ec-8a2e-4d00-8a33-481d991c8b9f", "comment": "Malware payload (Dridex)", "value": "335279f0a5b108d85745a1b40c74d39f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "ec411370-a39a-42d2-96db-fe96cb9b0bf4", "comment": "Malware payload (Dridex)", "value": "39379f2a9a115c0c96accc3ec807ce252989f514465d356686dcb0ee7d612dcc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "3f37a054-9f58-4cd1-ac0a-090e97182049", "comment": "Malware payload (Dridex)", "value": "bcfc1e2a8afbfd3f66b0a079b99524121c93bc73", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "93837ddc-5d57-4ac2-85a6-65b23f98eb79", "comment": "Malware payload (Dridex)", "value": "790f51573c2d4f8db276ae67b4948a2aa1255f9c97199769460f26d69283a410f09d2275fe9e2c5256f8c4c6fe218d4a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "d5d94768-8fa0-45de-a6d7-9358822e2f23", "value": "5714AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "b837b01c-37d5-439c-ba8e-d6e3f077a653", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "a2560582-4c05-4fb4-9bd9-af59843e54ef", "value": "3072:2pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:2BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028175, "uuid": "aacaeaf9-d235-4629-9eb8-11a717fefb02", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028175, "uuid": "d3655b37-b159-4709-b23f-a1a33d05ba83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "2e73c803-f750-4f79-aff8-c6d14ca507bd", "value": "39379f2a9a115c0c96accc3ec807ce252989f514465d356686dcb0ee7d612dcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20110359-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028149, "uuid": "b4d9f473-9ab9-4153-92f6-f4644caeff2e", "comment": "Malware payload (Dridex)", "value": "2ee667d83eb03b59db3aa658fc9c0964", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028149, "uuid": "0d71001c-1a8e-42f4-9207-33a2110ba5aa", "comment": "Malware payload (Dridex)", "value": "397a93c63dc890aa9b8af356c8dbb6fdb7bdf06aed50de044f2a6d07d463c6fd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028149, "uuid": "31ad8feb-d83a-4344-9353-56a897d0f05a", "comment": "Malware payload (Dridex)", "value": "0865646ceb45f3855148b5056ee0da425e4d608d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028149, "uuid": "7e562007-c77a-4d60-a130-09360a642142", "comment": "Malware payload (Dridex)", "value": "f71caebced17bf52ab1a643b8249086a015169065cccefa6b669a529ccd996b5dbea78f517dd901258213df0f7670471", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028149, "uuid": "736dfa7b-ecb8-458d-8d43-109e0f010447", "value": "DF14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028149, "uuid": "c38625d3-1e02-48b4-85cd-f47e4a48f4fa", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028149, "uuid": "34a5c975-7f50-4e92-a1e6-c61325a5e15d", "value": "3072:NpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:NBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028149, "uuid": "f3c78ca0-f5e4-4e61-85de-cf09fd419ab3", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028149, "uuid": "c1e6ab38-e05e-471e-a64c-ec78b1a7a609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028149, "uuid": "cc961cdd-9e85-4eef-90b4-f5aaaab94cb9", "value": "397a93c63dc890aa9b8af356c8dbb6fdb7bdf06aed50de044f2a6d07d463c6fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af195f4-909c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617028543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028543, "uuid": "2a947f46-2711-4d9e-98a3-958b266ab42c", "comment": "Malware payload (IcedID)", "value": "350e72fa00c7808b805d997e075902f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028543, "uuid": "fbb8d16b-bac7-4fa1-a312-9d7474287cc1", "comment": "Malware payload (IcedID)", "value": "39e9a1261310ad753c0d61c9101b4a5d363c89b7f83a003e6d447db8d09436ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028543, "uuid": "790a3c48-4d3b-47ee-8f79-234c1bfaf56e", "comment": "Malware payload (IcedID)", "value": "c8ae4d7f7ce974df41eb2723b86e95f59507956e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028543, "uuid": "aab5533f-476f-4feb-b374-06dea8155187", "comment": "Malware payload (IcedID)", "value": "b73c81a42ec89defbff08f040da76340e040e22f904e41a346561942b2061acd1b002398589bfa44c8b34cb45b69d920", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028543, "uuid": "38ccb0e2-1471-4406-8895-6438cf385bee", "value": "FDA4F71AD6380BBDC512E879C517A433E1713C2502E889BB92E467776F32768FD6E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028543, "uuid": "8b201c6c-57b6-4c57-9aac-a864f0880864", "value": "896f4618011fc8c614eb9c9053bf51a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028543, "uuid": "12e90c2d-d377-4515-84d5-7cd97cbfc82d", "value": "6144:7uvnWwlxWgg8x/V/f1VK2+3uGWppAPFXYcaUohGtfJTzYJwa:7u5g8x5K2+R4APGRUoOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028543, "uuid": "d294d0f4-4526-4b2b-ad37-7ebb67473297", "value": 484214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028543, "uuid": "55794009-c75f-464b-9620-921aaed1e7e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028543, "uuid": "b9589913-30a1-40eb-a66a-32c51966f31c", "value": "39e9a1261310ad753c0d61c9101b4a5d363c89b7f83a0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2485f11-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1616998357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998357, "uuid": "3273031c-2325-4e47-bdef-e7c60860d321", "comment": "Malware payload (njrat)", "value": "b522c9aeb8935023380297c44981513d", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998357, "uuid": "a7cd2f52-4c61-4c0e-bf1d-faf2a818ddfc", "comment": "Malware payload (njrat)", "value": "3a1aff915146803fcc9e416994e6c4962134ba981f98207314fecc6a0cd06133", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998357, "uuid": "e830d881-69be-4e53-a1ee-e76d144015f3", "comment": "Malware payload (njrat)", "value": "57b28bebeee95145d693a69d29e42af4152f2a9a", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998357, "uuid": "ea3ee1f3-f600-43f9-9c12-1413160b2850", "comment": "Malware payload (njrat)", "value": "7cc6e78d218ab796531508f72519e75a27c6b47ef13babf9831516704d716854b5c41740fe0878e179075a4190ab8948", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998357, "uuid": "1b84e3b9-dcf2-4472-8d91-34141230a0d6", "value": "7F5413F93705CD86E40875BE467D23C521B53272418FFC883C6DEA2E4BB98DDB80595A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998357, "uuid": "b3c84ee7-83b5-4b8f-a5a8-0dbe50bcb168", "value": "6144:rKq8vTo4Xt+QYDV4PR4/3/sAfMPuaE7AG3a5Uu:rcv5Xt5wvseMPHE7A0a5Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998357, "uuid": "b4c68182-e1c5-46b6-8932-e0d0be000f41", "value": 283354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998357, "uuid": "2f3edd7d-b172-4238-9fe8-d29583121da2", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998357, "uuid": "291b604e-7c7f-4fd9-adf0-efd1be3e29e1", "value": "29032021OrderRequest_BituChemLTD.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7b5774-908e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617022642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022642, "uuid": "4ddd09e6-75ac-4d67-96c5-88de0810a91a", "comment": "Malware payload (AgentTesla)", "value": "a458d5a43d647c212e67dff03f48f70a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022642, "uuid": "7a2a19c8-fe87-4bba-ac2a-afe61ffec4ad", "comment": "Malware payload (AgentTesla)", "value": "3a53c02706b5ffc376f3ef9ba5d28df365b4607954659c42d1d4609204200914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022642, "uuid": "c50b16b1-bc17-481a-9c72-2d8b594f17e1", "comment": "Malware payload (AgentTesla)", "value": "7882328fd651d4174cabf3dde4acc79f99621e98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022642, "uuid": "97d6ed1b-3d2c-401b-a550-55b76533d241", "comment": "Malware payload (AgentTesla)", "value": "fd3910ad0b471455a31375b2469269eab7f96aff255010815ac85e8914ad7636f8ccd0596dbd00ada3c78cdc83b411ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022642, "uuid": "e85055aa-2717-464c-8b08-1f6cd336a42c", "value": "6F05BE7E0699A527C07FD3B488E40003B331A12BF5D6AB1A56D1C6E59F66723788F70E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022642, "uuid": "2cafb828-b666-4ac9-8fe7-c8712e360fb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022642, "uuid": "ac98bc28-0f8d-47f6-9928-99b8a81c2f46", "value": "24576:OAl+m47CmZhBK40efFSo8xC2Jvo14aVlCvqrZZ6MzKYY:T47CmZhBK40efFSo8xCEbWC66MzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617022642, "uuid": "46c90928-4c5c-4ad9-9daa-5f037e5335f0", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617022642, "uuid": "83b42642-68b0-4987-9a56-aa9b3d9914ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022642, "uuid": "5d58c24c-792b-434c-87aa-4e51e225d93e", "value": "REQUEST FOR QUOTAION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7044b132-9066-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005520, "uuid": "157b43fe-feeb-422a-9647-95d0a9ecb8b9", "comment": "Malware payload", "value": "c0e20d0b3011455a5f9ff9d7f5a39dd1", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005520, "uuid": "7e420600-932a-4a64-993e-cca5448ee90d", "comment": "Malware payload", "value": "3a64941353e52a3d8fb3bc898189a0d684b1a88a9c5fdbc496ef58738f42c444", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005520, "uuid": "1206fe2b-cdae-4a39-8e67-75f8389e6368", "comment": "Malware payload", "value": "bf1d475cfc6fdd656770b9d9cdac5342cafb9c2a", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005520, "uuid": "e1df3f38-47b9-44f6-bfb1-8efc231c01fd", "comment": "Malware payload", "value": "88e1f080738e85aded5e5aed06b4f782cc4ee58bb002e0fa2be9eee4087147b5112dfec194014c994365a8635d29a7e1", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005520, "uuid": "d28e6ca2-2d14-46ac-9f4f-5b37569701e2", "value": "D8C60101E9858973D8B3013552BB9BAB497AA9202715C5D3A7D43C387A707C17A3B3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005520, "uuid": "6f01d305-d74b-45de-b813-d7d1153ca7f0", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005520, "uuid": "acab3e43-7b20-464c-b0b4-b62a0888fe75", "value": "196608:y9berPbn1E7KvCBbxj/SB8Dux5YV/DIYyLXH3:xn1EmCX/euVDIpXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005520, "uuid": "53b7a5f7-9cd2-4d83-82d4-d31e03b643d0", "value": 11812040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005520, "uuid": "1a75ddf0-cef6-406b-bb44-08501da3219e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005520, "uuid": "06132920-d1b7-4a21-af76-d4c3b355d32e", "value": "3a64941353e52a3d8fb3bc898189a0d684b1a88a9c5fdbc496ef58738f42c444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d4dfb5-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028124, "uuid": "b0ffbaf9-d5a0-4a80-beff-5243c43fe973", "comment": "Malware payload (Dridex)", "value": "77f7d82fc0756ad87b8f37923a1f933d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028124, "uuid": "fd940ebc-79a2-4b37-84b8-97dfbdfd41dd", "comment": "Malware payload (Dridex)", "value": "3a778a4e2392d1e0370d052b84ca4696f436fbafcf3fb8a7e3d0cf057fd0a967", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028124, "uuid": "6bbdad07-67a1-4fb9-b5c1-0acc324ddbf9", "comment": "Malware payload (Dridex)", "value": "c049895bd3d21d36ee853b52ce812cc9778a13d7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028124, "uuid": "1a1ab0eb-0307-48a8-8307-0ca29f2e90ba", "comment": "Malware payload (Dridex)", "value": "6be495fa61eb8ec72741a02754923dfa9f215aa0c40525b2b7cc5db36de62aee5a8208a13277e0b98f62ed318f4dfc59", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028124, "uuid": "9d675867-3e1f-4454-939e-d5e1f3e02f14", "value": "0514AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028124, "uuid": "0172fba2-bacf-4aaf-8ead-3d253bcd77aa", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028124, "uuid": "95b19ea2-bdb1-4f49-85fb-0015111abeb7", "value": "3072:DpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:DBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028124, "uuid": "6f5bc31c-57b5-4998-bade-441a46e7a163", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028124, "uuid": "8e058120-c85f-402a-bda0-228bbc2d627e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028124, "uuid": "896824a4-4863-4e9b-b0b8-f5b1e3bf10b5", "value": "3a778a4e2392d1e0370d052b84ca4696f436fbafcf3fb8a7e3d0cf057fd0a967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88ffb00-9025-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616977832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616977832, "uuid": "0c462b87-5642-48d3-be4a-86c7e85403da", "comment": "Malware payload (RemcosRAT)", "value": "292610aea0626defa6be2f62306fe8ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616977832, "uuid": "914faaf1-2d2f-4ce1-bcb4-02a22c69d0e5", "comment": "Malware payload (RemcosRAT)", "value": "3a80ad81bdfbf133bb92fca5ca32477d0079be2bf26872819fd29d81bfaaf1c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616977832, "uuid": "e622500a-24a7-4574-8cc6-d6909e1d41d5", "comment": "Malware payload (RemcosRAT)", "value": "d34879a397e1e0074b5bdadadba29fc2f4ed0d47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616977832, "uuid": "5a5f7f79-5871-4bd7-baf4-fc8115030293", "comment": "Malware payload (RemcosRAT)", "value": "126a0a01328a101f08ea515d7f5fda1766b4e4cc12c86c76c8349300657960801ece6628fb0701541b245b0c0604dce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616977832, "uuid": "e0db4156-08ca-4c88-b028-453c07ff1514", "value": "B1E301A211F44477D2A1167006ABEB3EF7F6E31102261A1B77AD5FF52D223CBC81664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616977832, "uuid": "e50eeeab-54d8-45ea-bd40-0d74ec2f63ba", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616977832, "uuid": "025bad57-4eb3-4689-984a-58d0cd85dcf2", "value": "3072:vTs3BxJNmJTNtPxIkKUFeiB+usOZhFRWyYaypGT4Z6c:vAPYtPl7YiB+567WyYfZ6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616977832, "uuid": "d389e0ed-e7e9-4d3f-8bc6-f91491a0af33", "value": 151975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616977832, "uuid": "86e821e8-411a-41c3-9c9e-2aaa651362ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616977832, "uuid": "831a721e-4fef-41fd-af5b-52261a84867c", "value": "G014 & G015 SPEC SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895f6d53-907d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617015441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015441, "uuid": "2243c4bd-8538-453a-8783-1a21325b23e0", "comment": "Malware payload (RemcosRAT)", "value": "c0f41a89ba4da5c89d63226843041635", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015441, "uuid": "397b1dcc-5dca-4661-9636-9ed4c2476051", "comment": "Malware payload (RemcosRAT)", "value": "3ac78afa830ab7ae38acebc0913229bc97a641aca960c2191daeecd0431759d0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015441, "uuid": "3dfe3ff5-7976-4a66-8f05-f0a6ec992ab4", "comment": "Malware payload (RemcosRAT)", "value": "cd368f1f6e7c80c0640f90804023598355a76ad6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015441, "uuid": "7729d717-1c31-4af6-a62e-6a11fcdd677a", "comment": "Malware payload (RemcosRAT)", "value": "71d4d85f7e5eaa8b96bfdfc0cbd574dc04907e7e405ec454b3ed0bdf4f3a606327fc85a6db1fcf40f129166bb337a5ec", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015441, "uuid": "c6e571c7-6e20-4fbe-a2fe-ffa240aab2c4", "value": "5EF313B0E2D0959717A2D4E27F00AFE7E940AFD1866D4A771723F12974E4C98DA2381F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015441, "uuid": "ade9967e-16e3-4aee-85d1-2960b04484a8", "value": "3072:D1Mph4LSdD7F+7mkXM1gc8TBY8NzQzthDO9h/8ot4o5PNzR1CzL7k:LLSBw7RTVY62Q9rtP5PNDo7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015441, "uuid": "b7062bf1-ec0a-4f48-9697-b2433f7c56cb", "value": 168496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015441, "uuid": "0ea1a121-1d4a-44e8-913d-ae1d0f1da999", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015441, "uuid": "ca348ff2-9a80-4758-8c4d-2e548e6391f7", "value": "REQUEST FOR QUOTATION - PR30016810.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ac1c81-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617054256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054256, "uuid": "b811f29c-a9f9-42e0-90e5-b712d8fae215", "comment": "Malware payload", "value": "741151649d1b412fc1bfd480d18f4e84", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054256, "uuid": "42a8cb30-b7db-4899-9380-f7e1e3b5e647", "comment": "Malware payload", "value": "3b90a0400e326fe9249c6829be0fb43d64dabe38fbe903109f29c53899e74f5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054256, "uuid": "d78b4508-8a48-4e51-8677-4d35a6bb0240", "comment": "Malware payload", "value": "5c92384ecfd76e5b4bd0ce9654eab00c66ea9857", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054256, "uuid": "7cc00937-a8f4-4533-87da-3c2a02d71368", "comment": "Malware payload", "value": "0d2264d498797ef3d409959753f9a511f8505c8a9a6474abef60ec4fc6495ceddf0d934be0626b0df67000ce8b44c8e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054256, "uuid": "82530053-ed75-4706-8759-d57e23670a35", "value": "CA54AFB8B5107CD2E67F577BCA96ADDD13B63622DA87A8CD806476C305A3331FE06804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054256, "uuid": "578c21bd-b878-4aa4-bcb8-f78678e010c2", "value": "6445acd2e4bc351402584ccad64eafe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054256, "uuid": "85afce6d-2a44-4ea8-8a54-30ea865cf43b", "value": "6144:ZZYhrtJL8YSfesdrbtyMq/1De9ruT8mT+LxBxU598uZTKlilGN:ZQrf8z7BE1DMruT81Xe9MDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054256, "uuid": "b8034de6-c468-431b-9d70-f13736c29bd9", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054256, "uuid": "36977888-c962-444d-adae-1a4f71f293fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054256, "uuid": "601e44fc-3442-41ae-8c50-fda202a59980", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.241.20916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba8fd6b-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616999822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999822, "uuid": "efc8554b-c7c3-402f-a21e-6e37fea88b0c", "comment": "Malware payload (Formbook)", "value": "b4c673cac8fbc1b73f91c2759be8d089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999822, "uuid": "2830b9d1-5ab0-4968-9fb0-34ebd1c31858", "comment": "Malware payload (Formbook)", "value": "3ba0da5db0ccdbabdfd7e95fe24a1c43056b77893dc6c589ede0a2a4ba365cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999822, "uuid": "5db55902-53c4-47f1-9493-dddfdc69e464", "comment": "Malware payload (Formbook)", "value": "e2f639474539943cd334b1979e43d605d7377abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999822, "uuid": "56423682-40e2-4140-a8af-85b4ef072859", "comment": "Malware payload (Formbook)", "value": "35ccba826ce15f651902ace2746bf939843d347dc2dfaec8eeec29fd43b4b09abbefff22c5e1728e5dd56ac39be58d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999822, "uuid": "2b65f872-f6e0-4082-a483-fa328dca4491", "value": "CEF4D48C1D99C1EAE5350BB842C9C4F746EA4EF30F22C87AB9D697C7E020786F516536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999822, "uuid": "9afdf552-60c4-4ad9-acbd-a8a6c60c86ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999822, "uuid": "b3ce4321-08c8-4540-9c80-b7b62f29ae69", "value": "12288:JG3mJknBurVWtmaXMGgvpUtckVlO2xGvVyRFduOB7:TkBuAJXMmVlRxKVyH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999822, "uuid": "e7397d02-e8de-4b27-a46a-687676a726f9", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999822, "uuid": "379ec844-200e-4f11-bff5-8f74049a3a37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999822, "uuid": "53c3034e-80f1-4181-a47c-574561700128", "value": "TT Remittance Copy.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069787aa-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617025530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025530, "uuid": "d6c127c2-2fd5-4dcf-9030-5983a3fda5d3", "comment": "Malware payload (AgentTesla)", "value": "2cc05a1c5eddac8787d2aba98ba1fdc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025530, "uuid": "0c90437f-4392-4bda-851c-b483cadb4aea", "comment": "Malware payload (AgentTesla)", "value": "3ba5a5d27f209c05b6af95dc9299d5fb37a6a7332fc6871c427eb9b13c477377", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025530, "uuid": "c27b7222-195c-4834-a8ad-1e8909efa70c", "comment": "Malware payload (AgentTesla)", "value": "bf07f86c118c065a420fab70b050b0356616a56f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025530, "uuid": "a521bdae-e90a-4670-b3b9-749dbdd385f3", "comment": "Malware payload (AgentTesla)", "value": "f8dfd0c5321a04307d491c5fbeaa44dcce8c295c0690d1bf1e3d3b77ecba2e37840e1d270fa60e6b19b39f4c4dea3a80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025530, "uuid": "ea080c0f-970b-4d75-9683-98eab4fe58c2", "value": "C6325C00D6DDAD62C79EA2A782956A0C8339B93F277B55B97D0C52423F7030B4EBC574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025530, "uuid": "8c4d73f9-fb56-41a4-a0c4-891738c6fbab", "value": "192:wYqVki5OqtHeGWKzQ4wK4divN3Rf/8XQazcDRrEY4eTAYERL0Qnclu4nxDZE2XsD:wYePztJTk4tlt2f+rEY4eT5E9XoZxDmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025530, "uuid": "eb0e7146-15e5-4f07-98b5-b06539c8ffae", "value": 11816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025530, "uuid": "3d4ba41d-a8a0-4767-9c32-0b3c5460baea", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025530, "uuid": "f3880e8a-5823-4b5c-9410-465fd31f174c", "value": "2cc05a1c5eddac8787d2aba98ba1fdc6.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43948dfc-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616997715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997715, "uuid": "6a331e57-e82b-4edb-992c-688209210fbc", "comment": "Malware payload", "value": "372140d7c2c68dc2c8dc137d1a471e9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997715, "uuid": "5490f3e7-f3b9-4fe8-9556-581f1527c93d", "comment": "Malware payload", "value": "3c38e7bb004b000bd90ad94446437096f46140292a138bfc9f7e44dc136bac8d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997715, "uuid": "21362c6e-debd-46af-b209-8f4f8f04dec4", "comment": "Malware payload", "value": "986f38a04937ede2000e8f25e59ea438ee265e24", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997715, "uuid": "e7952516-a91e-4d73-9574-c1cd8907504a", "comment": "Malware payload", "value": "19eb53098cc65f5e8942a60698dfc646e87f9e38522b84765bf38c8f1ec3836f2fc84e7efda59e6ceaba44491df34f94", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997715, "uuid": "3a4db843-1594-4888-a1be-a9105ebf8247", "value": "7013186A73189E391D83D52BDB92F1461D8A01C7C9A87400B5EE7909F73E135F0B7A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997715, "uuid": "d54b5b32-9595-4a6b-80b4-b01ea411e8f4", "value": "768:8P6TOzs0KfYxIAcBHbWBVcVdFX+xWMzDYUbrf+wqI/+zD5:8z40qYxTcBHb/VdFX5gbrt/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997715, "uuid": "4300afbe-d93c-4472-8b54-ea0aa97ac13e", "value": 41655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997715, "uuid": "9588397b-6bda-4196-921a-8d3bc558f9a5", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997715, "uuid": "5aa30f47-f940-47e4-9c14-5e99fcd1bd4c", "value": "3c38e7bb004b000bd90ad94446437096f46140292a138bfc9f7e44dc136bac8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12069e9-907b-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617014622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014622, "uuid": "477f5daf-ac09-42ac-90ec-b7d4cccf7280", "comment": "Malware payload (BitRAT)", "value": "5368930e073889874745e520be58b06d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014622, "uuid": "f7b0062d-edb7-4526-baa8-31c2ce339502", "comment": "Malware payload (BitRAT)", "value": "3c433cb1c5fbe7966fc5545c22a795866484b7bab4600598629939ed4a542b01", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014622, "uuid": "38d5ebcb-5295-43c8-a3b5-645bdd118b6b", "comment": "Malware payload (BitRAT)", "value": "cbb7af7ecc36efcabcb470643bca94989c4dd4b8", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014622, "uuid": "44366ba2-e59b-450b-8494-cfbe33947cd2", "comment": "Malware payload (BitRAT)", "value": "b176796bc7d3877cccdde0d593d81ba8bd57c2f215f1ed69a51e709e5eb58325b8e8ef9257e7ed7c2b5a7f8c601b46dc", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014622, "uuid": "e8c2a219-567c-466e-a971-b4b0c06aae1b", "value": "ECA5230C9A8FD92BD316CBF68177E0B9077EB9C4FDD702B5750AA84EE9ED16D0100A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014622, "uuid": "1e64400f-fd4f-448a-b23e-7613316d691f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014622, "uuid": "4a253d81-38f3-460e-8e7b-ed40bd7a732d", "value": "49152:2W/ExXa6l03M2hVE/5JF+gpUqQfSkrrvzlPo79L4NoJ5ROq5W:dEg6G3M8K/F+gIakvelQCOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014622, "uuid": "74e2268e-e514-426b-8566-264c5dfa9c5a", "value": 2226176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014622, "uuid": "10a8c865-8fcb-4ffb-864c-afa4a139fd98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014622, "uuid": "5dbe813f-491f-4d38-beaa-70f97775f879", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.24731.24808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3901599c-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616997697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997697, "uuid": "28619397-0d3f-42a1-bdeb-a705613ebecf", "comment": "Malware payload (Formbook)", "value": "a87d8af1f352d4cbe0072988b0c36097", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997697, "uuid": "f4fb3bf6-c817-45cf-a829-1b34534ec772", "comment": "Malware payload (Formbook)", "value": "3ca011a75b097e940ac3eadfd3b34539bbd95f7b5da1aac81b0704bfe0dad82a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997697, "uuid": "72096a5d-4f9f-4809-944d-e20e2306d5eb", "comment": "Malware payload (Formbook)", "value": "2efe8ad4aca0549f2c7f235fc751c18d19373bdb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997697, "uuid": "09dad297-7fa6-4af5-ae29-5148cd3e5d0b", "comment": "Malware payload (Formbook)", "value": "89c91475694f3afca304ee4c14f6d1ab955f1a91092df13c49d1cfaff3267000851a87b7457f2cfb0000321ae18cecb7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997697, "uuid": "a9206a24-6e5a-49c2-89d0-2ea25ca3a5d8", "value": "F3C53315E8CF4F6FC12A8EBA895CE88C153ACD056B218C40B6BE7A6B9476770234537D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997697, "uuid": "c0fcebb6-ca91-44ca-b276-ea48eafc84a4", "value": "49152:Ikjm6Wcv6OKQQSR5ZIpTOLjBtczKi1eehMn/4IV51szuop/+6r:Ikjm6WM9r0I+D1r4/4dCo1+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997697, "uuid": "2ff797db-218a-4bb3-a4f6-c9b0ab77b26f", "value": 2609152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997697, "uuid": "666c6c78-6981-465c-b797-ef08a480ba0a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997697, "uuid": "e6d1e638-e28c-46cf-ab78-3b6849f84c2e", "value": "MV Sky Marine.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca825e30-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616996652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996652, "uuid": "06be8e50-71fa-49c5-89d4-5cea3af9e213", "comment": "Malware payload (Formbook)", "value": "185797312bebaf8572f43f95872c7d6f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996652, "uuid": "866b9551-a69a-4a4d-b1fa-ed053d55a47f", "comment": "Malware payload (Formbook)", "value": "3d281c53a3267d17f47165c537955d1e904b97bac28d9b3845e17b2367fafd8f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996652, "uuid": "d47b9067-aed7-4d01-9337-18899d1af79f", "comment": "Malware payload (Formbook)", "value": "bdb5faa60c2a61e408005520e9b71bd1c980ea26", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996652, "uuid": "7a2f502f-153f-4555-b390-048c2be9f6eb", "comment": "Malware payload (Formbook)", "value": "6f7fb684a384e44cecf533fb4fbdb9f084016e059aecddb6994371cc6446814e8dab284b060b9c355aba86fe0b47ae9e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996652, "uuid": "56d28ed7-5d7a-4ef0-9843-8cf1de78e51d", "value": "5A94233D1BA0E6FDB66138BBC1BD110E3CBC9574818D7791F632A549161ABECB82C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996652, "uuid": "9d4f8073-af18-4786-b0cf-dfcd36e640cb", "value": "6144:nBKdWFak21TS0FFZvwowbrqLC4wGAoyhKJRImZ/rn8fWneWKI3t4WEwoOnCXppIG:B79av1woOrqaAamZjn8fAeGdvmO6IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996652, "uuid": "43c22294-2947-4f33-bf27-c6660965f174", "value": 409598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996652, "uuid": "5a0e1d95-5045-4fdf-a714-bfc9d75623c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996652, "uuid": "7069cfbf-7efa-4357-bdde-4405658d7477", "value": "Order_PO-0186500.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c396fd3-90c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617047255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047255, "uuid": "8d87b43e-6b7b-4f2d-8901-ed7ba96f7ca5", "comment": "Malware payload (Dridex)", "value": "e304592773f40ae15360ee26f7e771f3", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047255, "uuid": "fe82e528-d593-4c4d-a9d1-8ff6388a4f5f", "comment": "Malware payload (Dridex)", "value": "3dca4ce0016f3996b0ac8c3d1ede6e4ee00a1ad8366fb1ed0514b24ff97c8589", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047255, "uuid": "d8a025b0-0456-4bcf-a285-36a044b73f4b", "comment": "Malware payload (Dridex)", "value": "efcd4ebf664780fcb2442c479d95b9fdfbc04736", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047255, "uuid": "dcefb65b-2d42-48a0-8b4b-0fbc39d5f7a9", "comment": "Malware payload (Dridex)", "value": "2ef98c5518d62e784f2b1b9d4041caf894db1e50f6ca7b7af0d473c62692eef42f96f50e718ed381ff0d6f7e5a9f25dd", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047255, "uuid": "7dc4435e-178d-4e4c-8181-843cb14d0a0e", "value": "42C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047255, "uuid": "a2f2cdbb-f826-4037-be55-99794ef24a4d", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047255, "uuid": "b027b4c0-2fa0-4250-b8fb-b80f2e512b25", "value": "12288:Ht+D1yz/1SXpqDaoWmusFZHk3eBWIcbd:HcA1aLoBx4eBjcbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617047255, "uuid": "50d134c5-a685-41e2-808e-7dcb67884a4b", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617047255, "uuid": "50ef40c0-5257-4300-a00f-49c981dd11f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047255, "uuid": "8fc8f94e-3e56-4bdd-84b8-13017518627c", "value": "3dca4ce0016f3996b0ac8c3d1ede6e4ee00a1ad8366fb1ed0514b24ff97c8589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ab4c2f-9073-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617011031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011031, "uuid": "f72a83fd-062f-41f1-904b-794eb187f180", "comment": "Malware payload (AgentTesla)", "value": "624c95ba81dda68b948141556ec124cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011031, "uuid": "31c11235-1d4d-4691-b33b-cc5c112ad3a6", "comment": "Malware payload (AgentTesla)", "value": "3e56702678b933901ef502a975077e309eef56c54e8c42710472514c1b0c449b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011031, "uuid": "82717bc1-81d7-4332-8a7d-8e635856bea4", "comment": "Malware payload (AgentTesla)", "value": "5bbbb2dc5bd16d463092bbe3a849298e8646929c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011031, "uuid": "aa54ad2b-69e6-4523-9e48-8a17084d2320", "comment": "Malware payload (AgentTesla)", "value": "1619b647633daee4005c328455c680b35c23263f8ce7e3da9a5411de7877e9608b39d2e7c5118f872b19fa74a5b4368f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011031, "uuid": "461af04b-d056-43a3-a448-beaf644976df", "value": "DF15BF3E0A99E937C07F93B499E40003B371A117F586AB0A56D1C7E19F66753788FA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011031, "uuid": "4ede3f11-e95b-46f0-8c39-8e3fced97dde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011031, "uuid": "43d74fb0-73d2-41b7-ba3e-83d0f61c1a0e", "value": "24576:lAlI8o5OWFddGocSLt6IktvZpTO9MIQuez34aMzVj3:wo5OWFddGocSLt6IktDkMI7zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011031, "uuid": "8c59205c-f4f3-4b13-91b8-c631de991143", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011031, "uuid": "be0d4f4c-c717-4a23-969d-e0163b2a59c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011031, "uuid": "dd380f8f-1e82-496c-b3e0-db34fa6f5404", "value": "SDSC-1100BYA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb1c4dc-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RunningRAT)", "timestamp": 1617001839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001839, "uuid": "74fee18d-0ebf-47ec-8530-cb492fa98379", "comment": "Malware payload (RunningRAT)", "value": "92b81afb69efbe857c74d07e464b4097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001839, "uuid": "5cda4072-dcdb-4aad-acbd-804cc3431034", "comment": "Malware payload (RunningRAT)", "value": "3f201f2578b5c9ce1a2d0deb31f79409b8da7e4c4c993e047f9c683b27783d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001839, "uuid": "f467c5bf-8dbc-4834-b4ee-1f679b7b0012", "comment": "Malware payload (RunningRAT)", "value": "7d3e80fd056e5ff2ed522220af3980f80572ad4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001839, "uuid": "df83b683-0c7b-4ac3-ba8e-f3159e461c94", "comment": "Malware payload (RunningRAT)", "value": "ec33b073fdf722d5b651f94c85b0dc2176d9a4cc46c366e63348b51f892db2a9e96fc0200f98aa10be191d9bc3c7b716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001839, "uuid": "ea15723c-a634-483a-be27-cf63f5dd285f", "value": "53B3E542A3E02412E1AF3B74597513364A7D3C795F2582EFF2D5C58E1879AE0AEB070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001839, "uuid": "639153ae-9117-4ac8-be34-99ba37a6c67f", "value": "7e3107c64f6a7a76d8463e3f374f74af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001839, "uuid": "e51be91b-be7b-47ce-ba4b-3ac3dd3e264e", "value": "1536:vqEA70HzLJksPEOajozLElnqiO2MdJ/tHi:vXTLJkQ7zAV3utC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001839, "uuid": "2c7cde36-9659-490f-92df-36c970b6d618", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001839, "uuid": "c3887dbe-5b32-430d-ab48-77eabbe23a0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001839, "uuid": "7e1cffb2-19e2-4e27-9d8d-561c046d48c6", "value": "92b81afb69efbe857c74d07e464b4097.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773428f2-90e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617060078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060078, "uuid": "fa5d9ca9-3038-4043-8a4b-26a2575eb133", "comment": "Malware payload (njrat)", "value": "f47e2ad2b0e4bf08a8ef53cb9d06b939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060078, "uuid": "788a51f0-0867-4c85-8d96-214d8f9f67d1", "comment": "Malware payload (njrat)", "value": "4046473f382bde02ac91f103dfe05fad0ad78a2f34add926ae4250e57f6f52d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060078, "uuid": "5676315f-851f-4b75-a61b-d660e000b3cd", "comment": "Malware payload (njrat)", "value": "f1e5b459689641d2332767bd62925b4e4578c93f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060078, "uuid": "0a9e45d5-0f82-488f-a497-4e096f1f242c", "comment": "Malware payload (njrat)", "value": "344711c37bf781dc20de8b999fd85756644ca1e59311969b17596bafb80e0eb4a2b184988f3e3bed6e0a381f8383c512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060078, "uuid": "23296f1b-f0cf-4128-8b97-07cfb1db51b7", "value": "3C0601C772D18568E81C1ABE92FD737443559E37A932426CAB95BE5BCB322801CC0D6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060078, "uuid": "3ac21a97-333b-4871-b8ef-7e0653c17ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060078, "uuid": "809421f3-7ad0-46de-9a03-7317620f0fb2", "value": "98304:mBKt10ZiIP/QTsc5b+IhKelWbiPeRaRyC2GE2i:m0GJITnJplWbiPe4Ry6E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617060078, "uuid": "f71ff0db-56ea-4abe-a85d-0cea19399507", "value": 3713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617060078, "uuid": "3cdf5ba6-b3be-4206-ac23-897a2c285e9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060078, "uuid": "ae4edb9c-3713-44dd-94d0-38b98b9e2a60", "value": "F47E2AD2B0E4BF08A8EF53CB9D06B939.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939e211c-9083-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617018035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018035, "uuid": "0bbeaa0c-7d25-4141-89ed-5dfe8d211c15", "comment": "Malware payload", "value": "2a337b103747df0320d7adce1c935b22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018035, "uuid": "6a04d96d-403c-4e4e-929e-f9b7ef7c6339", "comment": "Malware payload", "value": "40d1273493a0bf2a59cfe9d8a5cca395bc4f1fbe5e4977abde9b6389258576d0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018035, "uuid": "9df8fc6a-95c8-4620-8752-3a669ed43803", "comment": "Malware payload", "value": "e134ab3263c86a52a74d209cd6dc46d8d5354a55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018035, "uuid": "677c6ef4-14bf-4b48-b677-10fe704cc4f5", "comment": "Malware payload", "value": "fb26ab512365bd5f8453d84f1dc6920e308edcdd1bc7709b3f020666a5af5c30e5f2cca58854e5c4fbf8f01953a928ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018035, "uuid": "3de60986-df02-4b86-bcad-5159a8a2018a", "value": "93F31A03E7124F1EE44CCD7444F952D00AB95E6FEE6162EF40AF3E997EB2931294B624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018035, "uuid": "6c25d20b-0074-44df-a4a8-23a872d2d7bf", "value": "3072:ZSKPgjwVjWSR+kicxTSz5555rejx555553uVZ:ZSZOWSRhnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617018035, "uuid": "b26f2e46-f180-4bf9-bd04-7482b9ffc169", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617018035, "uuid": "663d343d-de96-4d03-8d7c-8a0290d6d0b7", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018035, "uuid": "8c2e5eb4-1701-4d7f-9ade-1974e028d94b", "value": "01\u6280\u672f\u578b\u56e2\u961f\u7684\u51dd\u805a\u529b\u53d7\u54ea\u4e9b\u56e0\u7d20\u5f71\u54cd.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e404047-90c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617045031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "0f540c9d-f635-404e-a124-a2b1b5b5a0d6", "comment": "Malware payload (Dridex)", "value": "4965ee15608d57ec31b181c3abd39aec", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "4ce45cb6-2cef-4674-bb97-8099024e1384", "comment": "Malware payload (Dridex)", "value": "41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "3fb14479-d4ac-441c-8d69-b8f9e119fe1a", "comment": "Malware payload (Dridex)", "value": "1740ab533cfeaaaeef20e0940bdb7b01e52d9d48", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "da439e56-4560-436c-99ef-d326bc31661f", "comment": "Malware payload (Dridex)", "value": "52180d711cc0570dacb0c8b556fd9fec1a871714581a3a508be8c76e770cda8c810a2fcac29fd157d7a084ecd7d44e0d", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "60f653e4-ce13-40dc-9590-df0bfd40cf05", "value": "11C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "1db10ea7-63ac-4a0c-ab1a-fe7cc3d868bd", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "5893747b-1835-4a27-932d-ab307174cf3d", "value": "12288:Bt+D1yz/1SXpqDaoWm8sFZHk3eBWIcCd:BcA1aLoBTQeBjcCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045031, "uuid": "b93c896f-7c23-42b9-bde6-321106756996", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045031, "uuid": "f195d304-bb14-4a9a-b963-8358e873be00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "28ed8e47-0578-41d2-a80d-ab1ad94dc02f", "value": "41a0e9ae19a114d1f5b7290cecd214b6d116a91867292bae6c3cf0b3597ee262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f946365-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033329, "uuid": "3e199e66-bec9-4632-8da4-645a72be8fda", "comment": "Malware payload (Dridex)", "value": "36c44b24a4f66e640ed6ab91dcee3dd4", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033329, "uuid": "360cf344-7d1c-48a6-9edd-4ed51d84d1ea", "comment": "Malware payload (Dridex)", "value": "41a9eb40e9c6b0b3e99c33f510aa4ba2cc4306e09df01c47e623b120c8e2a997", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033329, "uuid": "b61cdf1f-0f1d-49e6-af8b-a9c7f67fccdf", "comment": "Malware payload (Dridex)", "value": "40f1d94150f32364805844a19ee69d1eb546f7c4", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033329, "uuid": "39b2edb3-c38d-4f11-8ce8-8ad5ef627041", "comment": "Malware payload (Dridex)", "value": "7e608934a0bc6efee1823753c0c11dbdd7aabcb28b0651249c0279bcd4c53f0a8d84e93a6b37420321a22881f8bb68b8", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033329, "uuid": "d4f16ff0-ddb3-499a-a60e-44f33e12d453", "value": "9C84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033329, "uuid": "eddcf7ff-f191-45ed-91a0-207194ddafc9", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033329, "uuid": "0355c4f0-e0bc-4674-8211-0fced2514a30", "value": "6144:JbazNBbycfmKsyUlVUMdUFIk1KyHNwoA/pFp5xMMC1h:kzeTlVU/7HNMp5WMUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033329, "uuid": "33f094af-6bf7-4aa5-9282-46de5854bf6c", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033329, "uuid": "c28f5f45-1d22-4506-9dcb-695be12a5549", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033329, "uuid": "e76c4682-3723-4934-aa85-6eb7adc0b89c", "value": "41a9eb40e9c6b0b3e99c33f510aa4ba2cc4306e09df01c47e623b120c8e2a997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25f0644-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617033656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033656, "uuid": "0a6dcb8e-e151-47ae-a88f-ba649c3d866f", "comment": "Malware payload (IcedID)", "value": "098de0d16a91b334f3afbed9779a3cb9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033656, "uuid": "4ab2aff1-c7fe-4e71-b066-f2fcb871c8d2", "comment": "Malware payload (IcedID)", "value": "4295c39e57c5feddc555348079a16538c952a7cda1acb4b128170000f192674c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033656, "uuid": "c64bd6ec-8e52-4cab-b852-2cf233a90f2b", "comment": "Malware payload (IcedID)", "value": "5d3a63310b922206fed6ea16e7dac7c849bc3c25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033656, "uuid": "16b14799-c675-4d83-8f03-9f3c257ee385", "comment": "Malware payload (IcedID)", "value": "689a7b85f570907dac9a8a75a3c2447e889bb8acc6f9521d95dd98f63b96d1e0199a2527ac6f286efb7d9f14f78ce980", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033656, "uuid": "958def39-4a2c-4333-b091-e3acb6224df9", "value": "FE133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033656, "uuid": "f06d6fd7-07d8-4856-89fc-0544a72f2963", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtBEYxEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBasc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033656, "uuid": "04376af0-221a-46d6-b03b-05508e72f8f3", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033656, "uuid": "3f753720-bd25-4db1-b930-2ba5bb06c8f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033656, "uuid": "005d07ea-9906-4d69-81c3-c2c3fdbdc836", "value": "4295c39e57c5feddc555348079a16538c952a7cda1acb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6539e7-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617054258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054258, "uuid": "806bb45c-6934-4f4f-85c2-4b8aadfcf224", "comment": "Malware payload", "value": "cdd95ff38e182507086b604b395c5131", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054258, "uuid": "e8d20c14-3ebd-4599-8395-e73f1dca1829", "comment": "Malware payload", "value": "42edefa09a3d85a3d4284f6ef57691c8b409ac00da21c799ae14b1adf17435f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054258, "uuid": "b0a1d474-0216-41cd-8ec3-87f79dc20916", "comment": "Malware payload", "value": "07347f01672fcd6824821d063d4c99450ab38d55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054258, "uuid": "219224b6-58d0-45ea-a1dc-da810c6f73da", "comment": "Malware payload", "value": "23f4ed36b32804c9d6a2a44b74493891f5f3e5ce65fa2c85094d020a85da9f65bca2c59d073e84cc4d7fe828a2c26b0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054258, "uuid": "3a37e813-a819-4c1c-bac9-a6a4af349a90", "value": "6E54AFB8B1142DD6E56F467BC996ACDD13B536629ACBE8CD80A47BC305A3361FF02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054258, "uuid": "8fce4190-3549-4a52-9109-de1e785632fc", "value": "8dd1cda0958dadd2459ce45a88de587f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054258, "uuid": "5d13854a-fa25-49cc-b136-4d9abd2d8411", "value": "6144:5RdcItrldgXTU4G0C2vg9QAJtn98PwuK3tTX+gGELCg4:5QuxaTdAJx98PwuKdXbGEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054258, "uuid": "bbdb529f-8ed4-4a94-aa69-f684953bfd21", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054258, "uuid": "96049eef-211e-4446-9cad-1682a09310f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054258, "uuid": "a21f2a1f-ddc5-4617-baf7-ae742b298315", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.3599.14716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94be337-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617054257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054257, "uuid": "f8cc8d2b-1ca3-4d8e-bb79-074e69e406ac", "comment": "Malware payload", "value": "92d182116716bcea94a7a142922a59f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054257, "uuid": "2be527b1-f097-4b90-a002-8dec1aa097e2", "comment": "Malware payload", "value": "42f597a7b0c1df670bb5d8f7d123fc923cacdc06a1a5fbfa325fc8598a895b02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054257, "uuid": "d314ff75-aa2d-48d4-a718-d1b53683954d", "comment": "Malware payload", "value": "e38af8a994145deefd4650966d240428ac958a98", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054257, "uuid": "61cdb67c-2d99-47d0-b857-a31eee05e80c", "comment": "Malware payload", "value": "614c7a9fcf1df52be3c406771894f0b5b9f84eadf91763f8f66d9d31c9b7ac0d2a7a411661c466c34520f7cc22f2a13b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054257, "uuid": "776eb170-f497-4c65-b3cd-5dc330e4fb60", "value": "42D49D14228917F2E4E382784D72541BF8BB34103B24869B724C5665BFBAAD2B73DF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054257, "uuid": "4baaa5bd-fb1c-4d44-b4e1-14178843da07", "value": "ecb5890e557ce6e2ee372bfc5e58be7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054257, "uuid": "745eafd5-0a3a-4378-a57d-d12671eaa6b3", "value": "3072:M2PvCt/BvJfXQxh6DZpN+5dnALK5u/prWO3661B1wQq9eK9o60ymfoNWXqsa3/iU:MGCzJI+N+/Ayu/EQzK9ufoFsa3qoir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054257, "uuid": "cc37c652-f65b-446f-ac49-0941cf01eb09", "value": 651139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054257, "uuid": "6d14db73-6b31-4a9c-bcd1-6f339f594e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054257, "uuid": "1a2f2598-e789-499f-8a7e-31183fdc0f01", "value": "SecuriteInfo.com.Trojan-FSUS92D182116716.27399.10213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a700a7-907e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617015940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015940, "uuid": "3f9ea38d-9448-4210-b14f-9a9ffac76f25", "comment": "Malware payload (AgentTesla)", "value": "8ed9a42adb4ef2f16f528c598cb2c2bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015940, "uuid": "ef6b86ff-b8c2-4c2e-afc8-8c6ae50cc32e", "comment": "Malware payload (AgentTesla)", "value": "437d7df09d9f25afe38fd40f992a0ee80ceea7b2a43f2e9083b1636034433df7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015940, "uuid": "d27a36f1-fd49-45f8-9b77-f37b669ffa73", "comment": "Malware payload (AgentTesla)", "value": "63356ed640b297b3be85e0956fd64028c487f919", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015940, "uuid": "78ba4dff-d8bf-494a-b791-cfc9dec656d3", "comment": "Malware payload (AgentTesla)", "value": "f11765626c2932a9374fb1706da6e08304591ffa670e22aec5aa15c11b8faec3050b9a157fbda5886f7f2c4e3b6ad553", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015940, "uuid": "f3dd548e-2181-47a4-b721-5354c08fee35", "value": "DCD423F6949C1E52DA2577FB21839F0188FAB16C10136BBDE24E4CA331712C636F9B64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015940, "uuid": "a2cc8ec2-8341-4728-93c0-a19a3c905b44", "value": "12288:Kl76jM3fUWu9CUkq6x1p0ZOP9i583LObWr6TP0:Q6jcfUWu9CUk/XpA5KLcxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015940, "uuid": "424f2315-ea9d-437a-9953-26c3c29e14da", "value": 630357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015940, "uuid": "88b4ca03-166b-4638-9661-61f1ed90c1ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015940, "uuid": "823d8dd3-bd2d-41a1-9f7c-550b69eea1f5", "value": "Document Submission.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c253500-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029592, "uuid": "fdbb2c3b-c368-4c48-b0b5-3dd24247ca3f", "comment": "Malware payload (Dridex)", "value": "fdf690cbb48fa0bf9091ba5a16707830", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029592, "uuid": "76a491d1-b4a5-4849-92cc-587829290eaa", "comment": "Malware payload (Dridex)", "value": "44032ba744f8574a8cb83c1a35a509ba1cdef099bf771271a4200fd0d5f8e33e", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029592, "uuid": "55112011-f5d3-4b15-80f2-0b9122562e74", "comment": "Malware payload (Dridex)", "value": "2c6dfd4ec362e552230745547bc6330bdec2b65f", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029592, "uuid": "6cef0862-c7e1-4572-b9eb-1246114db2de", "comment": "Malware payload (Dridex)", "value": "b6b51bac97020aad52270d77907d1fa72d86854d384a1eb936fe117276f5c62658a7e4dd80593e044dbd2b0ca706d657", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029592, "uuid": "228ec7ba-aff0-4837-b606-c738cd031b2b", "value": "8384D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029592, "uuid": "09cd36f2-b21d-4d62-ad93-f30e67a24475", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029592, "uuid": "ccbecce8-d077-4f64-b421-e4e8beed7cf8", "value": "6144:EbazNBbycfmKsyUlVuMdUFIk1KyHNwoAfpFp5xM+C1h:vzeTlVu/7HNsp5W+Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029592, "uuid": "40b5d14d-9352-4c01-9054-d3bc327a0186", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029592, "uuid": "0f5cf760-babf-4793-8126-e8682cde74b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029592, "uuid": "86dd537b-db37-4bbd-a3eb-058649ebe927", "value": "44032ba744f8574a8cb83c1a35a509ba1cdef099bf771271a4200fd0d5f8e33e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74d950b-9089-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617020672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020672, "uuid": "b28ed1af-fed7-4b0f-b992-467623931d18", "comment": "Malware payload (Dridex)", "value": "f87ff65c847f00ba5913df4a5f96d2d5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020672, "uuid": "70353d7f-d11c-425b-ad2b-bc105d1dffba", "comment": "Malware payload (Dridex)", "value": "440e57a997e1c87e7a946cfae981a4182cdd06486b29dde425260495a7a40620", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020672, "uuid": "1421c118-6597-4525-8aa7-5b335825cbca", "comment": "Malware payload (Dridex)", "value": "a89328a69b119430d4533a2508e9bbbb092b9d58", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020672, "uuid": "7a21d4ac-1652-4b0d-a9e4-209e82a4076c", "comment": "Malware payload (Dridex)", "value": "fb43a19b2b97bff723e9d375672ab4140135823dcd19eecb7e0fdaa1e248b592bbe88e9a7118277c32e0bbba13fea709", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020672, "uuid": "3c3dc9c5-5fa3-4c4b-be7e-04917edfde2f", "value": "A214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020672, "uuid": "a0fe399f-11ce-4c6c-aa6e-94f7c8cf1cfa", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020672, "uuid": "892978d2-c853-44f4-a5b9-4116b56e3f20", "value": "3072:31i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617020672, "uuid": "b1cd3ca0-32ac-4961-9ea9-f554a3ba3932", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617020672, "uuid": "1a04cb0a-a8b7-49ea-9a7e-503429632e12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020672, "uuid": "22e653b5-7eea-4bf4-b8c2-e6154dd26afd", "value": "440e57a997e1c87e7a946cfae981a4182cdd06486b29dde425260495a7a40620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b1e6a2-90d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Adwind)", "timestamp": 1617051353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051353, "uuid": "49fcf1d4-4a6c-46bc-a794-3d1e284db23f", "comment": "Malware payload (Adwind)", "value": "a86a21838742876cfbe95cc376bb2fd9", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051353, "uuid": "5a526b52-f658-435a-9076-76d31e725c29", "comment": "Malware payload (Adwind)", "value": "440eb41236d2a1863e20dc52c928bfe9698b8689b1c09c1f21f06e8535972bbf", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051353, "uuid": "ca0d847d-fc0e-4d50-901a-281f0142f547", "comment": "Malware payload (Adwind)", "value": "5afa7e4beb285668780cbfd4567674b022281add", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051353, "uuid": "dc2b3c94-f818-4d8b-877a-b267e1f23643", "comment": "Malware payload (Adwind)", "value": "6f0fbeb70f87846997f625f2920a6d77d6d2f7d21adda7b7664ce9abcff39537630e408ec6a4c1a7f25d7c367b0ee4d0", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051353, "uuid": "41998aef-3780-4320-945f-85aef2d82a4d", "value": "21C4124DFB9E90A6D7E7213015C605CAA7AA6E98D3C114B22CB536238379C37DB139F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051353, "uuid": "4c797051-66b3-4ad3-b934-d9520303db54", "value": "12288:OdhZzdXBqSBb2agPXqp1tZBkyNE7v5pxogQNUhIK/0c2qnu:OLZzdXvF2ag/OzZG7BsS7B2qnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051353, "uuid": "8257347b-3379-4ca6-afa6-889b3dc97a20", "value": 579013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051353, "uuid": "50aeb420-7b84-445f-8845-3aee8e64b0d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051353, "uuid": "d99c0117-098b-4c67-bde4-447d8f15ad93", "value": "Spark-Invoice29-03-2021.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fba0c3-9064-11eb-abe1-42010a9c0039", "comment": "Malware payload (ServHelper)", "timestamp": 1617004617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004617, "uuid": "f3612b35-5583-4c4b-a787-c336866a2026", "comment": "Malware payload (ServHelper)", "value": "92068f4e5a7e704caf1fad1665121757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004617, "uuid": "42b8a797-de5f-4cf0-87a7-4c3aa54b545a", "comment": "Malware payload (ServHelper)", "value": "4411d8a69230284cb6238a2e8cf29878afbbef90935bb94d1a6f8d59af30c6cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004617, "uuid": "7a7f34ce-bf68-4cba-99c7-e8ce617863a0", "comment": "Malware payload (ServHelper)", "value": "63af0fcb20bc4abb452c53455a9955dc210334bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004617, "uuid": "69ba3f5a-ce02-4630-8314-0fbba657f613", "comment": "Malware payload (ServHelper)", "value": "7eee11d50249b9ad2b3ab227662598ad1affc656e2eb502c7b00918c39f840bf71a827e287d8f1ae611072712987b456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004617, "uuid": "7187f7e6-7fad-4ed5-9860-f56e8843a9e3", "value": "2556F116BCD204FAC57AE170865693A176723C64C7323BD31E94BAAA1AB5FD42F3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004617, "uuid": "f1da37be-2f16-486c-9e69-146b72e0f0fd", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004617, "uuid": "9dac4898-3bf3-4d6c-b79e-9c49e2a29725", "value": "49152:zFH0XcONJ1ipWN59v8qwofIlrfPou6nJTppIq7MYurLSnpqDstXL5xDgPMNXQiEU:eXcONJ1qT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004617, "uuid": "d903d25b-2174-41e9-b3b2-a6dd4d076059", "value": 6342144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004617, "uuid": "00be45ac-f93e-4c0b-9a17-ca6fca215629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004617, "uuid": "f20fdf96-d08c-4de5-a677-8f8ef3ddaead", "value": "92068f4e5a7e704caf1fad1665121757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15d052f-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617002623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002623, "uuid": "c9227b4c-e37f-48a1-8450-9016d310abe2", "comment": "Malware payload (Formbook)", "value": "28162044d6ae70b53bf03b90ff2f1b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002623, "uuid": "c55ae79d-06e7-41a7-b60b-f1a619c1b27f", "comment": "Malware payload (Formbook)", "value": "44e02535fe51b8fd800732a38914fda84987f7cb22aaf043bddaa0018123da59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002623, "uuid": "43e3106f-1cdc-4d76-b467-e4fa7eff44dc", "comment": "Malware payload (Formbook)", "value": "0be07f055edcfb6ee54aa4e52d6d4efc3b108fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002623, "uuid": "382fa6d4-83c0-4446-b3e0-46c46a3fae29", "comment": "Malware payload (Formbook)", "value": "da5f5fc0895bb8d78387d7f101dab8e375f1499236d18bc5ed4c440bd09da3438e753e966207082b2f21250883900c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002623, "uuid": "fb8a3f96-70aa-49d4-9b0e-73d040928ef8", "value": "D535394C5E98C2CAE2394BB891D9E49943F56EF38F22CC79BDD547CBC130B41E606626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002623, "uuid": "bc2bf620-6093-4f1d-aac9-6be3061ec95b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002623, "uuid": "7711509e-8359-452a-9ead-0f20fc532748", "value": "12288:QkGQcepUcArH9YIc66eb2w+3cQpCfcvzOZ1EI2cBGOy15tUvROeCwAYg+Y:QL9J2w+rAcv+xXZy1HsRO9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002623, "uuid": "309c3438-153e-46ce-9770-81548d39760c", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002623, "uuid": "7749e22c-c490-4dd0-9a7f-43d4da3c0024", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002623, "uuid": "d48014f8-a2e8-4ed9-8109-0096f47c4622", "value": "28162044d6ae70b53bf03b90ff2f1b1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734228fb-907a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617014115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014115, "uuid": "ad4d7450-9025-4e58-b49e-ee6493a9c65d", "comment": "Malware payload (AgentTesla)", "value": "b5345465197ec33e8ae47d5f2450598f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014115, "uuid": "1eb11579-cc4a-4e4b-8f2a-c5203a885081", "comment": "Malware payload (AgentTesla)", "value": "4554627313825aec9d2f4ea8a89d711b32c500cb5b4126c010e3080d8e5ca850", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014115, "uuid": "ab516b3e-7c36-487d-b084-afb812241fef", "comment": "Malware payload (AgentTesla)", "value": "46d8a7a237d4d228743b79b67c4901bad1da5bd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014115, "uuid": "65040554-c6c9-4332-a221-3c10fae83d20", "comment": "Malware payload (AgentTesla)", "value": "d6b82ebb5b777cccd89f9548dd26bfa0b6b69523a4800263f58d74e6bc0daa6a03e827adfb0670fc46917e94414dddd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014115, "uuid": "58e7ff17-cc7a-483c-9b5f-ad8b78ca0386", "value": "6AF4BE11A3A5AB48F33B5378827D121297F6B546D236E7BDAC8050DD0EB3A454A7B333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014115, "uuid": "718bb0a7-b7d2-4d35-9a57-126be298fce3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014115, "uuid": "1f6790dd-b9d0-46ed-87d7-5eba42876d3a", "value": "12288:bG5cCwVrqmxQT0QI8VXNo4vtj7P9ttWesVtOJcXeX+jCcZYepqPf25:bMcCwVqWQ99o0jbjtvaXw+7KDe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014115, "uuid": "c1f35a99-fd94-47a4-b0a7-09e4c7ffa797", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014115, "uuid": "45c95f77-f2bb-4aea-8d72-1b617bd9a8a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014115, "uuid": "e68445c8-68eb-4123-bc0c-6c5ad6aa0bd8", "value": "AWB # 2205280630.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fbcbd2-907a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617014058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014058, "uuid": "c3b0391f-a5dd-4a8e-8e15-b2261417814b", "comment": "Malware payload (AgentTesla)", "value": "3f09c7a44fff1381defa28e009ccb5df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014058, "uuid": "110f8c09-bda8-4606-a4ae-038594ac1696", "comment": "Malware payload (AgentTesla)", "value": "4568536bd18235e681ac0e4bf028e9e1422f46ef07277a57b33b98476d1144f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014058, "uuid": "0478a26a-e5cf-4f2d-9855-a49a127668e9", "comment": "Malware payload (AgentTesla)", "value": "1a92405725f11f0514acacbb2d623909e61be656", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014058, "uuid": "1c0f2e3b-bb35-47cc-8f3d-a968416eb84f", "comment": "Malware payload (AgentTesla)", "value": "fc1e53ed7ea296ff62131261d5c1cf3828f4567b9581cc4c1053b466c39f91f14e89084903adbed8ba3eacbb84eb75d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014058, "uuid": "eb9e472a-6825-4fe2-9606-97efdae22c77", "value": "94B423C4E0F52519BBBFED067A0E61BFE9F80D6327085831673F07E94561AB2CA584D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014058, "uuid": "13d4e82e-7a2f-4412-97f9-2391f4931e95", "value": "12288:OThr3Mmx064yabQf46cPHbsXSYolnfuU5UudA+WAGgmdC3Ed:OThr3MmxtwMxcPHoXshUudA+8gmMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014058, "uuid": "17bbfa3c-4c31-4044-a6b2-5c3ef95b669e", "value": 525392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014058, "uuid": "ea5dbbd0-a336-43b7-acfb-7819e1031576", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014058, "uuid": "4da037d8-eec7-46f5-9b20-03ada4931378", "value": "AWB # 2205280630.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8504ae-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996575, "uuid": "aaeb32bd-970d-4165-86c1-919bafd0554f", "comment": "Malware payload (AgentTesla)", "value": "8a2576f43cb7fb45e5fd852b3779a0dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996575, "uuid": "3d6c0876-a25f-4f79-a6f7-79f46dcdcf42", "comment": "Malware payload (AgentTesla)", "value": "4585e13fe4d4307e82e693c3063bf53ea84591b843c0ae59fefc0f4086ec86db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996575, "uuid": "ea81fe4d-d128-47be-88b5-036c5d7f666f", "comment": "Malware payload (AgentTesla)", "value": "0883595e0e9b76ecacf3a9a36d4052a6f481aee2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996575, "uuid": "40fa7e9c-7aa8-4cd1-81ba-1ee46c7447ea", "comment": "Malware payload (AgentTesla)", "value": "ef6d2d2651c7d70fe251b52088cbf7c70830b169d4a0db2c10eab3280a12705a88d120cfb561d93f64d92a3cdf8fc31c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996575, "uuid": "652a45c2-6661-4015-b7a9-f9df73bf4c8e", "value": "98E4818C5D9EC1E6E6354BA842C9C4FB06EB5EF34F12C879B9C68BC7E020746E516532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996575, "uuid": "ece80d4d-95d5-4938-8f86-84ec8df2ccc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996575, "uuid": "a7196acd-3af3-492d-814f-ed55c32a935a", "value": "12288:2+BC8/xyHzJ0qzEUJXf54pBbf3xfVUL7O:2+BC8/IHd0qzxJB4pJ3xt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996575, "uuid": "be882673-85e9-47f3-bb56-752930792c10", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996575, "uuid": "fd8a7930-96ba-4863-9f2f-f117287e542d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996575, "uuid": "9e68b60d-ce77-468d-a6fe-1c914d455956", "value": "QUOTATION 03-28-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8aa7333-9073-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617011199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011199, "uuid": "3ae41242-98bb-40a3-b9c0-f9b8fbfd8cc7", "comment": "Malware payload (AgentTesla)", "value": "fc2f66eb76e5c8a18afdbeb826fd632e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011199, "uuid": "eebe3705-85e4-4913-9704-dd54e9ea0d5c", "comment": "Malware payload (AgentTesla)", "value": "45ac27e470f9bee8be8b25ac91c656192b98efef4e806a96cafabdcdbeda3b2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011199, "uuid": "f139aa2b-c7f7-4cfa-8447-2b15fb50e88f", "comment": "Malware payload (AgentTesla)", "value": "353237f04d925b4bec0f69cce2793516953085f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011199, "uuid": "bf5db167-1227-4a5b-809f-721dd9bf8237", "comment": "Malware payload (AgentTesla)", "value": "b3716aed2f010ff27b8aac96712752406455d0e7d1d43b98ae4bfe7da5448b84927065b6701cac8d85371382bb4991ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011199, "uuid": "3e2eed48-b56e-459c-a26c-98396b44489f", "value": "6A05F1DC9A6A6723C9AA23BD41DB32D4CF61521A0C51FFFA98CA10821553770DA437FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011199, "uuid": "4b4f1a7d-fc9c-4db7-9ec6-76c9a7db2d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011199, "uuid": "f61eee7d-7840-4e14-9a25-023620e45394", "value": "12288:RI7Rqeuebj8tn1z21F5oL4BgzJDa+8AmCVBV9ZPVFWCTwzKc3Lxdjk/r9T:RIHue/bFKL4jQ3PVsCMz5xlk/r9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011199, "uuid": "e8a3be36-7822-4610-a25e-b2cee2dedb10", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011199, "uuid": "2d14d8f1-2ecb-404c-b973-48ad935e3e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011199, "uuid": "ba7a903e-7f9f-4e60-a037-419d51a41839", "value": "MV ZENKEN MARU-CTM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6914f08a-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617032137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032137, "uuid": "5f58eaf8-a2fc-4d42-8c35-9f6aa33fa513", "comment": "Malware payload (IcedID)", "value": "937d66a99e1edad3fa26f243280af1f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032137, "uuid": "417e234b-8a52-4aad-a32c-484cee15ef15", "comment": "Malware payload (IcedID)", "value": "45c2bb18079e07f9c02b75b5ba108580005ccccfc7914457704593f09104da33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032137, "uuid": "b31b79c5-1bdf-4e87-9de4-3599412fb267", "comment": "Malware payload (IcedID)", "value": "4a017739c6a68d1b35713a764eeeb2dbc57b7e76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032137, "uuid": "3a8c3852-fa8f-49ef-b5e1-3144a7378716", "comment": "Malware payload (IcedID)", "value": "785e73ea2a2eebc9e6d3a3b28245e81a4bd75131ec68f76385c9679874db5a7300821f50071579389a9ebb42d0ea12f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032137, "uuid": "995a6792-86a9-4d28-9303-5e4f1bbb575d", "value": "FE133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032137, "uuid": "31b82c56-6d18-4ba9-89f6-1767ffb952d1", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtBvxEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBUsc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032137, "uuid": "348c0ac9-58a0-427c-9f02-8e54d41bca39", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032137, "uuid": "df2725cb-a83f-4bb5-a32d-c0562562a473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032137, "uuid": "1bf31439-f857-4fb0-8638-afb67340df4b", "value": "45c2bb18079e07f9c02b75b5ba108580005ccccfc7914.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10270435-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617002353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002353, "uuid": "a3ce6a34-52bf-471b-a7f1-71a3ad567225", "comment": "Malware payload (Formbook)", "value": "c0615abb7bf663bed3b32f2c1b3808e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002353, "uuid": "e146be66-f2b7-44a7-b97f-dcd277101719", "comment": "Malware payload (Formbook)", "value": "462ede8a2b37164863953764e75ccb25c0224396475dbaf96f6dbb6b51484257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002353, "uuid": "5322e050-5c07-4878-907e-7923d86ded2e", "comment": "Malware payload (Formbook)", "value": "d74fcf9f8659ea8d0c2513fdfa9b8e6b54ac7cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002353, "uuid": "9e7a8a1a-bd8e-4fbe-803f-e027db943fbe", "comment": "Malware payload (Formbook)", "value": "eedb73bc7ecbd2fdf9c19b896c32acd129f1c7c6d654a14440ebede592451754fe5d6a63a9730809cc7b25618cf0a000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002353, "uuid": "d5eff7a2-ca15-4603-9ce2-b301ca69400d", "value": "8235398C1E99D2CAE2794BB891D9E49943F56EF38F21CC79BDD547CBC130B40E606622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002353, "uuid": "65aa3b59-f916-4fe3-b8f8-5ff45e67af07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002353, "uuid": "744103a2-8362-44a0-9a6f-ea3511889b40", "value": "12288:2JLziaRc7Ffoy9f3Jj/TODjTT0LhBUNZwKG2qEqBeoPvqEBQXHzZB1kNMCIcFWV:2AdU3bNKKvMB9Piz9BSNMaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002353, "uuid": "62eb7962-da2b-4413-acbe-53c43ca0c272", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002353, "uuid": "82493673-e7e4-4be3-a85d-7942d06e247e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002353, "uuid": "db8cf4e7-5af3-43dc-bc0f-4bfa9ecabdfe", "value": "c0615abb7bf663bed3b32f2c1b3808e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d732a2e3-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617054226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054226, "uuid": "cbd272c6-5bee-47bc-9b03-98c562be93c5", "comment": "Malware payload (Dridex)", "value": "cb960b3bec3d9e2464a2c1bcf357c1b7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054226, "uuid": "0a996e9d-4c08-4e5f-b25e-f82ca5329e64", "comment": "Malware payload (Dridex)", "value": "47054f93ff652602b7cbe8645283e3cbb4fe00d6843d6b65f50f1b07c9822435", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054226, "uuid": "1d3b0ade-00ad-4211-b4c5-3b50a879f3f1", "comment": "Malware payload (Dridex)", "value": "9b242abba0baf3659bdde112c232328cd485558f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054226, "uuid": "837a1bc9-635f-40c2-ba7e-cb5c8952a83c", "comment": "Malware payload (Dridex)", "value": "c32260e27d6b08e0e65559d54c553c4f8209b7c0c3549046701559199064c74e2b27a035bb2d7b4da7c975e50e5179f6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054226, "uuid": "b83e6753-6f28-476f-b1e5-55c5b0764ac7", "value": "9C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054226, "uuid": "a26a097a-162e-4706-b0c5-e49a5b6e41cc", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054226, "uuid": "b5e33480-db77-40b7-9005-4393147d7ccd", "value": "3072:x1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ji78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054226, "uuid": "d03168eb-7086-4b63-bca0-c730ec48cb01", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054226, "uuid": "46f7f127-8996-43f5-b5e7-f30526d92f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054226, "uuid": "a909961d-23d1-4b7b-bdb1-c58d1e1de5ba", "value": "47054f93ff652602b7cbe8645283e3cbb4fe00d6843d6b65f50f1b07c9822435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d596915b-9083-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617018146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018146, "uuid": "e8d84f96-02a2-4c13-a8e0-2615788dd60b", "comment": "Malware payload (SnakeKeylogger)", "value": "64331a648d0c971b318e81557627b81f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018146, "uuid": "4e51a75c-dac8-4c12-b05b-0c62f585035d", "comment": "Malware payload (SnakeKeylogger)", "value": "47744a69efb3a1c1c329b46d82f36ef935c704c3f970e77aa7d48e543ef81f07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018146, "uuid": "edf3b5e7-bce6-4825-a83e-c29213a400c4", "comment": "Malware payload (SnakeKeylogger)", "value": "a7047c55c6f732e9c821b850102c3858813ebc11", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018146, "uuid": "89bf51a8-21b2-4e3d-801d-851f5fadc530", "comment": "Malware payload (SnakeKeylogger)", "value": "9255de0ce63df9264875957b99d2c847d6dfc08952aed9232fb8f39f6366b0600797db6a8feb5cea828e79e8bcc516f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018146, "uuid": "5edd5838-820a-4579-b555-90b5cd7919d5", "value": "C40523A279E21D78709BF18B5E7B526CE517D07AFB830984F2F9422C4CBA61413CD6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018146, "uuid": "42f8cf97-0833-4728-810e-3a995de37b45", "value": "12288:Qn2fbyVzIv637m1vJzCSrdj0MmuQXjFY6KuOt02IeKOpCLgD3QdRnaTtEMgxJ:Qn2fbQIv6LC1uSQza6KfnIjeC0DLTtIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617018146, "uuid": "9ef88679-2b7c-44ac-a596-fcede445aa83", "value": 800358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617018146, "uuid": "1851bb49-949e-4577-9fbb-eb9cd23549e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018146, "uuid": "79534fe2-5a91-4e13-b615-1e5c88186a0f", "value": "New-Order098167.pptx_______________________________________.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2c9806-9053-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616997299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997299, "uuid": "812e9846-f1f0-434d-8a82-251a7399358c", "comment": "Malware payload (SnakeKeylogger)", "value": "bdf1d2cc7f97ef8c1890120236065fd3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997299, "uuid": "104c235e-0125-421f-8d6e-dce7dd01e383", "comment": "Malware payload (SnakeKeylogger)", "value": "485b2a47540bff38cf989e064aa7405f0d5f07200f63f97c086ef7dfcce4c940", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997299, "uuid": "caf2715f-0d28-4cf1-a18c-a376c8643124", "comment": "Malware payload (SnakeKeylogger)", "value": "6efa180cf29128aba3c599170dc1271c8b2fcb74", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997299, "uuid": "2435c15b-69ea-4308-8387-11b2f0ee8dd4", "comment": "Malware payload (SnakeKeylogger)", "value": "977a26a2d5224e0a43464bab5a91df1864138302b178753420baf7754093136bc16e6871f3964c29e133857acf9c0567", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997299, "uuid": "9ac9627e-2d08-4096-8cb2-2c5f08666fc0", "value": "5E55E0E57E0A719AC1211A549F53F60C2B2BF223D7E1509C364FE53E13FD946EA2AC60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997299, "uuid": "b62f5300-ff69-4c64-90f1-5b794364a0fd", "value": "6144:kwCNGWwCNGWwCNGWwCNGWwCNGWwCNGWwCNGWwCNGWwCNGWwCNGWwCNGWwCNGWwCL:XXXXXXXXXXXXXXXXXXXXXXXXX0yjB6ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997299, "uuid": "bdb7c59c-ee06-434f-8f98-ad4832a492b8", "value": 1317590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997299, "uuid": "998c9bf8-13cd-4f7a-ace8-6065a2597e4e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997299, "uuid": "c715d521-9e5e-43f1-a467-b3ebce8d88c0", "value": "PO_7201_60_74.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c201dd08-9080-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617016825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016825, "uuid": "b2b3117b-980a-4da3-8ceb-7b49ee5fee84", "comment": "Malware payload (AgentTesla)", "value": "f5be5b9cd76b279dec89c34eee803df1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016825, "uuid": "ca0a1431-8d92-4767-8251-1bb567f7d3ee", "comment": "Malware payload (AgentTesla)", "value": "485f2f5926f56eed31c3ed2732c0a833895962f3b499cd2a1bc52fb1453443ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016825, "uuid": "810b5e56-4790-48cb-9151-dec15043784e", "comment": "Malware payload (AgentTesla)", "value": "a651a27fe0056cbefd1b7204e14573e170198257", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016825, "uuid": "f9934632-3002-4108-b95c-0254ef0499ad", "comment": "Malware payload (AgentTesla)", "value": "745f68bbde53b5041ca2b5f0e2fc4a6d8f43017972d89680c004e594e7a6070b20a1e6a59cd5a0e6535776ed9d573b4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016825, "uuid": "c78064bd-534f-4de6-b9bd-de35c677c6e0", "value": "59F42305988BBE419F0D5DF90E470136071BD4E0D38B87D6B3A82B593C9EB70B2A9697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016825, "uuid": "18d2ba8c-277a-45a4-8b18-dac6ed19c7d3", "value": "12288:hcDE4TSvdsmJ7306DIvxGlNcyAjKsRs5TyC8N5osznj9fbld7OYwWxX+HYeQp4g:hJ9smRJEvxwujKsITyzN6Ojlld+WdFPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016825, "uuid": "5055c000-7261-4b0b-899c-2c9fc1fdbe5b", "value": 774520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016825, "uuid": "e159ee89-7332-41c7-94e0-b38bedf71123", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016825, "uuid": "0686ac65-8907-414f-a07b-74ba8b506988", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b16db0d-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617025537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025537, "uuid": "e86b0221-87bf-4123-9b1e-c0e2882e4665", "comment": "Malware payload", "value": "f57566d81832c3723e701b4d634b84c3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025537, "uuid": "af9be9ee-0cf6-4035-8947-86349f44dfdd", "comment": "Malware payload", "value": "486d056dcda7b96bde210500e726ccc5a7422b831a7e61f88227113af7ca8805", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025537, "uuid": "01a580e8-0bbd-44c7-bc0c-17d7d353cb3e", "comment": "Malware payload", "value": "5e75b2f653bdea4c88d8c244fc165fa7cceafd6c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025537, "uuid": "679f8f6e-23bb-4b67-bdaf-5e566a1408d9", "comment": "Malware payload", "value": "824a25619633bec7562159ba2628e050d7c152577a36be5ec7d7caea84c78fcdd65b09adf40474a7d96f7bd0beee39ac", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025537, "uuid": "75c870af-9ee8-40c9-9f31-c7eefe657c43", "value": "32B4BFF876047DD6666F176BCA96ACDD13B626239ACB94CC4064B7C305A3376FE02C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025537, "uuid": "4e0d5770-74eb-486d-b81a-3c8d9a18310c", "value": "12288:6y2tB85RDQtTBhOZW6KEBRZc7pIwKvjxcYIONVCCGy2ZXtAgxSg:6yRO76KerzpDBNYCGFffxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025537, "uuid": "7475c0fe-daba-4c25-9275-29e5f89a02a9", "value": 497594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025537, "uuid": "dbb14c3e-38e6-4669-a616-0232b9a4a9c5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025537, "uuid": "bfd374b7-d9f6-4eef-ac42-87f1cf3065c8", "value": "Sample pictures.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f12836-90a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617032541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032541, "uuid": "f531f220-6e19-40fc-85ff-9a28cc891c71", "comment": "Malware payload (RemcosRAT)", "value": "87c95a367b014881bd531f724ca8cea3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032541, "uuid": "11cd3ddf-ce09-48f4-95fd-25b7f79dc9e7", "comment": "Malware payload (RemcosRAT)", "value": "488e149d927fc0666fb9ed082f4cedf0c25db00f392974f2880b618efd5c0fbd", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032541, "uuid": "333d71ad-e1ef-4c25-96c5-ab2b23667aff", "comment": "Malware payload (RemcosRAT)", "value": "cfc31ed554820fc3cb8029d319fa5a0d36d4406c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032541, "uuid": "c0066a64-83eb-4391-8f84-3d90041b7eac", "comment": "Malware payload (RemcosRAT)", "value": "2d2741e4bbfe73671e84241e4a5e8fb2ca6c2fb224cea8518cfc623601353655c4e03566e61a10ceeb7d9e38ee557275", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032541, "uuid": "41008c52-ebcc-45c1-b1ee-e7803aa64220", "value": "AAD4239B6CB6911801CE9B403605EE4798FFA2507DB09A4E589CC07F3B9135E89F6CED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032541, "uuid": "db44c9dc-381b-4ba2-988b-211a13ad0ae9", "value": "12288:PIZ7VwEgGlyfIU+1h2Uf0ve9YWOMkWNFd7S1NpoH8sexZDSA1I0DOwjD+:PIZ7VwEgGofI/h2UfB980QNtVxpdzOw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032541, "uuid": "ead41280-6bd9-4426-be1f-4250705008d8", "value": 635663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032541, "uuid": "d2d36c53-e11e-493f-9740-fadf7c6af132", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032541, "uuid": "ffcf725e-b19e-47eb-8a92-c59b028a755d", "value": "payment swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e844ff-90af-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617037069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037069, "uuid": "badb03c2-8394-4995-bc44-5843440fb44c", "comment": "Malware payload (Loki)", "value": "2260627e8bc585ab567f4bf56b48b14d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037069, "uuid": "51034552-4942-4481-8287-d0e9b78763da", "comment": "Malware payload (Loki)", "value": "4962cfb568aa9d6eeb77cf412373bf2ac889256382014d050e8c8d477f5a2744", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037069, "uuid": "b232274f-a289-4afe-88b1-dd14d05e9325", "comment": "Malware payload (Loki)", "value": "8093a53a4ac63f39da81fe9e17192e7467632fac", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037069, "uuid": "a6f7b47b-74bd-4c0a-9baa-961c69330a14", "comment": "Malware payload (Loki)", "value": "149d30d68624ab597b769811bdefe942aae352d0ac48ed1afaa9eb0cce7bdf44f03623510674ad5663022877bf438ac5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037069, "uuid": "1b7da5fc-0cb3-4d8b-9edd-41c0c9b84d25", "value": "17E312B5471A4EFFB12A76191D89EE8FC5A3A54E9D4521EE10303CB13A73C7593342A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037069, "uuid": "d9efec0f-3d80-44e4-b72e-d28de13cbfa0", "value": "3072:WsFv3AQQhgD75uEwptkKU6Cp8NDzGqATyB5LFGoKY2FSMgdZfV/X8kshF:Wsx3ZHwTtkKnCeNdzLIYn3tcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617037069, "uuid": "99837b47-c833-44e1-a0b7-f22c9c0824dc", "value": 146103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617037069, "uuid": "b4da8b23-2c79-4d86-9b6c-4c1774b3440e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037069, "uuid": "43bd8141-901b-4494-ad37-70277f6de17e", "value": "Offord30622997.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1931d18d-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617028138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028138, "uuid": "3c0d97a0-6341-40b6-be0b-7cfed057e4ae", "comment": "Malware payload (AgentTesla)", "value": "c433a6fc4e1845fe90dc005fbd3fd4ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028138, "uuid": "88e6bf76-6624-4cec-9921-cdacc6be231c", "comment": "Malware payload (AgentTesla)", "value": "49a6b922ac532f62b844b5a51054eeab612a1a141978edff79aa69ab08d56817", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028138, "uuid": "80ee29da-58b1-49c3-85f2-993312142164", "comment": "Malware payload (AgentTesla)", "value": "542b9fcdda3cf1cdb369b3c7fc071562d85df114", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028138, "uuid": "67dc3dc3-a23a-45a1-af4f-1f432f79e6e9", "comment": "Malware payload (AgentTesla)", "value": "7c484f3b58dffd7140b50e0a452009bc8e068b20823457a4779930e60479ce333f086765521e65e8fef450dd55800a43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028138, "uuid": "1accda49-16de-4192-bc7c-fa3be8b51a8f", "value": "31B2F1B4AAF61088D26E67B92786CF850641FED5C1E768BED0397434C21C2623F314F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028138, "uuid": "85d112e9-aa56-4760-86fd-eea1dcd389ed", "value": "384:lao9DCujNWPf3SInIrA2f4XDA/vyfcU2+U/tZZeooBwHL8ckJ/8/L+1+XvIIPQQp:co9mujNWPf38Nf4T8NZZeome8ckJ4qQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028138, "uuid": "c6dadb99-2e26-4c4b-bbf2-19b7809deb33", "value": 24469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028138, "uuid": "31293dbc-485a-472a-a2c9-242ab7c72894", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028138, "uuid": "e1ed883d-a7a1-4bdc-8956-dd97e04d7692", "value": "TT Copy #8985434.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61749b8f-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996047, "uuid": "f7dd6392-db63-4a8e-8513-b3ee147f80a0", "comment": "Malware payload (AgentTesla)", "value": "76eef942bdc7d0191a14d89121f292f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996047, "uuid": "f70f44c8-16ce-43f2-b0d5-0e3ef1890501", "comment": "Malware payload (AgentTesla)", "value": "49e5d63b87b7ed850fe7efe20bc291354464e9e7e0d47df1a7a7238d525b7938", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996047, "uuid": "2dfbd39f-2f6b-40ac-b65b-c9884e4afc93", "comment": "Malware payload (AgentTesla)", "value": "c22fc7eab07ca1f78ee3943ebe2eee7ae82459e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996047, "uuid": "6645791a-b39c-41e9-bc11-2843bab5b814", "comment": "Malware payload (AgentTesla)", "value": "ce24a5706f2980654cd378f269fa19c0a2e9c1d9ea5798686aaaf2b9e9fe0f774d47c2f4ebc452487fb4e38ebc4dffa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996047, "uuid": "1291833c-f843-4ec3-9f62-78ad05d07529", "value": "810533877C63039C4ED2F8273310EC8638BD99618C5EC5EDBAE4C743A6579079A84E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996047, "uuid": "ea97109c-a71c-498f-aadd-723f8ce2845a", "value": "24576:TVN5QGeqYkR76hRFukDMCYfq/lvY5vq3HQAtUPAZ:b+NqGukKfq/lvY5vqAl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996047, "uuid": "95be4653-11bc-4bc5-a91e-79abdfbee42f", "value": 795521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996047, "uuid": "4fa11341-16ca-410c-a700-7038a2dde55a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996047, "uuid": "bbf28136-1f5e-48a4-b972-c7325616532b", "value": "shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93acfcaf-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617001714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001714, "uuid": "d84e752d-101b-4b3d-8125-11f7b67bfb5d", "comment": "Malware payload (ArkeiStealer)", "value": "a282da0cf8b4a35a1fec2a5751682acf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001714, "uuid": "d76d9fdb-d4cb-48ef-8e5d-d46b95fb72f3", "comment": "Malware payload (ArkeiStealer)", "value": "4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001714, "uuid": "5092db25-ee3b-454e-9227-587f15ba5de0", "comment": "Malware payload (ArkeiStealer)", "value": "0d56c63f4afd00d7bd67fe561a2b7de0a08ff365", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001714, "uuid": "16eb7737-98d5-40b5-afa1-1e87ac9ba591", "comment": "Malware payload (ArkeiStealer)", "value": "36bb40f1c1668eb80ad6e4a51e3579ed79dfcbbb329455df4151c98ee5982de063e47801d13ef62ff79097622fec060d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001714, "uuid": "40407456-5a5a-4c41-b117-e95beaed41c0", "value": "AED59D29B1B34CB6F36A5E3658164160673EFD843E28ACD635D6FA3E0BF518335261C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001714, "uuid": "b257cbe4-ef3f-4a42-9de3-3dd1b45ccff2", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001714, "uuid": "20c82cf5-f6f5-405a-bffc-6054bfad27cf", "value": "49152:VgprPO37fzH4A6hanqNmZBb9TcAY8bsTLtWfWT:WprPO37fzH4A6h0PtcAYbmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001714, "uuid": "45a89a9c-0c5d-4a77-802a-7fc81ddd4426", "value": 2949344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001714, "uuid": "bcd37205-cc85-4a06-bf58-6cfc2e6e1233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001714, "uuid": "a365e5af-0bf1-49db-b7d1-fe82a67e6da1", "value": "4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7ed39d-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616996629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996629, "uuid": "39af3f1b-2fc1-4a75-bb82-bd6789388eda", "comment": "Malware payload (Formbook)", "value": "2699565544023bc922f2683ed9ef1207", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996629, "uuid": "4241b90c-5c5f-4e2e-9578-d82097c325bd", "comment": "Malware payload (Formbook)", "value": "4a525cfb1981ce8d12a3ec61efd86016f4ae1f3dc089b18391a5e8af393e684d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996629, "uuid": "d1a7a373-ab10-4988-aa6b-fc04d8b7d669", "comment": "Malware payload (Formbook)", "value": "1677666318a29864c85566a901054c893be719e6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996629, "uuid": "a02e20bd-8e4f-4530-a03a-99ac74ce362e", "comment": "Malware payload (Formbook)", "value": "1c77944f7c6ed6c9d962aec9757c6a4242bf72fa227c62d1878b18ba34e4fbd15fa3e2d9bc4400b3cb3a337c7c7297dd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996629, "uuid": "2fc2f169-3367-4659-8345-daa346366594", "value": "7E94233D1BA4E6EDB67138BBC1BD110E7CBC9574818D7791F632A549161A7ECB82C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996629, "uuid": "4d09840c-20b1-4e9a-a05f-5bbb2de3eb9a", "value": "6144:rBKdWFak21TS0FFZvwowbrqLC4wGAoyhKJRImZ/rn8fWneWKI3t4WEwoOnCXppIK:179av1woOrqaAamZjn8fAeGdvmO6IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996629, "uuid": "8f13289a-8b4d-4ee4-9abd-b86ca53dcb3c", "value": 409626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996629, "uuid": "5456c063-9306-41b6-9d9d-ab45f0205dc6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996629, "uuid": "500cca34-8419-4b93-8eff-acd30159a877", "value": "DK Purchase Order 2021 - 00041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d765e841-90a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617030604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030604, "uuid": "56418b3f-c242-4775-8ee6-d7d6fb3f968e", "comment": "Malware payload (Loki)", "value": "b11585890781e6be24d8bbb52d0d0545", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030604, "uuid": "3611a995-0b1a-495d-b79f-1b5954e93d72", "comment": "Malware payload (Loki)", "value": "4a6bac5f25ba10ea1b6910ad13a16fb0833082c7866399bd710774effe8c9efb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030604, "uuid": "8e74783d-053c-4c5f-95c2-5314757121b6", "comment": "Malware payload (Loki)", "value": "1e9716c4f273994a5454723ff221a89755d971c9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030604, "uuid": "65b50420-354d-4516-9b90-1c575e0f35b4", "comment": "Malware payload (Loki)", "value": "f0eabc08948304ebb97e17922cff45d959aaa520d0273f5c312846f05441618ba3ded2cda5940a1feea6505fc12b1f27", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030604, "uuid": "c1005e97-25f0-4a51-b0a7-931a3cadd257", "value": "8AD433E46393EDDCED2FC31888E8AEFC5AA251C80D4E1701D5E402E4AB16E796971F31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030604, "uuid": "c521eebd-ff35-494b-b676-62d4be8f4917", "value": "12288:BdaWkma87cC5ctt9tDoQeYmoBEA0My23/nSSH8h73E6Bm2+H7:+Wkma8jctbtDoTA0My23/nbch7I2+H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030604, "uuid": "48f7cb7c-0838-4bcf-b65a-aba7152f5229", "value": 637346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030604, "uuid": "c5ec1513-d230-40bb-8f3d-949ae6537a1b", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030604, "uuid": "73e8cf0e-e5c1-48f3-b47e-7398c3e99203", "value": "Quotation_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edab428d-9081-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617017327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017327, "uuid": "d15acc4d-5bfc-4468-ba9a-894dce700a3a", "comment": "Malware payload (Formbook)", "value": "9e35fad13e16bc1cbaaafee537a4fdf1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017327, "uuid": "cdb24af6-ce8c-45cd-9568-45e2675b1880", "comment": "Malware payload (Formbook)", "value": "4a869a01d536dd9c7874319cde9f8f1e1f1e2ba45d537e988d999e6adabe890a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017327, "uuid": "dbe34284-742f-4885-80bf-e50b52c0d9c4", "comment": "Malware payload (Formbook)", "value": "abe7490e04a7ee70b7eedc9b221987c17f2f80a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017327, "uuid": "f5c8e7ac-1451-4055-8baa-be56b7cff8e1", "comment": "Malware payload (Formbook)", "value": "227289f19c7432b8f8557eaf729c8ed9c8b45426447b16c216ebba2e53de3e5c2bd01d41d115fd65b57640ffc5dc78a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017327, "uuid": "08570a64-75d7-4c85-9f59-74ea072d4a67", "value": "1915A18C6E9AC0CAC5390B7846C9D4F646E95FF30F22887AB9C45FCBF431745E50A626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017327, "uuid": "5e46c493-0c57-49f2-a3de-61ac77514378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017327, "uuid": "63710cd2-4291-4703-b78f-3e5f68fff24a", "value": "12288:2rgMhltFA+J2iNGZUU/LbINNRcEtRshqiPF57N2:+gMhltFNJ1MZVLiRjglP7N2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617017327, "uuid": "a22d8e2a-2a8f-4afb-9ad3-a2acf4db6e2a", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617017327, "uuid": "f29e9dce-c55c-4324-94d6-7ee4f7aa6012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017327, "uuid": "6f80a32f-674a-497e-83c1-8de9bcc45100", "value": "Scan-45679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0403614-90d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617052550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617052550, "uuid": "85aaaf2e-a8de-46cb-a5ab-7fd1bc9d64eb", "comment": "Malware payload (ArkeiStealer)", "value": "7bf8cb17d39796d800e22388d23e9fd5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617052550, "uuid": "3ca6f16d-b350-4dc6-b3f2-7364ad2a2d8c", "comment": "Malware payload (ArkeiStealer)", "value": "4ae0156d1ccca584c5ed35708b150e0649cd470f5b192653a578c215e5118c08", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617052550, "uuid": "2e77b1b2-4979-4b58-82a8-bc092ac7002b", "comment": "Malware payload (ArkeiStealer)", "value": "3327ba03c0fc25fc6a7f3c4fcbae40fde7ac0b07", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617052550, "uuid": "d435c559-acb7-47fb-95e9-5b9b82893ffd", "comment": "Malware payload (ArkeiStealer)", "value": "04ac4ea624b4687f345863cc7825ca97b540ffa916fbb2e81c4b53b7467a469dc272b692f7d65c568a008310394388bc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617052550, "uuid": "f57e2bd7-4771-4675-87eb-d3b1adcd7bbe", "value": "0C863349718681B7E824183D544B63F1B433BF0C4139990E5BED0BEEA1373AE1E597AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617052550, "uuid": "3ed81622-5499-4ec5-9f21-86489e950c9f", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617052550, "uuid": "943f584a-8eb4-44f4-a02c-1d05ece04067", "value": "196608:itz+7MBr0wCCoxY85JzuXG03mB0ocqsgJ7inbth7MY4Uw:M+7MmdB5JzSwB02FIbfQY41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617052550, "uuid": "92cb1906-e474-4cc5-a451-63fd497681e1", "value": 8162995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617052550, "uuid": "8484a779-8323-48a7-bed9-b86d6a28e28c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617052550, "uuid": "ae3b61dd-551f-49b9-b975-5d65ba8dc2b2", "value": "7bf8cb17d39796d800e22388d23e9fd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75975b61-907d-11eb-abe1-42010a9c0039", "comment": "Malware payload (MedusaLocker)", "timestamp": 1617015408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015408, "uuid": "93581392-3b5a-4d67-b799-78848643f925", "comment": "Malware payload (MedusaLocker)", "value": "82143033173cbeee7f559002fb8ab8c5", "object_relation": "md5", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015408, "uuid": "b79a57f7-24c1-498d-9f73-aa235ade24fe", "comment": "Malware payload (MedusaLocker)", "value": "4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4", "object_relation": "sha256", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015408, "uuid": "866b770b-1264-4f88-b545-f79ef7f9c18b", "comment": "Malware payload (MedusaLocker)", "value": "e03aedb8b9770f899a29f1939636db43825e95cf", "object_relation": "sha1", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015408, "uuid": "67c0f783-83ab-4462-9e41-bef2fef7ed6a", "comment": "Malware payload (MedusaLocker)", "value": "2fd798748f7f7b089de4c3e66ed91f100c5c194bf99655dc6c02a06ee58f0cbc8a19eb80c6926f5aa0c24589105d14ff", "object_relation": "sha3-384", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015408, "uuid": "2dc2ab4c-9d00-4c96-b0a6-bf37aed2dba5", "value": "32E48D1035C2C132E97315728EBD996E416DFD220B2728DBA3C8165E5FB99F27E32532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015408, "uuid": "76df2028-b8af-437b-8ca6-8363e51126ce", "value": "f2a8a842c869f344b4d75729bc60feed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015408, "uuid": "c7dfce7b-9a84-47d1-af7d-b75bc66fdd1a", "value": "12288:cPJ4U0TYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuMJVoM7:JzTYVQ2qZ7aSgLwuVfstRJLrYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015408, "uuid": "9ad2c175-c9d9-40cf-9ba5-c6bb37791992", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015408, "uuid": "e6c1d1b8-6bb5-4e9b-bf1f-78a35031398c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015408, "uuid": "e374fab3-bf72-4ae8-8e1e-052b508e3de6", "value": "4ae110bb89ddcc45bb2c4e980794195ee5eb85b5261799caedef7334f0f57cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33a32aa-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1616998358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998358, "uuid": "fc93500b-e6ac-402a-baf5-e1effa1f2dac", "comment": "Malware payload (njrat)", "value": "5668a086e3c47ec9cdb8c02b36fd3395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998358, "uuid": "d643f415-dd7e-456d-8d7a-93c8ba865139", "comment": "Malware payload (njrat)", "value": "4b1cbc04c8e1b83928148304d772cbf7c55b7aaedf520720b2bf2a6a77fd34a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998358, "uuid": "e7d5bcde-af4d-4688-8eaa-833f9500425e", "comment": "Malware payload (njrat)", "value": "263b69b49ad9ab8237f706f91f42ff889d939f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998358, "uuid": "f207398a-34d7-4820-b87f-8d8af33f8239", "comment": "Malware payload (njrat)", "value": "968a76bb9ad4def37d7dc3964feca28ffc5f2a08a4e9a57f5190b39ff0346fa8152b37e1e61a3d6f720af32016b1a688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998358, "uuid": "5e94fd8e-bf98-4592-9059-f7dc59d4e14e", "value": "4B84AE3E73647FAED52C0F3A86130D0C83E5C1137273F55AADF51CD697A2B094A2A49A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998358, "uuid": "4b80323b-320c-4076-a4d3-5f42086454d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998358, "uuid": "5e6e8692-89c0-4295-83e3-496937941139", "value": "6144:qUUNuhHYmL2hhLpiO+QYDC4PR4w3/nAiIj9xPNt1MZ/bAidxlAQFa:qUUYmiO5yvAioJexddHAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998358, "uuid": "042f23a0-a9f6-4d26-878c-3e35898b140c", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998358, "uuid": "5f5a83f3-603c-4515-8261-793bf7971434", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998358, "uuid": "46a88eb1-3e22-4241-8521-b9624b1e4a76", "value": "OrderRequest29032021_BituChemLtd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a7e8f5-9081-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617017342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017342, "uuid": "d6363254-dcf0-445c-b042-53edaa0ad809", "comment": "Malware payload (AgentTesla)", "value": "c4f1c5732b3308eac05ce325fa53bac8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017342, "uuid": "8cc65616-64d3-44cb-839a-ef87dbd5aef0", "comment": "Malware payload (AgentTesla)", "value": "4b49558e3e90359b9d91a2f42e97cc10048d4fdbb5bf4956fea2d91a4f97168f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017342, "uuid": "027e1a02-d6f9-41de-8932-f64fc2617c41", "comment": "Malware payload (AgentTesla)", "value": "32a51b706742af5212bc462096150bf4813a9038", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017342, "uuid": "52b28db5-23a1-4b2e-aa4b-42d8f8c71c10", "comment": "Malware payload (AgentTesla)", "value": "9855cc3eba04ba72e0a741de152e445f8ec533d55db4a37b70846e2856cb665862a2c2f218a1d69b50acb831d537585c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017342, "uuid": "ec91631d-e40e-4b02-bdf7-0e418b887dbe", "value": "D715127232A57FE2F9798FF5653124444FF97427A671E28CAD8220D626B7B019F90C23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017342, "uuid": "e3dd3e58-a65d-456b-8dee-adbfaffb9234", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017342, "uuid": "b491d5cd-6e60-477e-866b-62bacf24953e", "value": "24576:mI4oJK8cu/26CkiLF50nUMQB6EDC+tOzrM:mI4oncf6CWnUnB6dVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617017342, "uuid": "d4b23696-79a5-4a60-a1f5-38d64b35e655", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617017342, "uuid": "81696544-20af-4d9e-a5b2-4366668f951c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017342, "uuid": "58ccbf8a-295a-4420-8e35-2ed249a7dbfa", "value": "Dlivery Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04e8d60-9058-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999722, "uuid": "cfb511b7-e930-44f5-b700-32af70635593", "comment": "Malware payload", "value": "e3645f946dd0cd7e0f42f27eaccc3776", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999722, "uuid": "985b16e7-2fa3-4239-ad64-b4738704f070", "comment": "Malware payload", "value": "4b608e3f2c70fd73d5fd38a095d35133f8cd0a071004501691a420e9badc3b2d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999722, "uuid": "03635c1c-cf10-408e-b874-3615e6ee4bd1", "comment": "Malware payload", "value": "e2a36fbaf7513915a5b01d03a9dbba951282b2d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999722, "uuid": "01d2025e-77bb-4d40-9fb4-fd37cfdf43ad", "comment": "Malware payload", "value": "ad6664f75a3b156b27f944d976e64a0d97ec19682c9fba402f7134d52546e2e9294ddd055e6df7a9d7965005af8332a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999722, "uuid": "7cf0dd56-0c30-4ab6-9a5a-144dedaa7eec", "value": "1FA4231A61E07D194A57128C1D4B869E36F4244CFE3CF718E4A61AB07E86EE8D0369FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999722, "uuid": "9361eef2-3f77-4ee9-8502-bad3cb3f4c9e", "value": "12288:A54nZc4S+ob9QecY5XHvimXFAAti/OtJxniiL9pb:64ZcNrrcgXv/GAc/OtJxJ9pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999722, "uuid": "1b80ba61-7b33-4357-a078-cd9eae0be9bf", "value": 465454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999722, "uuid": "14449967-9c8c-4262-bcc6-afa567cb0fdf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999722, "uuid": "d2b95ef4-2ccf-46d5-a5a4-708f1cce055d", "value": "New Purchase Order.xls.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf198d4-9098-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617027152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027152, "uuid": "44ab2b24-7cae-4e28-9f4c-a17cd8d85354", "comment": "Malware payload (Loki)", "value": "cc8d6c29506bd62f1dc87133455bbbab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027152, "uuid": "eb56e8e8-8cee-4bb3-a596-1b14eff59da9", "comment": "Malware payload (Loki)", "value": "4b725f9b503e801f63f4f18f014d3d0769830550dd1132a56cf9625250a65fb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027152, "uuid": "1c945e95-ef42-4e6b-87f8-a840cb6a47ac", "comment": "Malware payload (Loki)", "value": "7880b81044d0b26ed98ee15e9aa95ac42c7878de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027152, "uuid": "756a8a5f-8032-4310-aecd-7ec6457e0c15", "comment": "Malware payload (Loki)", "value": "2f85a32f37a257f2eee5d4faa54e026694ceb6198685d210450dae6c70ec78caf4278b7e7039069e3d19ba9bbd8a1610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027152, "uuid": "05e5b150-e6c1-4130-a93f-49f952bc2489", "value": "45D48E72B390443BC16316746C1B57A9AD3AFF203E18A84B67F87E4C5F3935279291A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027152, "uuid": "36b2ee42-b363-458a-8017-0aa69cb0ca90", "value": "1348df303efcafad50a6f5b8c3aa3e4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027152, "uuid": "8d249e6e-a408-4aed-9847-b1fcfcdd08eb", "value": "12288:fsOKEbAY0nluh0T5ZcxSO8Al/Rbe5pg+s9GUsWB7YV:0FE30nlu+T5+fHRwODsxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027152, "uuid": "fa17ce2e-bc53-44b3-b25b-c6293978a478", "value": 633840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027152, "uuid": "db4c1213-7572-4171-85e9-288a65c2513f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027152, "uuid": "144c3871-d023-4889-b059-b8a5cc294c64", "value": "purchase_order file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3668dbc9-9092-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617024321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024321, "uuid": "feb7a564-ea7a-4983-906d-0236ece60039", "comment": "Malware payload (AsyncRAT)", "value": "dd3b0f098c83a98cdf3cbadf09234270", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024321, "uuid": "8c00b207-25de-45c8-bfea-91f5dd8ac97c", "comment": "Malware payload (AsyncRAT)", "value": "4b9802e46fc0efd83d5e603b47743543987c12d543b4a75b67d6b873e889eb34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024321, "uuid": "346d6e8b-2c9c-4cdf-805b-5d6a2c60b35f", "comment": "Malware payload (AsyncRAT)", "value": "17957536a610d616dde30f9447c40927ae4da1df", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024321, "uuid": "180b998e-123e-424b-a1e9-0b7c9e101d62", "comment": "Malware payload (AsyncRAT)", "value": "126075005588a8461a89d20529b7bf2c879621410ae1365d6124ad4a73b2958aae998eaf6a3bd443bc7158c80cc07783", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024321, "uuid": "9b73a9a3-0037-4c13-ba5d-bc439ea26df8", "value": "8255CF12B391DA66CC708C78A09756F0137ADC6DF91FFA236DE5F1AB193E2C89702251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024321, "uuid": "8a8670d1-6a65-4e25-8920-65fcfeca8ad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024321, "uuid": "5d929618-0f8b-4a79-a274-d72c1860b2e3", "value": "24576:V+wVZL6jRg8f5Ev2lI9S29k6rMrN/tYlyUW9:V1oC2KtkcoaBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024321, "uuid": "7c3c41be-59be-4c78-a96b-23e63713d70f", "value": 1404928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024321, "uuid": "1b1e7e98-3ded-4314-b6e0-87dc0ef8ac45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024321, "uuid": "328d29ae-272f-405f-adba-1048a67dde38", "value": "dd3b0f098c83a98cdf3cbadf09234270.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c727660-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616998266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998266, "uuid": "13a2d2db-420c-4bb8-8fde-df985c227f80", "comment": "Malware payload", "value": "09fe20dfb5d6e5ae2b2595b214d677e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998266, "uuid": "e5876afc-97de-4cd9-a225-af16d4ca7ace", "comment": "Malware payload", "value": "4be8b909642a387e0a3efaf1d568dae83e6f45d82a2dde11a5683ce22ed3cb03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998266, "uuid": "6a7643cf-7e01-4728-8d86-0f2ead592600", "comment": "Malware payload", "value": "0c03c93409870f9c763b931af448fd28366d3f8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998266, "uuid": "d73f3a3c-8614-43c8-9831-268bcea69f0a", "comment": "Malware payload", "value": "691b4a61c1220555a053451363a1109daabd422b4571aaf522a3cd0d78195cb791582713af8ff67209b8efadfae8af31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998266, "uuid": "0c2ebfd1-84a1-4d63-86c7-c6956ebe95a0", "value": "4D17332C336C7BC4C026C8B85533D946B379171E52F08AAAB2CBBA4C7FEB5449546F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998266, "uuid": "126e68af-115d-4cb4-b727-3edf7ecf0089", "value": "69fae9604d8dbdf910c547b8bcd38884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998266, "uuid": "571039bf-8abf-4e16-8e99-ffc1d8b7d6c7", "value": "393216:JsRvUMEeyAVkcXPs7q5kke2xbVd/uSQb0TMBYl+/xJ7:JshUMETYfmY9eWvWy+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998266, "uuid": "b1711140-eb98-421f-9d8b-5716597659a5", "value": 19154432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998266, "uuid": "3fda4996-23ba-4b8c-8370-7595b9a80374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998266, "uuid": "a920d150-9027-46c3-9326-d58e60936391", "value": "t-rex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1183e55-9076-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617012528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012528, "uuid": "57e02f7b-70e3-47b4-86b5-c8adfa780d79", "comment": "Malware payload (SnakeKeylogger)", "value": "bfb4a4fa36d42121348f838507e721f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012528, "uuid": "9f91f764-2b8e-4197-ae49-f594511c70c2", "comment": "Malware payload (SnakeKeylogger)", "value": "4c3a40e5c49e3467a82408e9cd09177efc8b4056e139efc244a9ffe2cee64cfe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012528, "uuid": "09f2e737-534e-4f88-962a-5e38d5fcaf69", "comment": "Malware payload (SnakeKeylogger)", "value": "8bd0548be4151c0d47dbd2437590b98db570d74b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012528, "uuid": "bae7fe2b-e26d-44ce-8cf2-692aa7cc9407", "comment": "Malware payload (SnakeKeylogger)", "value": "f8471cef4324df38759b6e0932289226c6585ced574485a8af430b8fc9bb39ab300a8de94eece18ae989f93d32544158", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012528, "uuid": "9caf7a41-f18f-489d-8a27-5a951560d34a", "value": "1EE433A05546689D9D9F6FB499F83DDB0373FB80A1B2C026DD08ADEC786A043D43953B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012528, "uuid": "a9c4b136-23f7-4698-b021-4fc0f052b5c8", "value": "12288:/53aJJOvJ1PtlJkKk9hagvhg3TUhcIwZGsh7usFg8nXri:R3iJOvPPaKk9Jvq34cKsKsFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012528, "uuid": "13ed9793-02a5-4396-be3e-10e81ec85e38", "value": 696445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012528, "uuid": "7a33c9b1-c00e-42b9-b329-dd9f2cf6640d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012528, "uuid": "8bafd068-9020-4b85-ab8b-11a7412ca692", "value": "ASB swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070c0012-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617029396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029396, "uuid": "d09657cf-dec2-4fad-8102-4d9318250844", "comment": "Malware payload (njrat)", "value": "4ad4f2326a267bf7670944c88c7e752a", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029396, "uuid": "3f2813e4-db97-4f9a-9a40-3fd3a9530f37", "comment": "Malware payload (njrat)", "value": "4c72f894b1f77f39a841ea11ab8572d81c3fd525e78ceacf4b4cad4234aed667", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029396, "uuid": "9ee478f1-ea19-4f74-bf2e-0d89c324cc15", "comment": "Malware payload (njrat)", "value": "05e4d6773898d1e8ce247217c09bf70521f3f9fd", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029396, "uuid": "47646de3-e022-425a-9a2d-ef4d8a12c2e5", "comment": "Malware payload (njrat)", "value": "13f84a541b6018be3a638309afc3218c4a42770ce3d05b9056f2e214f1ca484c401e07e8b0dafb6f183d822a46e530bb", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029396, "uuid": "5cedbfae-0037-4842-ae80-1f09e6cfb585", "value": "190412275E69E4FDE60A50D0A48D121B0F78FEE0B38FFE51AD8E8F8146A57039903D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029396, "uuid": "6cc47a42-de0a-47ce-9543-023033128eb1", "value": "3072:iYzxnMTzqT7xB8rZO7E4vLuDT95HQLdUV0uOhINLPgl3Q25xXq3Ln3I:iYhwzqHx6rkZDuN5wvhINLQ3Q8xXq3TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029396, "uuid": "7823445f-3860-4f2a-a37c-4d073b16da17", "value": 188090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029396, "uuid": "7a4b720f-57f5-48fc-aff6-385e5bc98190", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029396, "uuid": "f769fd0c-0fd9-4f53-b0f8-a437584f8013", "value": "FACTURA.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325fdab7-908a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617020878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020878, "uuid": "5e110b23-72d4-4aea-8b90-fbd2a9c0ddd7", "comment": "Malware payload (Formbook)", "value": "fceec6b67c7ad07b686e746d9f813573", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020878, "uuid": "57f7d471-d289-4ba2-8e9f-6eb9c083e377", "comment": "Malware payload (Formbook)", "value": "4cc12290092624d264b98e838fab950d5b1865c30e50db3f72ad613187595d81", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020878, "uuid": "1a921e90-2c16-4d94-be17-6f8cb9e244fa", "comment": "Malware payload (Formbook)", "value": "f3e838508e4572dd95de96f691c1bbf0c4fe2ade", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020878, "uuid": "c859314b-4979-46d3-a471-7dd130465181", "comment": "Malware payload (Formbook)", "value": "8cb64403d44312b8d127901d5734fc328599b1d74948f0742658dba8f2cad5e71e8b4d748c89f2707db5ef28715a8227", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020878, "uuid": "cb3ce05d-8484-43a9-b2a7-c47eebdb9bde", "value": "59224C6DC542FC2BC217493DE06805F6EB1C11529693A83B6159F19E47A02C38B9F1FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020878, "uuid": "fa8b5e52-2c15-46a1-8ba4-6d0bcaae647a", "value": "192:ScIMmtPCmHqqG/bYx1vtqgkD6/JgiuQ3TgKJN:SPXqmsO45D8J79Tgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617020878, "uuid": "3647fe37-c7ea-4fc1-8de3-bef7a59d32da", "value": 10342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617020878, "uuid": "656166ac-dfca-410b-bcca-bf1751cf017b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020878, "uuid": "384cc4b4-c89b-4699-af8f-fada7f86f747", "value": "New purchase Order_Invoice payment info and shipping documents.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b83f62b-90d0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617050905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050905, "uuid": "0dd6d0c4-b8c1-4b65-af04-d8b538dc14e7", "comment": "Malware payload", "value": "c759e2a5bc28804347759869e6370b42", "object_relation": "md5", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050905, "uuid": "79dd15da-4ef1-4c5f-a430-4218dea290bd", "comment": "Malware payload", "value": "4dd950fcdcd8483ec9346b4a5214931134975c439cf463daa3a0518cfc5db9a6", "object_relation": "sha256", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050905, "uuid": "578590a0-2116-4a6a-b2ba-6775838c5476", "comment": "Malware payload", "value": "0ed870df940076422ccccc9dd81154d728bb5da3", "object_relation": "sha1", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050905, "uuid": "f753d44a-5477-4369-8d06-4740aa9ac8d5", "comment": "Malware payload", "value": "4237d6965be6e5d42865d03dae3ea909342c4f3e3bd3dc11d2f36fb80121e5058357875530e6c094fa42a170e47b3e9d", "object_relation": "sha3-384", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050905, "uuid": "ae90de8c-22b4-41e0-be3d-6506f6ab958e", "value": "FA062373B76BACD8CC56F5B06F11409467C41353F2823EAC32A06A87DE34956DAB87C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050905, "uuid": "7fb5295a-f8e1-4b52-a036-2802ba94021e", "value": "56f52fe51ac6695ebdcb4c51172b21df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050905, "uuid": "28ea9a4c-52b0-46bb-bb6a-c7474f74f106", "value": "98304:nMY7F3ugutj+mPHHsOTL+bUFbPYRRdqLUJKGjkfVE:nJ5ugZSHs8LEUJ8dqwHoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617050905, "uuid": "512b3509-c26e-459c-ba90-842325746ab9", "value": 3672392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617050905, "uuid": "47ebf2d1-1ea0-4acc-9192-9733c1ebf47c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050905, "uuid": "fbd2b758-6f70-4c81-b587-e69e98ced068", "value": "4dd950fcdcd8483ec9346b4a5214931134975c439cf463daa3a0518cfc5db9a6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900d1aaa-90d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617051530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051530, "uuid": "0d76dc64-efd2-4e6b-8376-57f2f250ade6", "comment": "Malware payload (SilentBuilder)", "value": "2a21701890a78bfbe32dc573093d0ed2", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051530, "uuid": "d5eeee97-6037-4b7f-9ff1-c1b81738fe88", "comment": "Malware payload (SilentBuilder)", "value": "4e3396ca4dd7c42bfb4fcd42442ecd7d9cd1b202f35079d79bc8d9314c743154", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051530, "uuid": "093b685e-abab-4276-9ee9-240ac7883ee5", "comment": "Malware payload (SilentBuilder)", "value": "2aff475b8d842938d0152b96809d6a0020a4d08f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051530, "uuid": "49f2fb03-3a10-4646-b489-e79e26d402ed", "comment": "Malware payload (SilentBuilder)", "value": "b0d3b3cdbf7b35ee8160d5755ecd24ed831add1cbfdc1f18ed242d3d51847f63fa074fbd421c4cff70a845bfe72ada4f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051530, "uuid": "2c7906ca-da98-4732-a9c6-f23b3b83c97c", "value": "B5A412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051530, "uuid": "acb3a1df-dcc7-4f37-8655-0363a5f4592a", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ71:dEKXJ0MDs8QTjVJVf4k4Zi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051530, "uuid": "299323f4-24b1-4443-a067-40a1148443c2", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051530, "uuid": "c5f3660c-87b0-4a56-8403-7aa3c2c08872", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051530, "uuid": "b4612f0d-4718-4b1f-befa-70c06dbfdfb9", "value": "SecuriteInfo.com.Heur.24571.31717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ac76df-90d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617051531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051531, "uuid": "3cce0a4b-049c-49f0-8b8e-33aded872b08", "comment": "Malware payload (TrickBot)", "value": "6f8c81f2c75397a505d230cdecbae2b0", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051531, "uuid": "12b0f8a4-251e-491f-a538-bc764507e763", "comment": "Malware payload (TrickBot)", "value": "4f2870ceceed96cfc6cc9047a92c1d1d5d4178e61cc93952f0314e0edb147457", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051531, "uuid": "23d33d9c-dc3b-42c9-93c3-08af0ab961ec", "comment": "Malware payload (TrickBot)", "value": "634b982cfccc5e8d3db0c5793e9ef0931d0069bc", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051531, "uuid": "0adf3e0b-d3b1-46a7-9883-3774fcba16b2", "comment": "Malware payload (TrickBot)", "value": "f97db0da130d7e5c7388e150967537ea64b0ccee19e33826e7ac71bcee3b3e69dc7a7e0b25a6acd50d352417b8e7cf67", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051531, "uuid": "13a05c0a-d402-4507-9ee2-96696cda4c92", "value": "4FA412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051531, "uuid": "c36633aa-5b78-4593-843b-df1eee25dd46", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7J:dEKXJ0MDs8QTjVJVf4k4ZiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051531, "uuid": "43e5d47d-c0bf-4b35-ac21-f1d7bccdc6c3", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051531, "uuid": "0b22b456-845f-4316-bbbc-d57147f3e5fe", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051531, "uuid": "c3383af3-b370-43a7-baaa-920babda61ee", "value": "SecuriteInfo.com.Heur.29305.9020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c1d0ec-904f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616995839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995839, "uuid": "8b5470f4-79d4-47a4-8160-bebcd507e1bd", "comment": "Malware payload (Loki)", "value": "8d79d6d1d9e439c0cee3fe46957ae8d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995839, "uuid": "f24f2e8d-736c-47e3-861a-7d1859553894", "comment": "Malware payload (Loki)", "value": "4fa6f61af228705c98ca7b7842ce636acc51481b0f3f4685c82b2851bf88e440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995839, "uuid": "57d197f6-6f9d-461c-85e0-a4dbd65229cc", "comment": "Malware payload (Loki)", "value": "79287809e35e9c55ce972190353c098fe159d68c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995839, "uuid": "29d1d67c-387c-4e99-b77f-34f0dd589efb", "comment": "Malware payload (Loki)", "value": "19cf05016c4e6f52a1ad57a0a6fb619d36f60fec755ecae245ffeb7a01fc8b320fd0e045582fda7145840361cec6daef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995839, "uuid": "9e8d589a-63f4-4a2e-8157-fcd8798b005b", "value": "F4645B4E39F98670C8A79E72C627E4735A5B7F182214910B7BD0FF133AA5406B72B217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995839, "uuid": "b99f3649-f46c-474c-9f7f-59194a644a22", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995839, "uuid": "8d14446a-bf8b-4d3b-8a9e-c8275fa78705", "value": "3072:fTs3BxJNmJCcBxuIP1UCxFjx3RER8IH5MS4nheiAX9W7OSZprEz0fBy6c:fAPV3CxFFBOQ1A0iSbrICBy6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616995839, "uuid": "fe714b3c-8d1a-4890-9a60-38d84d017633", "value": 321224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616995839, "uuid": "6d9c5259-792c-4c9b-ba07-722ed66aba6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995839, "uuid": "966aaad8-4c93-43e8-806e-82f89b33c6e5", "value": "BOJ, TT.Swift290321scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a52751-907b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617014650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014650, "uuid": "573440f9-ded1-4085-8afb-51096f93645e", "comment": "Malware payload", "value": "58a55fba281d001b6ada27ec0037b162", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014650, "uuid": "fef626b1-196e-42db-851d-4a142cf43760", "comment": "Malware payload", "value": "513476e12094db94dd755131b162a016b2ad5c41d387b26c3a5c803d28d3fcb6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014650, "uuid": "8c35b7a5-0331-479b-8adb-2b8741cf371f", "comment": "Malware payload", "value": "14fedddb115f7634b4adbef30fa4a9f77e4eda14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014650, "uuid": "0aadb190-9e1c-492d-bf20-2ff141948dbd", "comment": "Malware payload", "value": "ebc0b7006de7950d8f19bae9473267be1f50e4a8b27a1fbaec12c4d2c68d99110564103d10b4495f5af6d093f28c9472", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014650, "uuid": "f4ab06fe-d36b-4ef5-be96-41d2dfd92e2e", "value": "9023F163B062F54D3033D9483A372BC5727CB39A7864DBE018B976899EEB24D5F1B014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014650, "uuid": "3b2e87e4-51e6-4160-b0b7-fe91e2388896", "value": "768:+CUddlMnEESYCJTF91wQsVJzMBbfLFgrHbb8RidEXoaXVC1cG6jZBvGS9jH3/:WdlaEDF9iQOz8zLFgz8UdEXpFC1dkntJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014650, "uuid": "d635cff6-32cb-4f36-810f-807bea5e9d6e", "value": 46397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014650, "uuid": "26859a38-7e70-46f2-be79-036a8e8a75ff", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014650, "uuid": "bbb30abc-52bb-4b50-ac30-9dc63dd0346a", "value": "STATEMENT OF ACCOUNT 290321.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851459da-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "e31d85bc-8093-4fe0-8726-b407b5140615", "comment": "Malware payload (Dridex)", "value": "8f49af3d022d4d808c7d6f9f5cec035d", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "4cfcf97c-7d97-4cca-9fdd-668be59d3fd6", "comment": "Malware payload (Dridex)", "value": "5191f39963ce0ceaeb612c49bdb7aa937dcc01eba47246dd2b837a1d32fdddf0", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "736a9743-cefd-4b36-a7cf-dc29f61cc8b3", "comment": "Malware payload (Dridex)", "value": "d7280461554343ca93a408c4a20b7c0de3c6b0d3", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "3173deac-00d0-476b-9102-ae01d68afb60", "comment": "Malware payload (Dridex)", "value": "b043c08d415c4f227fa081df7545cf99e8981978fb0804f21fa917c06e1d920f6510381ac84333c459217d5659894c78", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "856704bf-5aa9-42b3-8257-7508d102867d", "value": "EE84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "381c747c-a0de-4fad-969e-e450fdcf1600", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "a1ea96b8-54c0-4569-b2cd-23e222b71095", "value": "6144:sbazNBbycfmKsyUlVyMdUFIk1KyHNwoA+pFp5xM6C1h:nzeTlVy/7HN1p5W6Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029607, "uuid": "d78d1cf2-728c-47a9-a709-12ad85ec4943", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029607, "uuid": "d5610e83-5b46-4128-a54c-82f4ca98ef9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "eee5e8b2-7639-4107-9926-a3aee3e62aa1", "value": "5191f39963ce0ceaeb612c49bdb7aa937dcc01eba47246dd2b837a1d32fdddf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321372fd-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "6fc422ce-0448-4cb7-a1ef-050ee9cd8ff1", "comment": "Malware payload (Dridex)", "value": "52130104c223eee03ec86482eafec3bf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "26f24dbf-1e64-476d-a007-ea0b399eec44", "comment": "Malware payload (Dridex)", "value": "52094e1e6f1dd96700f875909a076b9c489db16091db279e1f246e38809b4065", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "b7accf19-9652-4fee-a131-b2298279d91e", "comment": "Malware payload (Dridex)", "value": "62846339f26e6070c990e39296abdfc4541bde0d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "e74b7880-4168-4912-a4a7-5f265880c4e4", "comment": "Malware payload (Dridex)", "value": "cbfc8f3e3277822bcf2427bffb85dc5a3874f257154d319e76dd9db2641320d802fee855c85ab50291d094057587f931", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "461f0e8c-dca1-4ae2-a2a8-0a795b486545", "value": "6214AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "41573591-0e31-4ae8-aab4-82430942c8c1", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "9724f071-05ad-4d2b-9b6d-55d89874e9ae", "value": "3072:RpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:RBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028179, "uuid": "b51a7c08-eb90-4935-b94f-63b1deb56a33", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028179, "uuid": "e0cbe14d-88ab-4a90-9d14-8101bc992165", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "eab6e94b-f05d-4891-b63d-50cd60698d1b", "value": "52094e1e6f1dd96700f875909a076b9c489db16091db279e1f246e38809b4065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b35dfa-9056-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616998825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998825, "uuid": "4883fa14-67fa-4e25-a26b-c6a59361ca35", "comment": "Malware payload (Loki)", "value": "dab2505496a45e8ccf8fb3e2966651cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998825, "uuid": "23b0cf8d-b775-4729-89b6-268803b5d5ee", "comment": "Malware payload (Loki)", "value": "525a8b4b10e2eb7067eac0ff67cffa19779019dbf5ea82f55f8b589acdd3049a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998825, "uuid": "5adfe695-1848-4e17-81fb-4636d1f20103", "comment": "Malware payload (Loki)", "value": "769e9c1ec57beed73b801351257f72249e3fb67a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998825, "uuid": "7b3fa52f-f546-4f1a-b65a-8ab977269e70", "comment": "Malware payload (Loki)", "value": "81c535fbe9432937ce6ed2c8eb7c551a0bf52922d7d59a1bb8a432a28562afc51993e25dca555037b3c20611437813ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998825, "uuid": "6d07a4c1-1094-4409-b6f1-8dcee93e4f50", "value": "D0D46F8C1C9AC1E6E6350B7846C9C4FB46EA5EF30F22C879B9DA97C7E020746F506536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998825, "uuid": "635c9ebb-7040-4d46-bb05-81b8b9651f7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998825, "uuid": "ae7feaa8-c4e1-4527-8e02-b18655306df8", "value": "6144:GZPs5HPlsRaVd+NvxovXUP1KtdCsIcqDmgZYLBvtKVmtIZjznR2ssl51x/:GZPs5HPpdIoWoTC5nZYnc7Zjjjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998825, "uuid": "59f6b05b-1754-46ec-b81b-f71ed1d40472", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998825, "uuid": "13f7664d-0639-4bb9-b5a0-c6e13843130d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998825, "uuid": "3598c772-17c3-4ca2-8f9e-ce6ce3afb56c", "value": "dab2505496a45e8ccf8fb3e2966651cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b936cede-905b-11eb-abe1-42010a9c0039", "comment": "Malware payload (MoDiRAT)", "timestamp": 1617000918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000918, "uuid": "3a41370b-12c5-44f3-8e87-3cb12111c817", "comment": "Malware payload (MoDiRAT)", "value": "0183beea62561077fbad5ade51f3ee7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000918, "uuid": "330d594c-ac35-45c5-972f-8c403a432e0a", "comment": "Malware payload (MoDiRAT)", "value": "539c5345917d080d775322a9f7bddc94e224abea97247dbf91c361a3ff9748b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000918, "uuid": "86c93c49-cdc9-44e1-b694-3336ab715757", "comment": "Malware payload (MoDiRAT)", "value": "0f68e1c40668f1198cdc69228a8419885b9fce7b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000918, "uuid": "2580a063-5c85-46df-ab67-74b823a1bb62", "comment": "Malware payload (MoDiRAT)", "value": "4e2a0594e14e69e131dd9e20b324cf7894fa3375fda8235b83edb3396eb06acc7759b41b76ae6c4c0ef8f8758fde0ffd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000918, "uuid": "d08b1160-2c81-42e7-a7f9-cef5f8b7b16d", "value": "E5A50FDC1D4FD80E5A984C426AF1EAA7533D97E39D982346F5F8FA8805B809F805C8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000918, "uuid": "0b55c96b-2b90-462c-b1c0-f2a9df059b9e", "value": "1536:Z3gDRKOy4pC39WOnA5IXRdveMm1s+LCdbbr0c8u8dATI7Ej:S1KOy4pC39fas+LCdbbr0BDNEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000918, "uuid": "88c16033-2e30-4403-906d-c22279ed15e6", "value": 2109534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000918, "uuid": "86086451-9532-4cba-8320-06d0d8b0ec9e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000918, "uuid": "36a1b693-7abe-4836-b119-41a285f1d2af", "value": "478478741.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7fc1ce-9094-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617025113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025113, "uuid": "91b5a2ef-1999-44a4-9470-c48da2745f3f", "comment": "Malware payload (Dridex)", "value": "0fbc1abd81727a054314587c75f716b0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025113, "uuid": "70a84d46-2f97-4dae-836e-5a4e5f3a90d5", "comment": "Malware payload (Dridex)", "value": "53a737c64da978daf0b47b5b3e6e986ae57add9eaa42e397c898efc88bf7831e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025113, "uuid": "b115256d-fce8-4183-b4eb-8b88386f1550", "comment": "Malware payload (Dridex)", "value": "229fe62a379bcfe6da39b2f10ec6f4cc5a50ead5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025113, "uuid": "a28c2bec-086a-4a95-9b69-55095c75146d", "comment": "Malware payload (Dridex)", "value": "3b8c3d3ef1e9d03b04f0b4bfd4cf64f008a9fa436b25cb636438d10b7e6d6fface2d7d3988203917cf7a1e479f270bda", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025113, "uuid": "597f18e5-870a-48ff-ba3b-ae6434ff49e9", "value": "0914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025113, "uuid": "d5929eb2-1090-4098-8405-43e479589b79", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025113, "uuid": "aa4f462b-797c-4419-9d6d-ca3e116df3e9", "value": "3072:+1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Wi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025113, "uuid": "c7e7f30b-b413-492c-a9b8-3d9f40a89cff", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025113, "uuid": "5cf2cb0e-5c70-410f-8887-89c0f4fa2b6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025113, "uuid": "7b4c23d8-82e8-489e-97db-78c2176bc028", "value": "53a737c64da978daf0b47b5b3e6e986ae57add9eaa42e397c898efc88bf7831e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ed6d2b-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617027973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027973, "uuid": "1dbb320c-b616-45ba-863a-74158cf9e32d", "comment": "Malware payload (AgentTesla)", "value": "7cf9641a69cf48dae7666c3494d60c9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027973, "uuid": "3c0777ef-a205-4460-b15b-6546df96cfb7", "comment": "Malware payload (AgentTesla)", "value": "5499eab9b2caa162006baa16cff7067fabeb0900f6bcf19653cf8a034e541e54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027973, "uuid": "3329b3db-80fd-44fb-b56b-79bd6a6721f4", "comment": "Malware payload (AgentTesla)", "value": "9a3cf82cff9c73ff52818a7349e5e81924156c6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027973, "uuid": "bf81db64-c74d-4902-bba1-c67e2e98d3cf", "comment": "Malware payload (AgentTesla)", "value": "a583ff2be735b98cfaee87f36ad6a57140558b0e0f812a3c489dc7910eb76d0da8abf4b84a0d3480c4347c05619c28dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027973, "uuid": "096bfc2a-be80-4567-8902-a6d9f30ad685", "value": "8205D07E25AA2A33D1B9C3B58CE50453F672682A3592D90E59D21BC01B6375338CFB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027973, "uuid": "c967dd68-d27b-4d02-8444-be1dc7231e3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027973, "uuid": "7b05734a-9b75-4278-94bb-573f7f9d465e", "value": "12288:PCK9AwivBs/WZLLKNyuiyNic74q0DVaK3D817WIAuZ4iK1AZcFEpD1:z9n/WRuiSirq0D4K3Dy7WIwiKehd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027973, "uuid": "846b6c05-cfc9-4c45-a0b4-6d3824db12a7", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027973, "uuid": "10922dbf-7a40-46d4-b2f9-b3449ba89b19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027973, "uuid": "95a8ee3a-5547-4d3a-adb5-c677a7736f92", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a463aa32-90a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030948, "uuid": "e0d7b5a8-52bd-41e1-9c99-1029cf94633a", "comment": "Malware payload (IcedID)", "value": "82d3ff9042ba122545529770072b8e3f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030948, "uuid": "30daea4d-37be-4d6c-bcd0-b0d9e591e816", "comment": "Malware payload (IcedID)", "value": "55961da94f9038f5529eca2a0896e3138a6b271b2367b198987c2a76c9b145bc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030948, "uuid": "d24d0125-d970-44ab-97db-cb1a70128a6d", "comment": "Malware payload (IcedID)", "value": "8d4e4559b672104cde3d00cd6c042216b3e3abfc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030948, "uuid": "641ed7ae-e82d-4f04-a268-0845c555c7d8", "comment": "Malware payload (IcedID)", "value": "f2d03cac10d3eed09a87144b0edb30100c4bc3a9ff7ff5e9acfbaac9b805fa012a199c2c2d73c9d8fe4e07c9f3c4f061", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030948, "uuid": "089019e1-faeb-4b64-a23d-cec7113dc85e", "value": "9E04122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030948, "uuid": "186e02d9-0654-442d-a0fb-b913122e9d38", "value": "3072:+3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:+nE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030948, "uuid": "57a5dbb3-3614-4063-a5b9-af338d19fec2", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030948, "uuid": "25614809-8b3d-4ae7-8070-4fa7eb68c98c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030948, "uuid": "538d2392-e5a6-407b-90b2-94920f497776", "value": "Claim3146141003292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322099da-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028180, "uuid": "998f8359-3f38-43ce-bb83-37eb2bfaa805", "comment": "Malware payload (Dridex)", "value": "052b090a7a2467bfc64f30677083e9bf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028180, "uuid": "fc6bbb2e-961b-41e2-917e-7e4a72e37891", "comment": "Malware payload (Dridex)", "value": "55a2b44f410bcd657e966e7bdab0dd36c4df6791c37e7266f97ec9db4eea277f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028180, "uuid": "29055cab-27c7-4414-a9c0-4992ebfcd4e2", "comment": "Malware payload (Dridex)", "value": "1233aaaf07c32421a2727e823a888166a8ea3f55", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028180, "uuid": "0221f99e-0505-4193-972e-a51212476726", "comment": "Malware payload (Dridex)", "value": "ba8c441e89239f56b271cb65e1cd916e1be6f81a985487dc8a9360dd3ebe908975fea214d8a961d5bf5fc1e7bfc81afb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028180, "uuid": "b3ed3811-4412-4589-8a34-d8edb7c9ec6d", "value": "8D14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028180, "uuid": "d17815c9-63f5-4d76-aac4-227e437a121f", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028180, "uuid": "3d3b6954-15dc-4b6e-a573-e81d6554d7a4", "value": "3072:opRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:oBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028180, "uuid": "643d7830-bf42-4a06-b174-ef4767b729c4", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028180, "uuid": "04305862-c2bb-4179-a036-ca08b2ac07eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028180, "uuid": "0bfb7625-9f54-4262-8185-484a767e42a3", "value": "55a2b44f410bcd657e966e7bdab0dd36c4df6791c37e7266f97ec9db4eea277f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4fb4b6-9073-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617011289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011289, "uuid": "9c0816a3-30cf-41ae-901e-88674237e2e4", "comment": "Malware payload (Loki)", "value": "a9cd4dd80f6f3ca2e9717fe5a11d1237", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011289, "uuid": "d4e7e1cc-de96-4d9e-a877-510c89c43dcc", "comment": "Malware payload (Loki)", "value": "55fcfb9488c770cb3be31a37ce4745806abd760fb9ad62464fb841030f3ce13e", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011289, "uuid": "aa23cc6a-449a-432a-9660-d01280b61c7a", "comment": "Malware payload (Loki)", "value": "82c84312f4fcd7ab250f307261f1de911057d46d", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011289, "uuid": "3b5713c4-867b-45ea-952a-f12e45ce32d7", "comment": "Malware payload (Loki)", "value": "409d024a17dbcc76a3468eba8bcfa7f2822608994ef8f055e9dafdf7fbc1fb73de50200c56ec6c04619acc77d0ee9a6f", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011289, "uuid": "71bd4fe1-93b7-4fc5-a6bb-b3a00e1b7dd3", "value": "7EE48E62B7804C37D06719749C1B4AE5EC35FF103D28A89B6BE86E0C5FB835179392A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011289, "uuid": "b2ceb6df-f848-40bd-b96d-1911afcf711d", "value": "12288:0sOKEbAY0nluh0T5ZcxSO8Al/RbV5pg+s9GUsWx7YVUNsx:xFE30nlu+T5+fHRJODsBVUNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011289, "uuid": "096c4fef-8adc-4a42-bf05-0a578aae3b4b", "value": 663064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011289, "uuid": "8f7039e7-507c-4dd5-b3c7-bf2a093be5c2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011289, "uuid": "3351abe4-a894-48dd-bfff-c8dc987a6177", "value": "Order list 28-03-21.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6b1dd7-907d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617015604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015604, "uuid": "59fb4385-6a4a-4057-86d0-1606755af3e9", "comment": "Malware payload (AgentTesla)", "value": "541e723b1c3c89bebf719228594b78db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015604, "uuid": "c5c2e36e-d652-49bd-84c9-55a81252a81d", "comment": "Malware payload (AgentTesla)", "value": "562dd9dc5a400fb51c9bdfe8b0ab97a873a4e2c3d029f4e2d565bef9884acf28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015604, "uuid": "2591aa3b-6ea6-4087-a76e-759e7e9fac72", "comment": "Malware payload (AgentTesla)", "value": "c840e46240015cbba70cfb34b4da43ec9c58e7fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015604, "uuid": "ff9075f2-41bd-4cf8-812a-740d2d3eb531", "comment": "Malware payload (AgentTesla)", "value": "ebab60a7ad6ef91f18d8bfbcf0d43833091a640648c275fae840b94d17cfacf77f72d448083c19562793dbd1a53246af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015604, "uuid": "477cc302-c912-4968-a56c-50f4dc437531", "value": "0CE423B790D53A608B2C9AB4B5A043764A50F8C2D24469FCED05B9D58FBF6CE58CF234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015604, "uuid": "6c44b96e-2e1c-4f5e-86cc-34cd919b631b", "value": "12288:jXB8HQZEjv7DN6KBvOk9RYIOaPkHVxpxVdY3UobuQPm1JFzc8fx:jXCHU2zv7RR4VxpxUbzPm1jzc8fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015604, "uuid": "1f73bd3f-43d0-45de-80d0-ef6e1acc0f5d", "value": 660291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015604, "uuid": "831ad994-92db-4841-ac59-5574f5ed80c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015604, "uuid": "4a7189a0-3da1-43d6-979d-d5f3cb59c122", "value": "scan attachments_03262021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca4cddb-90b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617040948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040948, "uuid": "7353422d-4119-4b30-83e1-61abf7a8fc31", "comment": "Malware payload", "value": "34db33828fd022b8c1de9da1cc60e133", "object_relation": "md5", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040948, "uuid": "e318d027-db1c-4710-b076-78bb37888f60", "comment": "Malware payload", "value": "567002ac9269007c402603a401d076a9d0dfa7e576ad0fc5eb4072be3acb5fd5", "object_relation": "sha256", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040948, "uuid": "13784e60-7ff0-41e6-9481-5bc1edfdeba9", "comment": "Malware payload", "value": "350f20296106a5bcc08b41c9b94400f862c27421", "object_relation": "sha1", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040948, "uuid": "5c2b19fa-69e4-4fc1-9abc-369c8fff9193", "comment": "Malware payload", "value": "e6286fa89b3b5ea2f6dc533929b2dfb4d074f5e64c658853f7fbc10d1b490f64ec1f2f1c1fb0fa0683055230686b305c", "object_relation": "sha3-384", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040948, "uuid": "815a4e6e-104b-422d-98bb-19837b4b338b", "value": "557412C3E6A584F9ECA84632E9278D9063077D28D8A5FE3E908D716379738604177F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040948, "uuid": "7142fc82-6c7d-485f-b627-ad6cb112b418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040948, "uuid": "93f2799b-10ab-4f0e-9b4a-f0a541b739a4", "value": "6144:wudexvfIJVfSbts39i7ijAPs7TvSqUXAZB+YY4mgHWX+KhJehR:w2OvQJVfSxSimj1TvSqbz+YYVQ2Hbeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040948, "uuid": "361ac33b-42f5-49b9-91ec-64cb9e92c320", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040948, "uuid": "26c96b91-b939-468f-8c6c-4fc0821385f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040948, "uuid": "7c23f935-60bc-47cd-8480-50d734c99969", "value": "INV#6534524.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeeb57b-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028067, "uuid": "7d840918-33db-47b3-8237-6da56f872bf2", "comment": "Malware payload (Dridex)", "value": "2edc81ecd46bd3737e78b35099de06f3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028067, "uuid": "a21b4864-3dcc-482d-8848-29b56fbcc5fb", "comment": "Malware payload (Dridex)", "value": "57582495d0b42af8050858fdda53f7074696510d9884fcbd893308777602ea98", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028067, "uuid": "f6f1f5a3-9078-42d8-9975-2887a461aba7", "comment": "Malware payload (Dridex)", "value": "c5983d660abb96cdd06398c7dc2557638bbdb48c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028067, "uuid": "7a3cf1e6-b869-4a1f-9bf4-2c2a4fa12f0b", "comment": "Malware payload (Dridex)", "value": "38a6f7f3cd1479b0cf89505c1f7a83a0f59ba64aaa876222227f8a42f715f05a32aca9705ffd78bfea28b97ee6e99df6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028067, "uuid": "e9e73e6b-b76b-4b0e-a33b-48b61d173749", "value": "1314AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028067, "uuid": "391e9985-63b5-465c-afec-b52fca960cca", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028067, "uuid": "456957a5-a27b-4d42-8444-db8d90c61edb", "value": "3072:jpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:jBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028067, "uuid": "490beee6-a2d1-4223-9f14-90deacb50f02", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028067, "uuid": "2e34b0ca-06ce-437b-aa26-e5cae2c0c58b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028067, "uuid": "f729c333-2cd0-4bf1-b8a7-2af5042820cd", "value": "57582495d0b42af8050858fdda53f7074696510d9884fcbd893308777602ea98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6946d658-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617032138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032138, "uuid": "ccc75a88-9f01-4fd8-9a01-934dc7573673", "comment": "Malware payload (AgentTesla)", "value": "f528063511b1a4fcc9dcd4736f7c40e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032138, "uuid": "80391d34-8a4a-4836-a819-a673809d1a81", "comment": "Malware payload (AgentTesla)", "value": "5788b847feb3f794a5e102ae72d95859fcd7391d62e8054942f500d54493050c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032138, "uuid": "08c05dd9-26e0-4615-a616-f5d310973fc4", "comment": "Malware payload (AgentTesla)", "value": "e3f7ab984029ec89b56e555220708ac57ecb9fc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032138, "uuid": "a1710400-cc16-40b7-9500-6238ffdea19f", "comment": "Malware payload (AgentTesla)", "value": "cc7db311263a5e6c6c3a11d8e9e1caf374950c5d2be05bd95afa60dec36d6c8010c6ee98286f2e05659f476a47c76cf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032138, "uuid": "8777d45d-c4ca-431e-8d81-f4ecb10626f6", "value": "04E4339B700A4C721537E9A8D7233A0CEECDD211CC7AAFD61AC696D2C859F1C80E9775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032138, "uuid": "507d217f-1d4a-412d-949f-53eb55b6c83f", "value": "12288:6PG0FirPsnv0hH86E//E7c+Q31dBmUZY4xq+ezKdTnTOauvu/5lXkqOBGpgZ4:6e0Fiqv0F8n///F3rB6l6XOauWRSlA6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032138, "uuid": "38fb448f-13ec-47e4-b6e7-fd2304cedf52", "value": 707657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032138, "uuid": "0f138e2e-1d66-4129-907b-1a935e8fb41a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032138, "uuid": "36233c5e-7807-43ee-9473-1938dfb4d7c0", "value": "2021249500-1274.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440b19c8-9062-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617003728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003728, "uuid": "d2d66337-2c47-41be-8747-dd154b73fd68", "comment": "Malware payload (NanoCore)", "value": "53ac3ebe846ae73422d5e5cfc9f54962", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003728, "uuid": "21df3044-b9b0-4035-95a0-6b72d2d07850", "comment": "Malware payload (NanoCore)", "value": "57a072ed904d71555f591f470fb023e75aeb8f7085066e53a9d20cda380934ee", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003728, "uuid": "82aa9020-2760-4b21-8817-7fd7950e5da6", "comment": "Malware payload (NanoCore)", "value": "8b11910fa30a712811950454d2a4058152beb627", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003728, "uuid": "64af30a6-dad4-45ac-ad4c-b2f898730374", "comment": "Malware payload (NanoCore)", "value": "273b7a21e8623ef2a0ed6e0cc647ce2264bcb6537fac9355c27a822871acd11148aebb74dd6dac584a665df05a9a469b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003728, "uuid": "70847ac7-3495-41aa-b084-42fba15fabe1", "value": "B9A423807A64EFC5797D97997F891588106D339187356C3E62A9EB33C33989C8C6232C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003728, "uuid": "537462ba-6ea8-4ce9-8a54-36455f454f32", "value": "12288:8JHQmutO/yvMMc3IrGIJRwgs1OZaPeX4hUQUc:8ume/El3IrGIJRwPbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617003728, "uuid": "83ffaa0b-8ef8-4265-a8a6-608741f634c8", "value": 457019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617003728, "uuid": "92299316-f992-4751-9019-2caad26aca6b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003728, "uuid": "b834fe2e-f284-4d17-824c-8a7cf6ee3ea0", "value": "New Order 567w43.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daff7ad-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617032118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032118, "uuid": "d1b642f8-c156-4572-8fb1-2b3d067e9310", "comment": "Malware payload (Dridex)", "value": "fea3ccc787aeafb782def32b03af6348", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032118, "uuid": "f1617944-dccf-4c89-a92b-f7685cc301e1", "comment": "Malware payload (Dridex)", "value": "5803122f447f51dd7bca13e8be793e544ee25f70e0e9a32cd246edcc6ef6f2cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032118, "uuid": "ce724006-23eb-4300-bbdb-9a695bd4d24d", "comment": "Malware payload (Dridex)", "value": "21b4ea3bfabe897e6e365edf1ca66f9340999578", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032118, "uuid": "de3aaab3-00d7-4f57-a0b0-83053f7e312d", "comment": "Malware payload (Dridex)", "value": "b8c943a9e1b6402c3146e70524b8114e816e86537e772301007d28fb2924c836be23528af7a5e172b30798d25de016b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032118, "uuid": "bef42498-7bf6-415e-95e3-93784fa066f6", "value": "C0349E67E68390F1CD8714726C2F2BBBF730142155309AE6E7F19DB99837AE19328B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032118, "uuid": "b38fa618-22b1-4d0c-882b-b54069f873ad", "value": "1e514447f004e9505dc193777ba8a65d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032118, "uuid": "d7c23fa6-1830-433c-858e-82bd6691795b", "value": "3072:o2L5vqnTYXiUBjR3fFPPFuNo8V1laeXF7ANJhCSUQHlRiV83M7TzO6cRgh3sdp8i:L8U5D8H7A9o7Onmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032118, "uuid": "2b436482-f35a-42d0-868c-1f699d6b7355", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032118, "uuid": "1b7c06cf-39ee-444c-b727-d1f80b4d7362", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032118, "uuid": "d6450132-999e-400f-b278-e3f26f06c844", "value": "dumped_pe_mem_fixed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431d70b6-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617025631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025631, "uuid": "0a0311b7-44f0-4b3b-90ec-12cbfd8fad4f", "comment": "Malware payload (GuLoader)", "value": "584c030ac9abd52c2347214088b1fa14", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025631, "uuid": "6fa38eda-29e0-45dc-8f6c-ca0f8e240495", "comment": "Malware payload (GuLoader)", "value": "59662ea91566a6d7578243f8f9ad28d84c2908ba17be418f0a45cdd218272b0b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025631, "uuid": "67130831-fade-4745-ae57-8dd9fd59c4ad", "comment": "Malware payload (GuLoader)", "value": "6deb5d5b469ba5f63e937bb093281911eab7c054", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025631, "uuid": "f9925782-0511-4f43-9111-f183ea480f50", "comment": "Malware payload (GuLoader)", "value": "7acac3682d717006de2558dbd889f98209cede41d97003d50ebd93a30703001030ddfba1ec1d951342826b838fbd1f61", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025631, "uuid": "580cf7f7-13c3-4795-95a9-b0b339ef6136", "value": "BA83298CE8E4F23AF371037B0E95569C814FB932B28AB717A078632955366C15365B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025631, "uuid": "f4dbe840-45e8-4d65-bb6a-6c7841e730fa", "value": "3ecd501451a806efb69c3dc3e8601427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025631, "uuid": "c79502ef-38e2-4ff5-9e70-b95ba6d7b557", "value": "768:QaMTZied1gEdEZzH9n8O9MA8f7eyGOjYkrch+rIUk/RjvMgE7D0Bq0XqhyLctUri:JeZZgMYQ9HGOPUekjMAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025631, "uuid": "830f29e2-8058-451c-8676-25c535911a60", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025631, "uuid": "aacbae77-554f-4a69-84b2-8d45dcecbd7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025631, "uuid": "7bc35393-2f99-4c0c-86e6-bab89d2eac74", "value": "PHOTOCHLORINATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfd58dd-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616997974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997974, "uuid": "99edbd2b-72c0-451a-b5ba-ee530d6e9225", "comment": "Malware payload", "value": "f0d5d1447f91a88f0b4331e82a661ea5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997974, "uuid": "131eacba-4fd4-47d2-abd9-61b83d5a2c1b", "comment": "Malware payload", "value": "599393e258d8ba7b8f8633e20c651868258827d3a43a4d0712125bc487eabf92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997974, "uuid": "f5c17069-5fb0-4d85-96b2-192b22b059a5", "comment": "Malware payload", "value": "11428c3bdf728860fd057c411a95b14e13f05dbc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997974, "uuid": "5cd1fbee-6e6c-4f10-b690-d20bc078f292", "comment": "Malware payload", "value": "552f27b617beb5021e0048a2e2d4de275ad4d9b4616c77ae8f16f988749eacb6e44837512259fd201fbf899f7ffa2452", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997974, "uuid": "6f0450e8-6e29-4c8e-a9e6-d83e5f8bad24", "value": "DC86AE056A66F0E5D5FEB07A899B8E07D272B9D0473087FB4AE4311A0E336D1DD3A2D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997974, "uuid": "45fe9dcb-d41d-42ba-baf0-e85d9ea1b794", "value": "6cb963f862ace78070e002f91c4f5c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997974, "uuid": "98a8c422-5a8d-4f7f-94bb-0adf1bdec989", "value": "98304:xi4jwJ2zVPiuNMuE1y2qldX6i/hIUA+nCvw3c7Mk9OoxK:I4NpPiMMt1y2AdX6i/hIal3ajko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997974, "uuid": "af80c188-9f39-43b2-9f87-a5bb4f984c05", "value": 8202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997974, "uuid": "995614a1-c011-446d-b809-73d58cbf7098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997974, "uuid": "842c4901-8fbf-4d4e-9d2b-f74eb9ef5748", "value": "PhoenixMiner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266aa6c0-9057-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616998954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998954, "uuid": "c9fe04ed-8eaf-44e8-a355-51291b35ed00", "comment": "Malware payload", "value": "c4902e38519ae92212bfca79f03ef120", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998954, "uuid": "7cb7b5cc-2c9e-4934-875e-ab394fafbbd1", "comment": "Malware payload", "value": "59a82bf653a532b2c9633b8d336db93a61eb364ebe4360e516f6935c1a388c2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998954, "uuid": "2ecb1f79-bf1a-4140-b904-0655ff1f5708", "comment": "Malware payload", "value": "c9da68efbf7d1792c2cdcd8b33e8e2bfc7467d57", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998954, "uuid": "12b05833-ecc3-483f-85c6-355179ed6067", "comment": "Malware payload", "value": "d196bd67eaf54de3be07e69bfe16fdb3aaa44ea2bf43990f511594198ed8f5d9f63b8cce3c62eae098df26e906db0a45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998954, "uuid": "1846acd3-8cf5-405e-a2c0-37834ddf55fe", "value": "41F4BF823185D8DAD40329F248AFD52061797D9E8174C60E374BBF2BA6E7353346B78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998954, "uuid": "d1126f13-4911-4373-a73c-0f139872a3bb", "value": "12288:jSityjK7wHnZzXutiFNX5DDqis/t+W5559H16:jdHynZz++tgIS59I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998954, "uuid": "0dd9bf11-4161-4232-af96-51eb01127c43", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998954, "uuid": "7e30fe0f-62cd-43fb-b8d9-2d5c194c1d7f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998954, "uuid": "c86b18c6-c0fa-4b6f-8d16-933fe2276a09", "value": "New Order quotation PO#789122,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b006e4-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028244, "uuid": "d17222ed-9cd0-419d-958f-bb9ace5b2a13", "comment": "Malware payload (Dridex)", "value": "7b8bfda79db4a4d50d864d6783a145d7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028244, "uuid": "4c6c5277-db5b-4def-81a7-e1e5734ff2d2", "comment": "Malware payload (Dridex)", "value": "5a0e4e34a96dfa55aafbf78a11ecf562fecaf3c43f5f6db410928bdb361299d1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028244, "uuid": "abce5a33-a4f6-4ce8-96e7-d087bb71a634", "comment": "Malware payload (Dridex)", "value": "5387732dbf2ff847e7435d5aeeb66158b7b1b697", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028244, "uuid": "33823914-66ab-4ce3-8ef1-0a0509202342", "comment": "Malware payload (Dridex)", "value": "b339b69104768b672e8bd33b62e4762643ba9a639f595e4ed6520b70d877b0810c1bb01c7dd5f4f532df9c9627ba0c23", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028244, "uuid": "0a304f18-fe07-4cdf-910a-08534632181f", "value": "4114AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028244, "uuid": "f4dd989a-c80a-4c9e-8b41-82928b41ca50", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028244, "uuid": "ff8a4b16-b4d5-411f-8f69-a62a9724c095", "value": "3072:VpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:VBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028244, "uuid": "5046dda7-c999-48e2-97dd-4c5d78287795", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028244, "uuid": "8af73a74-b583-4839-8d26-2137775be951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028244, "uuid": "0cc2a745-4683-4a97-8bff-b3d272e9a3ac", "value": "5a0e4e34a96dfa55aafbf78a11ecf562fecaf3c43f5f6db410928bdb361299d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b7b254-905a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617000543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000543, "uuid": "dc133b6e-67d8-47cf-a144-3688955eaf8d", "comment": "Malware payload (Formbook)", "value": "793365b9900fb18919fde92a9fe96ca5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000543, "uuid": "70e79bbd-f3de-4b7d-b90a-c5160323c4f9", "comment": "Malware payload (Formbook)", "value": "5ab838838f2def5608f2cb0672c33858cb549fd3cf10768b44976daa8d9f0269", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000543, "uuid": "3c5afe54-25e2-493d-9803-a1e6d113df5e", "comment": "Malware payload (Formbook)", "value": "f6911299339b4f1a3e3918e8de285ea09a257292", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000543, "uuid": "369a9927-dbb0-421d-83a5-97336d3fc523", "comment": "Malware payload (Formbook)", "value": "d0e6f071bf8e0f208ef74c4931eb1205a185506cff863c27ad2a4ee9d7020cd43002a51a6aee5e712e4dace127d6708f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000543, "uuid": "709b465b-396d-483f-940a-36e8729b4a82", "value": "ED8423FFAD0FDC51C14529114B386AB68710A957C39F0AA067F46189B2D92B6FCF2273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000543, "uuid": "6befa151-140f-48f5-9cdd-e1c544dccf35", "value": "12288:gioQz6ha/PvZ5lVJMCqOCQr+1wZFcSsCdcXQk:gio/ha/DJZCQC1w0FXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000543, "uuid": "59def8ad-0a11-4ff0-acfc-cfb71f87d766", "value": 404772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000543, "uuid": "aa435096-baa8-409e-b9b4-9f71bf07110b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000543, "uuid": "27a95c29-23d5-479a-aecf-400ae3f1f90c", "value": "032921.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f9efe5-909c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617028803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028803, "uuid": "6935ab50-f87e-43fe-b984-65e759e1c965", "comment": "Malware payload (AgentTesla)", "value": "29baf373618fe6d8d00dbbcf5d2a91f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028803, "uuid": "ee38f602-6463-4227-9688-c9746410acc1", "comment": "Malware payload (AgentTesla)", "value": "5adc78688490ba3f2529247caf3b51fd13d2749b9f351b749e196c1f7d93f978", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028803, "uuid": "2be021fb-3f84-419d-9624-7ddf7f672d1e", "comment": "Malware payload (AgentTesla)", "value": "abe2d7f7833242e775288a39a4d108ae7a7674ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028803, "uuid": "7e7d03fe-431c-4e7c-b82b-018c0bf3edaa", "comment": "Malware payload (AgentTesla)", "value": "220c52e35ca87c14ddb53280b2f0b98f02a502b63b32a289a626f8cda78a3290b503952deff64ce62a9c145d99cc5403", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028803, "uuid": "56773c60-3aac-426f-b280-7bbaa357cbbe", "value": "54B302B6BAC0589A3070865B2691E1A09FDAF9D7ED1C714087CB5376C14B9983ECFE07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028803, "uuid": "c67890c4-971e-48ae-afbd-a98895a6165b", "value": "3072:X9inBMf1yY2M57GzG9kQRb0CkGvnevTxKXxtawE2ESyIo:tiufD2MkaRRcWHKd2E7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028803, "uuid": "2f298745-fcc1-4664-82e1-242571e10855", "value": 115411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028803, "uuid": "708d518c-f1d2-496f-b859-f2ce33442f79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028803, "uuid": "840a1643-db47-445b-8b2d-64a9cccd8bf4", "value": "RFO 003887 MTH 888700.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51154076-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002462, "uuid": "755839c2-7e3c-433a-9a72-330847412c2f", "comment": "Malware payload (AgentTesla)", "value": "2434a9d7d50e2d313dc9dd2dc3ec0542", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002462, "uuid": "361a801d-0546-4532-878c-459ceaa36a80", "comment": "Malware payload (AgentTesla)", "value": "5ae08f3d04dbe644d6af878eca715adb2a351b8cefdc0340698b104097b486ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002462, "uuid": "d35f07ee-4635-496e-867d-1b0dce383151", "comment": "Malware payload (AgentTesla)", "value": "dfd7a98a007801a645407dd6eff8965cb8b3ed8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002462, "uuid": "c0ef2f5a-575a-4a09-895d-2d6b10d96355", "comment": "Malware payload (AgentTesla)", "value": "9171ee5ae2616fada9d4873bc7b1cf6e47edfe34850ee9c330c1fabe075f67de740101d3ffda1d5dd67242157e637dae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002462, "uuid": "19a5d030-10e8-4300-a6fd-a9beaaca35a5", "value": "0E354A4C1E98D2C6E23D4BB892D9E49943F96EF38F12CCB9BDD447CBC121B41E606526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002462, "uuid": "55d66cc2-d7fd-4344-a346-0492f9e80db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002462, "uuid": "82b326a9-cc95-4f79-a4b8-00f9200ea11b", "value": "24576:nSO3mV5fR3v1SKhkRATi+cbxU0e9sIV5pJAt6cX:S4of3v1thUKcb7e9fVJA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002462, "uuid": "fef8c018-1345-4f75-a43d-eceea0e5a6e1", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002462, "uuid": "2ab4a9d6-9d39-407d-ba3b-c8cf35d6a7d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002462, "uuid": "b2073a2d-e0b7-4b1a-a055-2f71f3edcd48", "value": "2434a9d7d50e2d313dc9dd2dc3ec0542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d499829c-90c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617046491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046491, "uuid": "17349b79-8a10-4889-8bf7-127c8b959cd2", "comment": "Malware payload", "value": "ef80e35e5a0f4c12933955423dad720c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046491, "uuid": "b1cba392-c3be-44c9-aaa4-1d08035598a6", "comment": "Malware payload", "value": "5b3e57fdf14cfa4d7688faecfa29c77974b8c92c97fffd786e82b0d582325315", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046491, "uuid": "fc45a3b3-86a7-4c57-b857-42dedc81dc30", "comment": "Malware payload", "value": "93a9fcf0d7675a73456584a34e6449542ffe9b48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046491, "uuid": "a386df5c-ffa5-49e1-ba0f-c4bb8903ddfa", "comment": "Malware payload", "value": "c7cef08664e23d31a8f81b6aab786d4c3f216ad5b83d35a27d58d1cd684d82fa8e7c6c020cf84a5ebd6e8057ca26ef02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046491, "uuid": "1d2a0ad0-9a06-4ac9-a909-11747d95b07c", "value": "62F437D24B3196D3CD279A3014290B3B7F226E26D57B922B88317C7D36EA1F106764E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046491, "uuid": "7cb0b0b8-90b4-46d5-bc19-3434f93eba12", "value": "924a6639786c2fe663b19a5bd1192f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046491, "uuid": "d83bade7-9f21-4db2-8843-0532b3943daa", "value": "12288:Fbd2oj1dgx82oWP/8YALurvih4YjfLS2NDEfa5wurfi6Hafu5VSWMSav:b7gx82oW8YAL2VEj5eXu5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617046491, "uuid": "25dbbfb9-95b8-4bab-b57a-852291723c58", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617046491, "uuid": "67baec08-c7f9-47a3-8bd3-83d3f2fad935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046491, "uuid": "1e3ea532-1584-4c49-aa42-fe5589d4ff72", "value": "SecuriteInfo.com.Trojan.DownLoader38.7231.63.17301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6230d69-90a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030951, "uuid": "1995f88f-73ee-4db3-ba08-58df23a7a6af", "comment": "Malware payload (IcedID)", "value": "0e914d4fb0787a120d7daa413061ec95", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030951, "uuid": "e0d3849b-fe27-4852-8bc1-fac949843f60", "comment": "Malware payload (IcedID)", "value": "5be822751e06a70afb64986162435ae78ca79a42365937ec409b1a6c69bb4d44", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030951, "uuid": "0e79ea23-f34f-4df8-9409-a33c71312505", "comment": "Malware payload (IcedID)", "value": "ac4497cc38f152f86bae772c67402bd017305c8b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030951, "uuid": "d801d87f-b4fa-4c5a-9fca-4bb66543ad0d", "comment": "Malware payload (IcedID)", "value": "d15eaffa0a6a498b72cd42aa8bf2815e9dd21f178e8cb62cc585de76e05f3ceb2e143b79ee3adca3ae3ac4501af718ad", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030951, "uuid": "aa86352e-11ab-4bc1-bf48-23c6fd277a6b", "value": "6804122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030951, "uuid": "6017211d-e462-4455-984a-e7737dde28c6", "value": "3072:O3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:OnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030951, "uuid": "be7df672-34f0-42f8-9667-fc750ba18051", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030951, "uuid": "0d6d397a-fec6-48ed-afb8-b1d7f7065764", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030951, "uuid": "4decfdf8-2ab8-4baa-8ab5-28f344635434", "value": "Claim134353683203292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0d6851-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616999819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999819, "uuid": "b9814077-e0fe-4624-bd6a-a8bf11b25a8c", "comment": "Malware payload (Formbook)", "value": "f2016f64aad12b36aebb2da876846e06", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999819, "uuid": "c9458984-2e88-419f-bcdb-96b6b27342af", "comment": "Malware payload (Formbook)", "value": "5c40b18e11a717a257251b5d1ffd555e19993688752ce8c52687b81f4ecdcb68", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999819, "uuid": "82505e40-640e-405e-91e6-bb9f50fda3fa", "comment": "Malware payload (Formbook)", "value": "efb316b846dea11761ac62308cbd43ffd48d30a8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999819, "uuid": "7297d710-da77-4cc0-8478-f71156f2dc1d", "comment": "Malware payload (Formbook)", "value": "70cb5bf6b32f28d524a10280378f935d7c7c389159edddf80acd62b05c25cc402185ced988aa31b110aa02d6f908823f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999819, "uuid": "95c226a8-fce1-4865-94b1-1cf9cbcef5a4", "value": "1405C38C1D99C1EAE5350BB842C9C4F746EB4EF30F22C879B9DA97C7E120786E506536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999819, "uuid": "4dbd51fa-4e98-4eb4-b4cf-4457744f9552", "value": "12288:8G3mJknBurVWtmaXMGgvpUtckVlO2xGvVyRFduOB7:akBuAJXMmVlRxKVyH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999819, "uuid": "4aa873aa-b629-4445-9fd3-dbcc0250ce53", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999819, "uuid": "a89bacfe-b20e-40ec-ba3c-a46a03368ba8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999819, "uuid": "f24efe36-4f79-4ebd-bfcf-8d731440492a", "value": "TT Remittance Copy.PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f915a4-90dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1617056046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617056046, "uuid": "ef494c79-ec06-4e25-b7e9-d07288c8fbde", "comment": "Malware payload (ZLoader)", "value": "0801368e0e80ba88daad52d7e5977d22", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617056046, "uuid": "84ed4a3c-3c8c-452e-8bdc-314336acdd0e", "comment": "Malware payload (ZLoader)", "value": "5c6c0c5a94f60a71467c535e094d8a9e62e677115cf35b50683fe6bf5d716c29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617056046, "uuid": "b7122fed-d5b9-41e1-9e6d-70926ba8789e", "comment": "Malware payload (ZLoader)", "value": "e8e2c197939ca869e7c6d120b27f1dcd35e20342", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617056046, "uuid": "3f224780-335f-4a9e-a30b-7cf3d52ebab8", "comment": "Malware payload (ZLoader)", "value": "d6f464dbee9055126ae7e5407dc95b3c625c7c07a015e8d34cc9ab207e782969b9f0ae531638512c15b174fd7008b06c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617056046, "uuid": "43f171bb-6895-4975-9104-5b7c185ef146", "value": "B143D796B385E816C94907364CE6CBEA7332BC555F53838B3289F72E1F766C08A12646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617056046, "uuid": "0869b96f-1d9f-49a8-b4e6-99978dba7628", "value": "1536:DSk3hbdlylKsgqopeJBWhZFGkE+cL2NdA9JuhkwqKZScmsiL:DSk3hbdlylKsgqopeJBWhZFGkE+cL2NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617056046, "uuid": "30acd975-64b3-4901-bb95-ac6fc90a5a85", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617056046, "uuid": "5f8a7b75-83ae-4b39-bcb9-542d5921c8d9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617056046, "uuid": "cebb8759-2a4c-4942-8661-ebaffd4b3f20", "value": "5c6c0c5a94f60a71467c535e094d8a9e62e677115cf35b50683fe6bf5d716c29.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f04c7b-90b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617039222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039222, "uuid": "e1dfee4a-80c3-4748-881d-f34b4febeb37", "comment": "Malware payload (Dridex)", "value": "078412b0b09512701f35480e5a979fb6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039222, "uuid": "659bb09a-94ea-4fcc-9fa3-3721f77d3ad7", "comment": "Malware payload (Dridex)", "value": "5ca1a25c3fe0b9e1463d76404636236242ba572538c280e55d0df859545f5339", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039222, "uuid": "327e5b40-fb2a-4dde-ae65-e25ba26f6d4e", "comment": "Malware payload (Dridex)", "value": "96b1abf7d8e0f0940f8ad23df4af330f21371e75", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039222, "uuid": "e24899bd-f7da-4e55-91d9-2ae92bfdd958", "comment": "Malware payload (Dridex)", "value": "66e11578ccfff6b4ef75492a6173fd9144b5649abf7dc46611c3999d1f76ea61994730f13ef13d63732005f83f87f46e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039222, "uuid": "66ad7366-e54e-45fb-b71e-ef1a9fcdc4f0", "value": "B114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039222, "uuid": "1e8c505a-326d-4467-a70a-aae305dd7e72", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039222, "uuid": "a05e1da9-3b7c-46e2-ba21-2aecd89b76fa", "value": "3072:71i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:5i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617039222, "uuid": "47b0c871-4ac2-4e23-83fc-3b317e8de0c4", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617039222, "uuid": "2ab8e4d1-3711-405f-8b26-f439590557c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039222, "uuid": "24ae868a-906e-4224-b7ef-3a67befde131", "value": "5ca1a25c3fe0b9e1463d76404636236242ba572538c280e55d0df859545f5339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e0f13b-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028187, "uuid": "b1ad035a-ebd5-4ff0-914d-1a1fe1a6f0cb", "comment": "Malware payload (Dridex)", "value": "8482a12ff00eb4da9b7404f006e36148", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028187, "uuid": "8475e0e0-8d4c-4f5b-8e00-eb490058a238", "comment": "Malware payload (Dridex)", "value": "5cf0cdc4db67e731ca86d3036a29728e66037b566f0a9a9e3645b766ba5c5ec6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028187, "uuid": "77d899e8-2967-40e4-b5b7-7e7ea248d24b", "comment": "Malware payload (Dridex)", "value": "795edbe47d8abf94f6b640d5d4ac2e8fc466a364", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028187, "uuid": "9f70362a-b3a0-4b61-9c36-81ebe64f99b7", "comment": "Malware payload (Dridex)", "value": "c3120886808d458719d3aa3cbe84d697239964695a62ca38046d7f00dc3c2ecb132947145acab8ab43fa69ad57d4c3cc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028187, "uuid": "42d74420-7d0d-4a69-adc3-dec9db5e586c", "value": "9A14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028187, "uuid": "a97d95f9-6e10-4030-b2fa-d1ff340fcff9", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028187, "uuid": "e1b24031-90b9-46c9-9c0d-82237205b66a", "value": "3072:qpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:qBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028187, "uuid": "1fbe1515-ed28-489d-acdd-480479eb5072", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028187, "uuid": "9094512f-deb5-4b78-9b57-741d29b374c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028187, "uuid": "59893de5-626a-40c1-bee3-1ba6f4f0a38a", "value": "5cf0cdc4db67e731ca86d3036a29728e66037b566f0a9a9e3645b766ba5c5ec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17fab63-90bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617042969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042969, "uuid": "5950033b-c00b-4c40-a5b6-9f30ea6aeb46", "comment": "Malware payload (SilentBuilder)", "value": "4b0bb4da6318005a27f0b807ac3445b2", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042969, "uuid": "662ee191-03f6-4935-bdea-306b3310267e", "comment": "Malware payload (SilentBuilder)", "value": "5d11e3ed79c75a5abc1e0ee59e10d9bfdd7b469c07543abc8e1512f03804bad0", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042969, "uuid": "1241d62f-77c8-41a0-8e64-e0953ea6f2d3", "comment": "Malware payload (SilentBuilder)", "value": "b058adc22f84672105cc49200386cf98800d3540", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042969, "uuid": "19a7d1cb-248f-4ad2-aa3e-439e99354cf3", "comment": "Malware payload (SilentBuilder)", "value": "2da684e5c5cafda30c94407f760365d68f84f7fc714c11b8a92e9e01bec8c10cf2a8f6426b37c5190e97134de3dce7af", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042969, "uuid": "64741a70-3eb1-4a09-ac0a-43b15971f970", "value": "26A412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042969, "uuid": "f97532bc-61d8-42b6-a3bc-f34f9580524e", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ79:dEKXJ0MDs8QTjVJVf4k4Zi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042969, "uuid": "7e4ed884-d1de-4199-86e1-f991bacc6162", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042969, "uuid": "60732788-5cf7-408d-b935-db363c77f29c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042969, "uuid": "dd22c20a-d24c-4b4a-8b2c-776df939b6b5", "value": "inv_1764822141_688529529.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c09f9f-9097-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617026580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026580, "uuid": "109f829e-f919-4bcd-9741-c25e7b30261b", "comment": "Malware payload (Loki)", "value": "f10671b7042afd73e0046ed4a7d7a9c3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026580, "uuid": "2f5247f7-fae1-469f-afa7-bfcfa59bfdfe", "comment": "Malware payload (Loki)", "value": "5d1487033d1f1c1aa34a504584016276e5cf9191e7a10d4e5aefe4cf87a5f546", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026580, "uuid": "5a08c987-1f6b-42cc-9307-b04ce53b955f", "comment": "Malware payload (Loki)", "value": "1dc41681022e3aa3320abf5ea0e214e2c83a0692", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026580, "uuid": "b5fff267-0bbd-4942-9314-318120df5265", "comment": "Malware payload (Loki)", "value": "d59605d5d6b6471bdbd2854d7405cbea40bef03279e641440f807d03a0b667644f725274fb91da1169a7573df835e117", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026580, "uuid": "875fc9e3-0c85-4069-90bf-598229118c75", "value": "27E41A9C3DE9D1EAC5354A7406C9BCB543F50EF2CF219869B88CEBC7C020F91AB16526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026580, "uuid": "8a356dcb-00d9-4701-bc2a-51d27c95daa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026580, "uuid": "ccf97701-c194-4c1e-b3d0-47ac3b9e60e8", "value": "6144:88jDkAmoOqMnSLQ3N4yPxyyAk2ivXnyiAVgsSMztTgHOTKA92MohogLEax:88jDkmOqMWxMrnybFJgHpI6TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617026580, "uuid": "5352ebcc-dba7-4c0a-ae5d-73ec7b751ab5", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617026580, "uuid": "8611292b-ec6e-4443-a03a-5333a12624b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026580, "uuid": "c5f0e314-4ff1-4583-882b-bda088d27e84", "value": "Po___20202904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4211841f-90bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617042380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042380, "uuid": "c2e33514-a032-4fa5-b37a-2268581abf6c", "comment": "Malware payload (NanoCore)", "value": "af0c6e51890886358f8031e9c7503ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042380, "uuid": "3cbc0438-00d2-4949-834e-5d5774b79d6b", "comment": "Malware payload (NanoCore)", "value": "5d77551f63e8034ace5718a9ee161959614aa1e7cf822310f9cd3980b0c9823f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042380, "uuid": "ad731eda-2794-4bfd-953e-8a871d827922", "comment": "Malware payload (NanoCore)", "value": "14808eb7d6f294adb4329691ecff7a3d09d91418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042380, "uuid": "b716cfdc-5639-41a0-a4cf-61cc6320fe85", "comment": "Malware payload (NanoCore)", "value": "fa8885217cbe2d61f2cb6e3a4a2048a63b544d7ed2fa005f23e6972bacc183a03c9d9d368cb17f37838984fbe1c20d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042380, "uuid": "04d9247d-4f01-4b0f-a5ae-329ca64d6553", "value": "F645DF933588CB98CE7947F62216404023F6E9FA8517D7086FC462E72EE6F9D0D91B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042380, "uuid": "75777cbf-42a6-4c3b-9108-044698365bb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042380, "uuid": "5a5e6dac-14ad-4afe-87fa-671d90fe27ad", "value": "24576:U52WwkSG/baFed+3FyKuQoLN6nnjqKoe:U7wkR/biewjXoLwjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042380, "uuid": "cf385651-bbe7-4cfa-bdbd-4d55fa830fd7", "value": 1178112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042380, "uuid": "a74c1e06-9843-4c23-b532-fc9292101dd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042380, "uuid": "d2fabf71-da68-42d4-8f68-27248ae607f6", "value": "receiptpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4877149-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040424, "uuid": "cc429b1a-87b0-4fb0-ba08-71e35982cf33", "comment": "Malware payload (Dridex)", "value": "dc7d785a47ffc7a44a8b1e58c5726971", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040424, "uuid": "f24446bd-f108-4c1a-9bb4-f8c9bbe75481", "comment": "Malware payload (Dridex)", "value": "5d8e96b102f96c275fc9ace5d72c4a65bfae0d81f9b0c6a8d5b654bd109cbbd5", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040424, "uuid": "15fc4e4f-0c66-41aa-aa65-7b663cf4606f", "comment": "Malware payload (Dridex)", "value": "50e838ca5fb596a3ef2bd5ba2361d0336cdd5965", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040424, "uuid": "dd32f86d-c4b7-42cb-922c-eeb5f232c294", "comment": "Malware payload (Dridex)", "value": "4dc2c9efb38257fce3106b02e99ad5b0e38205e414c06848d5f764541f304ba96ec37396f39f4d6653a8aade106b263c", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040424, "uuid": "155f5d50-261d-432a-b82d-4e34d35e9e42", "value": "5BC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040424, "uuid": "417df6b7-8f7d-4b30-83ff-d518eb8afa45", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040424, "uuid": "078c91bc-2dc3-4146-914b-e302d762b671", "value": "12288:Tt+D1yz/1SXpqDaoWm4sFBHk3eBWIcad:TcA1aLoB/AeBjcad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040424, "uuid": "c97ba7b1-77d1-45a1-b8e6-9d738946c901", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040424, "uuid": "fb89d36e-6585-4ed4-a54e-4f46ae4ce128", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040424, "uuid": "4b711f10-b919-467d-b7f9-e2b2c1c47ef1", "value": "5d8e96b102f96c275fc9ace5d72c4a65bfae0d81f9b0c6a8d5b654bd109cbbd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea2ccb7-9063-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617004363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004363, "uuid": "ab06a10d-d15e-4d71-82e1-2d0a0c3de9e7", "comment": "Malware payload (AgentTesla)", "value": "f5d5ad7b4e6b666209534f6d082eab70", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004363, "uuid": "79e312ea-e4f2-46be-ba5d-9a8d18da5742", "comment": "Malware payload (AgentTesla)", "value": "5d9a4ea6dfc1910c1cdcd6d98c0a4c10a97c34f69f0f0ed7071376dd23ae4b41", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004363, "uuid": "7c403438-d64f-41a4-b176-baf1484e3d58", "comment": "Malware payload (AgentTesla)", "value": "7e489267636ffc7aa462dfa63f2df72a8bc5cd5e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004363, "uuid": "ab70a99f-24a4-495b-8931-938f8ccb79a2", "comment": "Malware payload (AgentTesla)", "value": "786b4749d305119bd8d6484469de1dbb0f563b31bbf5cd868560c7d83606ef57bdfd4cfea64637e5975697b65ae5415b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004363, "uuid": "77929803-7992-4f11-909e-1db802a9365e", "value": "44A31240ED8D3A009D221A5EDD7643DD974AAEB3AF590C5F0D281023E945C2FBE368E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004363, "uuid": "47e7b611-94ae-4bdc-9599-9b622ac2dfa5", "value": "1536:okUYZ0zb+6AFzFsMDh63RsUGcCdmZhAgVoa5pvLQrlkyCd2d0K4aaoeJJpR:okWnBIFs5RvmgVoaTe6yCdAHXcJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004363, "uuid": "5730657f-4b8d-4ec7-b80b-ca545b6c62ee", "value": 104435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004363, "uuid": "a0fb03ff-fb75-4add-a824-3aac6da02c4b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004363, "uuid": "87178cac-17cc-4a80-8c08-46ce297751d5", "value": "R ALHTQ19-TYPBLDGP0401-940 GR2P5 -NASE FERDAN Q0539 NE-Q22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1fe656-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005814, "uuid": "8b03818e-7472-4dbb-9bad-7bb1b9cdf330", "comment": "Malware payload", "value": "82457b4a7929912acc2e5946333f35ca", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005814, "uuid": "d52b04c3-64e8-4af6-af47-ee2b079573f6", "comment": "Malware payload", "value": "5dc4c9f9b91f1d349aa12569b1c9e792710adbc5d8e200b89f92c920008901fc", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005814, "uuid": "3dd7e339-6f17-4935-9279-a806e6c2caf8", "comment": "Malware payload", "value": "e21316c302ac8dda27f082b1b22ad637ae582950", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005814, "uuid": "cd2108a4-e221-4544-9aef-8ed40893211b", "comment": "Malware payload", "value": "0c0e4b25d9093414f74d0c84827604efcec1d68d6b0e0fb709e59b387186b7c87fc1dd2aa9930db8f8060a6db7021ced", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005814, "uuid": "3788ba8c-8694-45e8-89c9-8cf69139af93", "value": "36A60101E9858573D8B3013416BB9BAB597AA9202725C5D3A7D43C387E707C16A3B3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005814, "uuid": "2047c9c3-6118-4aa8-a82f-46800e7c1b43", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005814, "uuid": "7650d9a9-575e-42b8-aad4-aac01fad77f3", "value": "196608:19berPbnqXsOgnWYQFYP7iGCdqYwrUosO:InqWW0DlSqnQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005814, "uuid": "324915cd-3ea0-498a-999d-d9f48deff648", "value": 9981344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005814, "uuid": "3e697a9b-5460-4cef-a7cb-b912775ef229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005814, "uuid": "73c38f25-93a9-4ebb-bba9-f826e1a101b5", "value": "5dc4c9f9b91f1d349aa12569b1c9e792710adbc5d8e200b89f92c920008901fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adee68d7-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040413, "uuid": "27de9fcf-bb61-4740-9dc4-e82905a82118", "comment": "Malware payload (Dridex)", "value": "aba9551c90f849cd88401c0c34f3f560", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040413, "uuid": "5e50860e-4222-45d7-be94-ff3eec74d7ee", "comment": "Malware payload (Dridex)", "value": "5efeb16ce9e32025f852f92f5ff4a9176e01edbc244feb2f11643dc0f2880cd1", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040413, "uuid": "60f0a478-accf-4ed6-a412-5fe09b5f6041", "comment": "Malware payload (Dridex)", "value": "b63b9743173ec8050cc1fa7403e267465c4fa161", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040413, "uuid": "a668c628-0c4c-49c7-94f9-cf0ced791439", "comment": "Malware payload (Dridex)", "value": "b9b887e054e97ed66cd240af5a57da5efbebdad6940ef0ba6228f9013d854ccbbe9b8016ddd804eb25cf908c392c7f51", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040413, "uuid": "205776cb-932c-4a36-99f0-bf73a377089d", "value": "0DC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040413, "uuid": "13756916-b3d7-41e7-bcd4-8102354cdb20", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040413, "uuid": "f5514689-2637-44bc-ab13-27ccfb63f570", "value": "12288:Qt+D1yz/1SXpqDaoWmnsFZHk3eBWIc/d:QcA1aLoBsgeBjc/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040413, "uuid": "3255d62d-6710-413e-990e-64937cf7b1aa", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040413, "uuid": "a35d56a5-5e89-4082-ac0d-062842d82071", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040413, "uuid": "baeb201f-78d9-4e87-98b3-8cf71c6cc902", "value": "5efeb16ce9e32025f852f92f5ff4a9176e01edbc244feb2f11643dc0f2880cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b24555-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002386, "uuid": "e53db22e-d35e-47bf-a84b-2c73efbfae6c", "comment": "Malware payload (AgentTesla)", "value": "7dbc707aa7ca54d4b3ba9be1fb300f2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002386, "uuid": "8ec8d6d4-a371-4502-b0d4-f2d5850c4a23", "comment": "Malware payload (AgentTesla)", "value": "5f088163faf431d3d035af48801d8e73c9df7595758c0139241f6999493e13c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002386, "uuid": "d814384d-6ddc-4d68-b3f9-41f102245e5f", "comment": "Malware payload (AgentTesla)", "value": "56d98b7ae07d085f5265a058841d92cdfd052569", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002386, "uuid": "88354a9e-09a6-40f6-a06d-a423e71c3eae", "comment": "Malware payload (AgentTesla)", "value": "6e527abc8454eb433a6e7dfb4223625e8a04732589942ac289f818fe1b72b60f87f7b400d1420b68fabd942b1589680e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002386, "uuid": "d3b6ff4b-03e2-4af7-a603-46d3d23acfde", "value": "3B454A4C1E98C2CAE2794BB891DDA49943F56EF38F22CC79BDD547CBC230B41E606526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002386, "uuid": "d9778c42-ddda-4247-bf5b-cb90632053ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002386, "uuid": "1a2ca53b-19d9-4b05-819b-902aa69d0762", "value": "12288:9La4UxWT+2HNq9Fa6LivRCMzD8wcVR41ChvkK3KZAijbLjFzeYY:9/MTa441DCFkK3KZAujFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002386, "uuid": "dc943193-5b05-4ed4-b5e5-3ec3bea54abf", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002386, "uuid": "44e45be5-1e8d-47d4-ade7-4a7f6c26dfbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002386, "uuid": "64889a21-8a3d-4945-8b28-8e1c33a022e6", "value": "7dbc707aa7ca54d4b3ba9be1fb300f2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0872ed0-90ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617036230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036230, "uuid": "a00f84eb-396c-4ab9-9c12-2eea6ee2f15a", "comment": "Malware payload (AgentTesla)", "value": "99007007d9c6cb38849ce15b28679827", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036230, "uuid": "dd3cad9f-2a5e-418d-806e-5c3f9e1a3a79", "comment": "Malware payload (AgentTesla)", "value": "5f0e187bfa2690c31f97457e97f2f0050ce1612efd8dbe19345ce4de2fa6c49f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036230, "uuid": "8cf576cb-f1d9-4784-9ec6-7c4cbd3ef300", "comment": "Malware payload (AgentTesla)", "value": "6ab467526573be6e3492ac42be611aace63bef56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036230, "uuid": "ee6491fc-5b16-4ed6-a180-f80494030663", "comment": "Malware payload (AgentTesla)", "value": "c4ba614762711b89dd57ae9f1d2849146999858ef780d0f25ccfe82a59c05ea866e21d43c25687cf51c7a45149581a2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036230, "uuid": "afe5c7d9-6207-4ffd-a48a-1eb57d482d20", "value": "0284231827A8BEC5E7EE2F350DFD7E075B04A2E286454DDCDA6863D2B160F0110BB65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036230, "uuid": "d77e72ba-5280-47e7-b01f-258b07b151cb", "value": "12288:BGaxYsADINgHyCU9OJXuW9BCs/1rfj08+er5KBjUVzv6:BGAzADt9dhBp5foorEBjUVzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617036230, "uuid": "64d17e2f-c553-4a2f-b71c-a0d7cdd36b69", "value": 394743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617036230, "uuid": "33702929-0fd0-4d93-ba80-a0964129673f", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036230, "uuid": "b64a448e-cee6-4b82-ada0-7bbe951524a1", "value": "Statement of Account.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50aaeee2-9053-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616997307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997307, "uuid": "f01183c9-29bb-4d56-aa4b-1fff8dd950ab", "comment": "Malware payload (AgentTesla)", "value": "4145b4ae33073ab580b7551ad96391d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997307, "uuid": "9901d211-7c0c-4a8e-acdf-018f5eda5687", "comment": "Malware payload (AgentTesla)", "value": "5f1a8a9bebff2076d89f77898a1dec079e95439171ad051ca6015fed84887d4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997307, "uuid": "1932eaa3-f596-4ad8-ac3b-ce1de832be4a", "comment": "Malware payload (AgentTesla)", "value": "244ff4415f2fb2950b28e02109d346eda5c848ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997307, "uuid": "b9120611-8d75-4a9e-b9d6-9f83eda3bab3", "comment": "Malware payload (AgentTesla)", "value": "e3180e5956c79eaac89a6a630437c99d855d5baafebbd850c586c3276841405ea0d02c147fa1110616f9c09d0c55d172", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997307, "uuid": "4ffe0bc1-7c76-446d-926c-3cc5db3fddc1", "value": "3A94AFF876047DD6266F466BDE96ACE903B627739AC794CC40A8B7C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997307, "uuid": "3fda7ebf-e24c-4a75-bc06-e8db55e4a18b", "value": "12288:kw1jjQxB3rYCGr9aPbA6LVUMu3oapgdI14KwrcAe5:e7b89aPc6LVUMuPR6xcF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997307, "uuid": "a158b832-774b-45ce-b71e-f1e6d096ba15", "value": 413348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997307, "uuid": "220d2bbe-d129-4b81-97de-44a6d7e3ce33", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997307, "uuid": "de204121-00d0-47ba-b10c-2c4ea242e7d0", "value": "Drawing Pipe Spools Ducts.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e42b856-90c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617045031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "052e58c5-7279-43a1-90cd-3519e2210020", "comment": "Malware payload (Dridex)", "value": "bb80cc023a5885329f26b8915c4949c6", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "15972985-9027-48ac-b389-decd44afe3e6", "comment": "Malware payload (Dridex)", "value": "5f204da2a771a02354a8f3027e28f38600b7e1b240da22f03d16ffd005f08e10", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "02c74f1f-379c-415e-bd10-6b13a6f465fb", "comment": "Malware payload (Dridex)", "value": "69a18b923d7496e85deffcdbed2b0e7cebd32e43", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045031, "uuid": "36fc826e-b562-4417-9a5e-658bf0ed420d", "comment": "Malware payload (Dridex)", "value": "b056d60bea4bec58ab57a0a4c9186e6f251679604bae3aa8bccc7dc68140b44410d217b8ee1efaa626b9d84dff19d906", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "ce5619bc-3b34-4daa-9817-fa8e7d24c6ce", "value": "4C84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "6a2bd40d-17a3-4b87-a180-574174ed5469", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "2dd13fa0-b02c-4bf2-96d7-e7722e1d5835", "value": "6144:nbazNBbycfmKsyUlVhMdUFIk1KyHNwoAXpFp5xMfC1h:WzeTlVh/7HNUp5WfUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045031, "uuid": "0879f4ea-749a-4303-9c84-ad8149048f01", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045031, "uuid": "cff8aa3c-0969-4794-bebb-0fbe311bab06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045031, "uuid": "e8bee8fc-dd77-47f8-8ae6-773d28395922", "value": "5f204da2a771a02354a8f3027e28f38600b7e1b240da22f03d16ffd005f08e10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7489242-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617054173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054173, "uuid": "fb9f30f7-b3e6-491f-9b20-1b80c37b8e49", "comment": "Malware payload", "value": "3689482256351f72c4108ba8a3985b81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054173, "uuid": "b266d8ff-d5c0-44f7-9b09-cd474aac90d9", "comment": "Malware payload", "value": "5fbedda881ce3eb91a839ccd4215d1caf22cf4f1295681ac303277688beb1f1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054173, "uuid": "46f041b7-9229-49c2-b056-90254ab3030f", "comment": "Malware payload", "value": "1c132f4e9818175970b9069aa6dcdd04b37bbb75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054173, "uuid": "2274c05b-4aa9-4960-a48d-5d94a7e0a318", "comment": "Malware payload", "value": "735fe6ef21b3369ec1ad3d35a25fe979c1feb55001b734521afe2fac544fc5e83779c0c85df319bda0fa8227fdc97781", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054173, "uuid": "9b769c0e-50fd-4de5-aee9-66ff20ab34af", "value": "35B423819820141EB644CAFE07394FCCDE7A1D5A58D81396D0E8DE4A5CBE16B339FB36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054173, "uuid": "d399c3e6-0a38-42ec-9bf7-2bd263bd1458", "value": "12288:U8ro31qOy0AsPBen2mpMiSCIBrl/COIhSp/6BFzTsn:dowOy0VPBe269P+RKOIhu/szAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054173, "uuid": "b88ddfee-7f25-472b-a1c0-377da8a913e5", "value": 498308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054173, "uuid": "09649548-4751-4877-8232-8401e7140cc2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054173, "uuid": "a076e335-52b7-4053-8b86-23830ae22c0e", "value": "Payment Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea2d0ec-906d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617008658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008658, "uuid": "e3a9cd77-95d2-4166-aa55-7cd6f2bec367", "comment": "Malware payload (AgentTesla)", "value": "874090925e2d1e7fdb689db0aa13236a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008658, "uuid": "f1fff388-9cbe-492d-9391-946da5cc03cf", "comment": "Malware payload (AgentTesla)", "value": "607ac8073da1c2e6719984f3ee177e2d0296273a0d929065d3ebc0d3c5d568a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008658, "uuid": "e24577d6-f122-4682-9dde-08384ca36381", "comment": "Malware payload (AgentTesla)", "value": "e31192e127089e7b1d82cdf8ca1066249a043136", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008658, "uuid": "b684f595-ed44-49e6-bc4c-530839b6b86e", "comment": "Malware payload (AgentTesla)", "value": "fb24631532832be2cebd2ea498f36dcfae810cb2f31d266ab59394d52ec4af7691f0ad4d27fccac9d93fa303eee674e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617008658, "uuid": "e6cd28a3-7e6e-4619-a8c5-89d56d7f27ff", "value": "52153376B01A26FC95164F44FF4658DE1F471B58AE28C292EB1FE3AD2491B0789C18CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617008658, "uuid": "2d50bf24-4a41-43cb-b9fd-688ba94a24c6", "value": "12288:uCUYUiifbXULDp4QM9TbHTdOoJwZwumX+DABFpCARgcOOQtaf5b1NGc:z/BcoHphMVHTWZKODAMARgcOOQ6b1Nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617008658, "uuid": "fbee12db-bb04-4ea7-a144-4e8443ad0d34", "value": 878193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617008658, "uuid": "e50e7cff-a109-4bae-8aad-2358564f8dd3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617008658, "uuid": "f087ad0d-ed60-4d8d-bd94-dfdb7b6c02f7", "value": "PO #047428.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0a59fa-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "f104562d-ff0b-426c-9a3d-1f3898034f4a", "comment": "Malware payload (Dridex)", "value": "1edf1c9dda3dab9ca189dd47f7925dfe", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "c4fc3184-2b12-4387-80b4-e691f4356a88", "comment": "Malware payload (Dridex)", "value": "60988ff09b0d229689af66e2045a647d162cc561b52c8eee13db247681b16ea7", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "ffc0b45e-8cf8-41c1-8bad-e6f933ea4d62", "comment": "Malware payload (Dridex)", "value": "c648e1214eaf6fab8f83091c2e4e437b81471552", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "a5d11dee-6f8c-4dec-9a54-86b546c960de", "comment": "Malware payload (Dridex)", "value": "5196fd27f356513777d2877144b48da1a17d47ea5717f6c5b60e99404794624350ceeb8d2c184497c0ab3fd2de60b1f3", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "51c62d55-9d9b-4f19-8dc0-7bff61536723", "value": "AF84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "240da391-d918-4f7e-9160-e8a35ea682d7", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "fb2bd593-719b-468a-b393-699992b4b1ca", "value": "6144:ObazNBbycfmKsyUlVOMdUFIk1KyHNwoAFpFp5xM+C1h:1zeTlVO/7HNip5W+Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033347, "uuid": "a8d721fe-29f1-46f4-8db8-0ce721c67747", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033347, "uuid": "5ddf6f6d-8531-4933-ab36-337b921d4c11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "84f06733-be12-4631-8a19-9de74b3ff54f", "value": "60988ff09b0d229689af66e2045a647d162cc561b52c8eee13db247681b16ea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5ca9b5-90d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617051527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051527, "uuid": "0d15c8ee-f954-43ea-91b4-0c89688c275b", "comment": "Malware payload (SilentBuilder)", "value": "6be7ef0543c5d48c2ddfeff04dc47c2e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051527, "uuid": "c5b0fe72-1b03-4d3c-ba81-e36eb2d727df", "comment": "Malware payload (SilentBuilder)", "value": "60e4b062f32f2656896e29a030fb719c8f5103a5b4ff6a2de95e1df8fd39065a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051527, "uuid": "44fba106-ebeb-45f6-9015-478a8d83403b", "comment": "Malware payload (SilentBuilder)", "value": "de6293bb28adbee9d4fa81fb5621dada9062ce38", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051527, "uuid": "6482c30f-d1b1-4369-ada3-e155245c6b28", "comment": "Malware payload (SilentBuilder)", "value": "f9b95db3afacdaed6d8864a4f450da5ad5bedf78ba8a52ed2a987d9f6009cc9002dc962ec357fe38234eba7fd603c9cc", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051527, "uuid": "0a4285e7-dd14-47c8-8fe4-03b654067e91", "value": "C1A412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051527, "uuid": "f205ce04-5e4a-448d-bc8d-4044f4340324", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7J:dEKXJ0MDs8QTjVJVf4k4ZiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051527, "uuid": "37ec8c47-7bcc-4e13-b089-6f77863f5004", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051527, "uuid": "a4943a4b-a978-41aa-9847-edf0aecc1214", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051527, "uuid": "b1fe0886-3970-4081-a8df-45e8a9fbd57b", "value": "SecuriteInfo.com.Heur.10468.9712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa204be-90ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617041455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617041455, "uuid": "00690220-b87b-4ffe-b496-86cb6cc514d3", "comment": "Malware payload (Vjw0rm)", "value": "76dc43bfd29712825afa55b64a08288b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617041455, "uuid": "c3338598-2b11-4a81-9a0c-70e0528a7f11", "comment": "Malware payload (Vjw0rm)", "value": "6105effb02ed3d170a6be694ae9a2dee8d18aa0031ff37bd1d7c654dfcdc1de8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617041455, "uuid": "30e4a039-850f-409d-9271-32d727452148", "comment": "Malware payload (Vjw0rm)", "value": "61951a4ff5c962d0d89a591c7e36f30dc1654386", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617041455, "uuid": "c858cdf1-7aff-4982-bb2b-c00b63b14f66", "comment": "Malware payload (Vjw0rm)", "value": "c653f8467d38810c6d798abb87b25b9e6a82835900564ddd8cb830bfebb0c94dc4a5a3119ef58c4a5f6cbfc9faad07a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617041455, "uuid": "c368434a-187f-493b-abd4-4a64d661cb5f", "value": "C8A3B6FCF1050F26D392615C89DE0A1873B3E362F5E9DF05666C2609C1DE92B538AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617041455, "uuid": "9c43fadc-7943-4243-8bfe-b72e6c501c27", "value": "192:rq1kdl35OXKfluzi75WbAZviG1hdh12cB5kw94tMa3dZYkVdPrv1kcHyuIVLk5/q:gkRO9z5K64y24jHus9qWWksSHKSqmg6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617041455, "uuid": "ef7e6180-0729-489d-b6e7-b676df0375a1", "value": 105120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617041455, "uuid": "9e7996a1-0c29-40b7-874a-60b1fbeed6ca", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617041455, "uuid": "159655a5-6a76-421c-bf08-063b1d3d4785", "value": "a3030OrderReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c7ffce-9026-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616978119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616978119, "uuid": "f43fea34-43d2-4aef-8571-e894335e6510", "comment": "Malware payload", "value": "5378ca92e0aace3fe11f9b82beb487f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616978119, "uuid": "16ed3044-2dc3-4873-82bd-62d353b84929", "comment": "Malware payload", "value": "6136c9e1c37cf6ad375a0470470cab5b82a4f71e78ba8209bd0f5387a59a269a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616978119, "uuid": "c61f79f3-5c35-4ff3-bb15-ffd98c110911", "comment": "Malware payload", "value": "612596834fe4c0047dd31c2de8b73bfc898ddfb8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616978119, "uuid": "52bc8081-54e9-49e0-9dd2-295f0a99e6ed", "comment": "Malware payload", "value": "a2b1e7d582ab222a096e63223c33b0f2e93be62f14c0323f302faa507d8a750646423e25467d3dbfe5ea73ae5d8c187f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616978119, "uuid": "d6fdc981-dcbb-47b2-b047-acb2f722b610", "value": "90840110F2E2C133D5618AB88123D276D9366C712378EDCB4F905A716E296E5873F3E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616978119, "uuid": "d55d3351-9bc5-45dc-b14b-4aefaef6717b", "value": "6144:D+FqLZuoZLIoKj90rLM0fiKK45rTPFo8+VqekDSNl5ptMAPkcLVzP7ZGgRcgnKjV:8qLZuyBKhDXe5to8/ekDSN5tfPkcL7cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616978119, "uuid": "41027069-43f5-4713-9701-0af538e4e845", "value": 380014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616978119, "uuid": "7077b13d-78e0-49ef-913c-9207da25bb12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616978119, "uuid": "e0602d08-3fde-4878-bb73-b7e306e825b5", "value": "SecuriteInfo.com.Variant.Swizzor.6.2410.7441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a094ccf-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617028139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028139, "uuid": "60cded80-5409-47d5-8d44-3c8b6dc8c4f6", "comment": "Malware payload (AgentTesla)", "value": "634b415dcc91209140c67311f6818200", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028139, "uuid": "838f42ec-d50c-4bdb-88ce-954c765eff33", "comment": "Malware payload (AgentTesla)", "value": "6152079dc32c640dbf15b02e7254250deb9f9ea5aee39a1b0f6183d9d619c60c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028139, "uuid": "a2f0cd22-2881-4457-8eb2-1ed1284b2c93", "comment": "Malware payload (AgentTesla)", "value": "dfd83168e7363206842d56c03e60b61a72509bff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028139, "uuid": "b998d033-d0d6-4fea-8543-aabdac08c7f0", "comment": "Malware payload (AgentTesla)", "value": "3e67a28b39b028f903bea168dea3673bf34ea4e01e6e7cdd1c0214a16fc8f3f21d90d946e9a0760cc21cae2c941ccb3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028139, "uuid": "cad75e44-81b4-4dd5-a8b0-994619031ff2", "value": "6F93F2D0DF07685E962C2D311D45BA70CA70AEB53A9583F784376C2642A15BCA2FBF81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028139, "uuid": "278ebf66-5f7d-4552-ac77-fbb0b3d4e7a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028139, "uuid": "f437af36-6b1c-447c-9527-afb1a1298d31", "value": "1536:2yQKLApVSQ1HZnw/gGajix8TJLenbBowCa9:2ytspVSQXw/gGajix8TJLenbBom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028139, "uuid": "199578fd-b251-4250-a12a-47fdeba6e3cb", "value": 94536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028139, "uuid": "d490c706-99a8-4625-a889-6a90cec4f458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028139, "uuid": "b598919a-1d2b-435a-b6c1-dbc829be9b4e", "value": "TT Copy #8985434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3331562-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617006035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006035, "uuid": "f6c961a2-d0b9-405c-a127-99a7b190d903", "comment": "Malware payload (AgentTesla)", "value": "fe75946dc21923d8328a47f181792236", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006035, "uuid": "f64e0e1b-6872-4cb7-9226-39657e4f682f", "comment": "Malware payload (AgentTesla)", "value": "61ae998518441b3cc2de4761cb58b183fd403165fcc6a6e4c2ecea8686c20e26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006035, "uuid": "7df0c727-8e38-452a-82e8-91f471da74ef", "comment": "Malware payload (AgentTesla)", "value": "3547a27d401a2e7c904d1a5f86dc90bf0ddaf7b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006035, "uuid": "a7532f94-b119-4c21-9fde-c0880269163e", "comment": "Malware payload (AgentTesla)", "value": "34cbe8a79c48fd456667ea405be98e85e05ff4a0b04c3d02b2d1aede9c1b1cad3c2ff18746b35b9ed16982b59960e18a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006035, "uuid": "3d4be6ac-9b3b-4c91-8bec-6044d3458cc0", "value": "AA334FE89B3506E7E96DF874B0A5311A6130B5BB18144A2792F7C0D3C82777E9DD0D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006035, "uuid": "ef2c8c59-0927-4140-94d8-9a62d7b2c2c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006035, "uuid": "c109dec6-9574-4729-b8ac-53bcddd45dbe", "value": "768:I1gNzmQF2KTk3ZN8D8mv1PttdOft3rGflRGflvx/FIwJGun51uHX7/Fo4dTh4:vFFjYv6jjmtEX7/lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617006035, "uuid": "180e4213-8d71-453b-baf1-71054767d4e8", "value": 53800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617006035, "uuid": "bbb7f439-4b50-4abb-b4a4-12756f950b4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006035, "uuid": "c7cd7a57-8024-4cf5-a883-07c7aaff4721", "value": "DHL_document11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6e4366-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617032332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032332, "uuid": "b49a3a3e-abc5-43c8-9476-540250aceefe", "comment": "Malware payload (Gozi)", "value": "dc190a4f56c3971c6af753d02d633b37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032332, "uuid": "2a772d3f-200a-42be-9497-39c4b2100a55", "comment": "Malware payload (Gozi)", "value": "632532e4c584dbacddc365e46d2ce8b219f1f6433ac8dc6d51dc7a29a1a36d35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032332, "uuid": "36d8f778-b8e7-47df-98a1-625075b415ff", "comment": "Malware payload (Gozi)", "value": "44d9de1f9b6374984ec4e6b9f2a531efef05b95a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032332, "uuid": "ca73517f-436a-43ae-a908-4fbc650ae07b", "comment": "Malware payload (Gozi)", "value": "a502e9ee42421575d35f158742bdb51d77e46314e2206418d1bd5469f5bbea06afcdb3a2b025a0bf85f1fc5731953c19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032332, "uuid": "07edceff-f500-4d20-a772-ce436e25fe9c", "value": "3F74AE053BB0C5D9D2A521B44ECD8EA4E924FCAA1F20D21372D975DCBDF9F89262D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032332, "uuid": "dd9fa7c8-2015-4ca5-880b-57f0569b6246", "value": "77af713b1f2916ea138f9bb7258cf849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032332, "uuid": "e22b404b-545f-4ebe-b459-61d2cbc529a0", "value": "1536:bepG5ACCny8GenidAHcz92ZIx9FxIl+YkSVoZlP1usBVEwnoxJashnXcX:36lGeExx9FmSSkfBt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032332, "uuid": "9d336604-94d6-4ebd-bdcc-9ccb22d0c131", "value": 367624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032332, "uuid": "9443981c-3019-4250-9bec-a33174d8ab09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032332, "uuid": "e20de591-9d44-451d-a356-1395970c5249", "value": "dc190a4f56c3971c6af753d02d633b37.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d6e781-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617027941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027941, "uuid": "34048be3-1622-492a-8893-757b327b6cb0", "comment": "Malware payload (IcedID)", "value": "2ad4e2cf4385163bfca1a034aff4a688", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027941, "uuid": "7a1c3511-1ffc-4536-aa45-36143122cdcb", "comment": "Malware payload (IcedID)", "value": "6383b484f8046d1f91cac33167355b18589fbe02392bd2b058c6a2ddceacfbba", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027941, "uuid": "783e5058-1a75-420a-a99d-cd1b1abb9d62", "comment": "Malware payload (IcedID)", "value": "739c4ae8de7e0b589970ff5c54d8870e0d9c113a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027941, "uuid": "b8a3d2cd-a8f7-4cf6-af2c-8587ba247cb1", "comment": "Malware payload (IcedID)", "value": "ffd7c26764ff4655bc0375709bc20c7109dc91103d434c3385deae91f20827da1da9bb9aab1ce5e6523748b4db5bc99e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027941, "uuid": "38a24cc6-6246-485d-8b5b-586f4d22347f", "value": "01B3B0BCCB06B0A7DA54DF3C854AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027941, "uuid": "7b14703e-cf5a-4e14-a900-0842321013da", "value": "3072:A26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:ALTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027941, "uuid": "67cba878-7dae-4ffa-b077-0e686455b499", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027941, "uuid": "994667a6-3515-480c-88b8-89b57090c8af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027941, "uuid": "b1df2620-e797-48ab-8d7d-c16f8954dd3b", "value": "document-1170380657.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a15e49-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "eb550ec4-47e4-4259-8813-7d7778ec3475", "comment": "Malware payload (Dridex)", "value": "93d9399a12ddb66c950b424501fd712a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "c4e8851c-3bad-4e3a-ae2e-64de67a15ca6", "comment": "Malware payload (Dridex)", "value": "647dc4fc00b71cc6ebb216cb8c97a4d19ffa48003ac50ce7d0dbeab76925ea2f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "37081143-2f93-4539-96f0-de7bd621b0c7", "comment": "Malware payload (Dridex)", "value": "e7e38f71641f255729163c08f18d355d0e67b6ce", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "fa3f44dd-94c8-4713-a218-293073fd0d0d", "comment": "Malware payload (Dridex)", "value": "c47a5a65cd8c62274677c3adfecc0d802df0e8848a04966107fe3a7cb4847cb53bec0abfe76e8c8cca36bfbc69107246", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "a15dccb7-7ea5-4642-90e4-8e2f011afb60", "value": "8814AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "b9c59419-2741-490f-b390-6f9c91a1316a", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "b3fae688-2252-4d8d-b3c3-f68c79b2c151", "value": "3072:kpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:kBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028216, "uuid": "d0411a33-f988-46a1-b709-c5a8c7fd8882", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028216, "uuid": "599776b9-3684-45b8-9637-fcb0a153f958", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "41990938-9913-4504-83e9-979d1845cce9", "value": "647dc4fc00b71cc6ebb216cb8c97a4d19ffa48003ac50ce7d0dbeab76925ea2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d294e5-9074-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617011513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011513, "uuid": "220577bf-ca12-415c-8832-9f148f26738c", "comment": "Malware payload (Formbook)", "value": "63cbbbbdf71a18fb223615e73b6e5fa1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011513, "uuid": "bb3e9b69-78b8-4dcf-8591-9585e079b916", "comment": "Malware payload (Formbook)", "value": "64823a7c1eaff696dcee7a17f3718ab781a85133b12f589ca5a75038b6057c10", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011513, "uuid": "f03106df-f5c0-4abe-b492-2000ade39240", "comment": "Malware payload (Formbook)", "value": "06dd2b2aff15407031659f02382df39e49a9c1b6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011513, "uuid": "73314018-bd79-4ce3-9367-83f9de35938e", "comment": "Malware payload (Formbook)", "value": "d25b222e1a86c805f5def77bf6926cb9af4a3d018c4fec6c515102ba29f4840e6fbd9ad376625d7cc6f8fcfe5bda79e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011513, "uuid": "26a6e10d-51f7-49fb-ae4c-d7b5cb78ced0", "value": "8BA423C11297A940C92466F9E959F2A5F2360BF8630C907D710EFE415E35B5EFBA0B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011513, "uuid": "2296a41f-0af1-444c-a274-309696363edb", "value": "12288:u3fP8FnrOGdquZbuEn1nkZEEOVUBqx6/U4DjcUqy4OQi98:mEFjZVhkZWrx6/U6IyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011513, "uuid": "68be1d00-74a7-46c8-8f43-906bf299123f", "value": 488856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011513, "uuid": "fab18a10-9769-4deb-86ab-2a0f009ecfa7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011513, "uuid": "2d9b1e2e-cf02-4a72-942e-637dfd59fad9", "value": "PO# 45101756870.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d456723-9057-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616998966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998966, "uuid": "022ae5ce-58bd-4963-94ad-e4dd56b447c8", "comment": "Malware payload", "value": "88a3e4f6f889778ab15c2e69546773dd", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998966, "uuid": "64e2e064-1321-4b97-9e47-5ebcbc073a6e", "comment": "Malware payload", "value": "64cdea2b27549ca4cd8be83f9b33b80cbda1c0fced5d2dd150196ffac16c40ff", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998966, "uuid": "1fad715a-60bf-4288-be1e-5c6460d765b0", "comment": "Malware payload", "value": "aecabbe118ee2362424d97cd82ec1182aa8aef62", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998966, "uuid": "1504a439-153a-4b8d-8db4-7a780d85fca3", "comment": "Malware payload", "value": "334e99e9cb8b7df1671f8ac892f0bbf32e59e536b59cb29181f545e1c2ba54bf90b1dd57c1fbd81a4f27333c68a8eacf", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998966, "uuid": "45523ad8-3bf9-4c5c-8160-350c74762ce1", "value": "2F25335161F58B79FC7977528BB8C117A2281D8E1B2E2B3F248871986F353660DC4EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998966, "uuid": "f2cdaf36-cd0b-4eed-9d89-8e1218abb623", "value": "24576:ZuCFb+t4h4gGDx8e93WEY8rsCnIZ2Pjvnu:ZDI41GllmEY8rsCIZ2bvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998966, "uuid": "5c15a9c3-3a59-4e96-b301-6f73c6781763", "value": 983950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998966, "uuid": "9c8c83aa-16f2-4cff-b52e-41509790314a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998966, "uuid": "7be6c4e6-21b4-4b8b-9a70-1047abf7c9af", "value": "New Purchase Order Ref_0022161.pdf__________________________________________________________________", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c0d3fa-9097-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617026578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026578, "uuid": "dadcff1b-3c81-4d65-bd7a-faae5b30bfb1", "comment": "Malware payload (Loki)", "value": "d14388e169ce06964b253b9b75e15226", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026578, "uuid": "9110a570-c88a-40a1-ac62-11414e540c26", "comment": "Malware payload (Loki)", "value": "659c802019c8cb45dbf60e1427c0e667a011aa6c8b418a8f633a43d66956f723", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026578, "uuid": "82b264af-a779-4f5f-b6be-e004cd71a1b7", "comment": "Malware payload (Loki)", "value": "06fbab2873fe00c8b63773d32e345eae75c1d303", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026578, "uuid": "3cc81ea6-764d-4de9-98fc-8a7048513bd9", "comment": "Malware payload (Loki)", "value": "1a4efbdb361b05facbdba53e65fd4aff3e8ed4ec4755f4aac0ff1dec5296faa583c69ee4aa5db09db2c4be4b768d9708", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026578, "uuid": "80fa5eb2-591d-4d3f-8cf8-7c3cb28b6eec", "value": "2E6423F908F67B99003B0057314EB6E4A89BD37481B96C59BD53DE5A22A4ECDCC9CC9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026578, "uuid": "36b357b9-f174-458a-acc0-e674b5437d7e", "value": "6144:xqqRBXZKP9AVTLFGS5nWQ+WkMJNbsLyojTXWJIIYapFxAEadiRce/:swBUP9A1w4txJNbsLyASJvxAldiz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617026578, "uuid": "b2e6caed-b404-421b-a774-cd2c21b8e212", "value": 333141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617026578, "uuid": "f6c5d168-c962-42e0-9b02-d4595bdf05d8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026578, "uuid": "fbc73312-e7e4-4516-a5ff-1da41f3cbf01", "value": "Po___20202904.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdc3820-90a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617032707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032707, "uuid": "b88cdba9-37f1-4d74-9ae7-f5c5a6237695", "comment": "Malware payload (AgentTesla)", "value": "e0abfb5d355309be0c1ccd3f0b6f8174", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032707, "uuid": "c06a1ac7-c4e1-413f-b1dd-5034eaa74839", "comment": "Malware payload (AgentTesla)", "value": "65c7e02ba4d05c0009b9c62be9127e472876a9ed70f86702e144f89f20e78b4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032707, "uuid": "81d97065-73a6-4649-8132-6c55f766100a", "comment": "Malware payload (AgentTesla)", "value": "bdbe2ed62d77901dff4e9705096dfc70023983ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032707, "uuid": "d12447c5-bec7-4be7-b76c-3864ac08ae7b", "comment": "Malware payload (AgentTesla)", "value": "41cf3c17a9fd33eea9e64ca7cf0832e5e387d87ba5927e854a593cb59f1ed15a7c18bb3f659ae34c42ca9f2ecc405b15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032707, "uuid": "f5463b2a-71b5-4d16-93f1-7d08b957c4c6", "value": "B015D19224ECD191D822BDFCC95BE3E3371AC9A79780AB4731BCD4526267B9BD11340E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032707, "uuid": "e5856074-5c5e-4847-b508-23d7c40f10ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032707, "uuid": "2d02213e-8af1-45d8-9767-e68611f641a3", "value": "12288:lzVNuGjvHoQrStHJMOPuUVmFgF9nPzjFd1TratXSI3r:lzruizSrfWUYgHnr5PnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032707, "uuid": "e9b00d41-6c8a-42bd-a2dc-d48dfa719fc1", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032707, "uuid": "187be14a-e455-4b02-ac39-0e2c5382b01a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032707, "uuid": "5aedfe9a-b9a3-4f96-9dfe-42b1f900dd1a", "value": "new Order no. 631701 - send PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae59c08-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616996465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996465, "uuid": "98a58485-5d2d-41d2-a243-ab5f65a8add1", "comment": "Malware payload", "value": "ca501a055dd27f088fd1b20d42f8ba52", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996465, "uuid": "39ce5bc0-50e2-44d3-a17d-b1befc88960a", "comment": "Malware payload", "value": "66824a1f4d190c4cb36b1eafb6bac4a3068a33b532a6139ab906a7f45e610dde", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996465, "uuid": "c7ea0297-1c45-4712-a9c1-6169324c81eb", "comment": "Malware payload", "value": "c3255f464e22af6578f438e8e9ad0d65ca762647", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996465, "uuid": "dda0c796-2868-4c89-88b3-3f26c29194a7", "comment": "Malware payload", "value": "30347045023276ba781bb2cf36ed413164320b3af83e06634c12420efc359a51fc5e278ccd3f42d13d660750bfea2b5f", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996465, "uuid": "f8715af6-d904-485b-bf97-bcf2c71db662", "value": "09D2F183BE1401C754A29AB796508E61E79D4106C83CCF004F823146FF5B3BE86DB2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996465, "uuid": "36bdf530-fc58-45b3-9744-681ea6f10aff", "value": "768:QmnI6ETPnFQvhTKQUHv2KHzENN/bFmXlrb+CL0m:QmqhihTSv2KHzC0ln+Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996465, "uuid": "21c332e8-572f-4273-aecd-69215b7a48e1", "value": 30757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996465, "uuid": "a1a8bb46-c38b-491d-86dd-103117a50c6a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996465, "uuid": "22696f02-4c9d-4b7c-93d5-cfbcefe69502", "value": "lastest shipment.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87353ba7-9058-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999546, "uuid": "90d4a9ee-1890-4c99-beb3-697c210db39a", "comment": "Malware payload", "value": "b8a332b7d66e657d7cb058271e8798a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999546, "uuid": "3f50b508-2959-4a49-823d-38c15ad486d7", "comment": "Malware payload", "value": "669912a8dc5b8ef36bc288090ce279a649587e64ae2a64f100f8ea0ec47a6ded", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999546, "uuid": "20aa1b7e-8623-4841-a4f8-75d63a66d811", "comment": "Malware payload", "value": "ba8b33ce7189092d9d763317d2d8f53830f09188", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999546, "uuid": "464ec6cd-792a-4086-a2dc-7931d4109c23", "comment": "Malware payload", "value": "1174b5b29d4dd5cfcb005866e126b85381e05c58d6092fa298c5918770c6a9f6be020c8c823904934f4290eecf615e23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999546, "uuid": "ee3f034d-a45c-4597-a21b-9260eedcdc22", "value": "9B0423DEE2C9DB34F687E7E7E73F12155A8644A25B438926435AA1F0A4100149E2BFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999546, "uuid": "4327536d-b119-41de-8f3c-abf78f07b166", "value": "3072:44riNlHKR1pPLoy504qlEMY1nbpXIUyn8FogZvBIvDzNVi6cPB66ymTY8Taiu:44ri3K1w4uY1mnmtSfngVyms8Taiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999546, "uuid": "12546f78-dc87-4de9-be19-7f9874d810bd", "value": 185625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999546, "uuid": "0736f300-283f-4a1f-a8bb-bfeee42b5aaf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999546, "uuid": "357625bb-7e20-4231-b62a-6e772f3d3f70", "value": "805.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23c19e9-9091-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024207, "uuid": "972b81d1-1a95-4519-905b-6f2d1b049fcb", "comment": "Malware payload (AgentTesla)", "value": "a84c04f3a6028e68f06fed564be3616a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024207, "uuid": "6f556a08-f828-4b78-b1d2-e17405ffd36b", "comment": "Malware payload (AgentTesla)", "value": "6817e2c7ce4cdccdab0bcd21be155f19e254621ddf225fda2f5a4c5b0ca6588f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024207, "uuid": "9f98f8c1-57f1-48cd-8296-60cee12f7bb0", "comment": "Malware payload (AgentTesla)", "value": "82f566d99bf31d21f348febd1ff252654c1cf18a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024207, "uuid": "b6b53268-3e7b-4430-82dd-61f5f89448e8", "comment": "Malware payload (AgentTesla)", "value": "2882fbbf46baf4f6778da8f620932a80e9e8c9f07494480e4394fab2314623b294cf25d3f724d9264da3e9a229bb467e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024207, "uuid": "d54dde3b-f549-4210-bc29-8c8c95d70529", "value": "35F4AF313AE95219F177AF754AE075818BFFF6237712D51D2890038E4722E81CEA277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024207, "uuid": "9d422e78-89fe-4076-98ac-3aeb4d4e0ec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024207, "uuid": "e54f080c-d45a-4d3e-a677-c67c02fe37be", "value": "12288:j9htAX/o2sJso2D3NvWNMrMYZhu4DfbYdBsOcQTPfGaqhMdW4PO/TniiR1n3dQzK:j5SNQ+h7YP3AydW4GLR13dQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024207, "uuid": "b2206a90-2777-4708-ac48-fea0d498f142", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024207, "uuid": "478f5e8b-7c39-415d-b258-86240b8ababa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024207, "uuid": "d0381042-c99b-4946-bba9-474d41159f11", "value": "11032021001#_AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88067ee-90a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030660, "uuid": "a80edf27-656b-441f-9949-6161e78b917c", "comment": "Malware payload (IcedID)", "value": "67639f2165674ab88dc12001ad1643e8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030660, "uuid": "13b4c08f-b1bd-49eb-a080-c6df7a0bd332", "comment": "Malware payload (IcedID)", "value": "683308e87083f4d614a923a8c7337ef224e7f7396fac710ff884b0c243fe6f62", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030660, "uuid": "fa4ff3a7-137a-44f3-a6da-92b8692a6a25", "comment": "Malware payload (IcedID)", "value": "9d1e28e35fe10a4410a7876715a16a735357727e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030660, "uuid": "048c66a6-df13-4bfa-974f-2b193fd7bf5f", "comment": "Malware payload (IcedID)", "value": "5c61e74c7ea3cad02e1ab473443f2f8aa4503967dc9a93d825801b72fa0e9b181c653ce45fc864f852055f5ef9f122a9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030660, "uuid": "d5357899-ed68-4078-b9b8-4fe7faa307d1", "value": "3D04122DC0568D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030660, "uuid": "5c5e784b-f35e-4cd5-9420-a03c0370d5c0", "value": "3072:A3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:AnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030660, "uuid": "1c38e182-6f5e-4478-b71b-6ce4b239a4cc", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030660, "uuid": "e0aff05d-ba34-48a9-9add-e463ec175bc9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030660, "uuid": "8934164d-eb31-48cb-a923-50899ad292e1", "value": "Claim206141819403292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc47914-905a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617000604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000604, "uuid": "339504bc-58db-4d36-af3b-e90da8732e8f", "comment": "Malware payload (AgentTesla)", "value": "991ba2c8a8f237284dd43773da0dc2a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000604, "uuid": "64ff0ccc-f798-4d70-843c-064e70e67474", "comment": "Malware payload (AgentTesla)", "value": "685379481a151d35891ddba30a43b360f40183375ca6c83167673b8d60704b38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000604, "uuid": "308e1480-79b5-4f09-a3f2-1a4548b0d195", "comment": "Malware payload (AgentTesla)", "value": "779d993deb2b14fbfa531f0e85d1b880fa8d153c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000604, "uuid": "2a882af9-b6c1-42af-8d0c-1b3a9b21fe59", "comment": "Malware payload (AgentTesla)", "value": "8b9fdc96d7a880ff5095b78e2b8a9ef02a1c92b9f8caac6f1a7fcb3fd27600e640ad3f33a20a808ed2fb53889591cbf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000604, "uuid": "0807b55c-eacc-4383-b200-482f136cb942", "value": "CFF47C84E4449AA5DD289BF65532C8300326BEED1437DA0C19CD7DEB3BFBB8A4C95943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000604, "uuid": "c6ce141f-1937-4f94-95e5-5495e577cc1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000604, "uuid": "368eb4e5-ad25-4cda-976a-8195727d2e2c", "value": "12288:AK2mn8EnOhjTO6DOB7fNYteiP9V5nDtP3/UUzQBwdVEpTxt/P7r9r/+ppppppppV:XxojF+6tlPDTPPUUzMwMxt/1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000604, "uuid": "d438a8d4-529e-4e0d-a87c-8cf9fb0cd2d6", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000604, "uuid": "5d310881-6b14-4a2a-9816-6af3e16ea1fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000604, "uuid": "f5afa8fa-ce0c-42d5-b808-8b82e38992df", "value": "Payment Copy.pdf...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f27cc3-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617025684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025684, "uuid": "0b1c1862-3beb-4c19-a213-d74fbaebf0c5", "comment": "Malware payload", "value": "a2e5f09d7fab57295b0edb1e722283d0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025684, "uuid": "82a85712-dcff-4420-b31c-e91d8f87ed85", "comment": "Malware payload", "value": "68546f6163304d3c7d4c4d678c7d879b6198d400344a944957f772f774bcc5d6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025684, "uuid": "880855c6-3a64-4494-a0e6-2f2a17df93d6", "comment": "Malware payload", "value": "5172f5e8037a38aa85a9371aa742e7da56040be7", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025684, "uuid": "372d32d5-30ad-4c2e-a541-b305187ec817", "comment": "Malware payload", "value": "6078b2d8e8b46142d6443808e9f7477892c475a743da5d9cb352b333ff5ade99aba82213249b9900028bcbb35539a875", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025684, "uuid": "6ea4e173-3208-47f2-9303-5a4e1ce29dfd", "value": "04B4235D3ED3AAFBE0728FBC593100123F368FDA6B6CCB63965B716B8635B905419120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025684, "uuid": "77ace66e-3893-48ed-b85a-1791bfc18d57", "value": "12288:xIbqqf+Y9kBuxWh3GG5N99V+gAR2NgqEms:xIuqf59kMxWh3xpgB2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025684, "uuid": "2d79334a-23b0-4f93-af41-a1549546644a", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025684, "uuid": "c27869b3-38a8-45aa-a746-7a8f603e5450", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025684, "uuid": "a93f0da5-b25e-465e-ae09-d73f4f385121", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b042df23-9092-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024526, "uuid": "5404c7ed-fa1a-40b1-bca6-d93c2a7ad6b1", "comment": "Malware payload (AgentTesla)", "value": "60edeecae1c17c507c56235b712eb895", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024526, "uuid": "b7efb873-e551-4dff-b5a6-c8f982282207", "comment": "Malware payload (AgentTesla)", "value": "689878b5e8cd791ccd158633365f65ef1f5efc7d1919d852adda3c6817ac6b53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024526, "uuid": "ff37e7ed-1140-4d82-8d51-99fb19c4d4c7", "comment": "Malware payload (AgentTesla)", "value": "32917b72caa091d0ce7f8370055feea79ebbd507", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024526, "uuid": "be258c28-6c1d-4cc0-a140-b68d08b743f3", "comment": "Malware payload (AgentTesla)", "value": "b5a862b4ba388ec7bb392185f051af8e80d9e21753d4f13c5bd8300fe46aa5c0ccc8646d98f46c336e8978e558e20537", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024526, "uuid": "0fab3e8b-44d7-420d-9c2e-0125667710e2", "value": "E835178C5E9DD2CAE1791B7985DD989883F95EF38F21C87EBDD017CBC160B84E506222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024526, "uuid": "8adb0d93-401d-4a9c-bfb8-67eb585f93b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024526, "uuid": "e6f1ffbc-3f7c-47ae-9e13-2ede35004b58", "value": "12288:3JlCa9fI6nYHwstjdZlrJD/kVAYvJ3nVppRCCD0PuuEFJ1bLkoJgfQKgn9R9l:yeI6ngxZ/ZkeYpVpp0XPu3FHIo5vn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024526, "uuid": "d68f7de4-63bb-4210-85c2-ec7b58d4300d", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024526, "uuid": "81d94a99-fda9-4ecd-a102-821ff1980c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024526, "uuid": "3a424d38-1daa-4ae8-b972-894b1e43ae27", "value": "Order_AH874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b381f59-9037-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616985326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985326, "uuid": "357cf492-0fa0-4790-96f1-1c0838f78add", "comment": "Malware payload (RedLineStealer)", "value": "a9acb6b3a69d554e4326726ad9221e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985326, "uuid": "dfdd4a67-426b-4432-9f54-4eeccda1d12d", "comment": "Malware payload (RedLineStealer)", "value": "689ca59de6d01b808fa447086aefd829f18f5b628c279148220188ab95e66cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985326, "uuid": "52dca89b-1ee6-4d22-9da3-6b28ae4974cd", "comment": "Malware payload (RedLineStealer)", "value": "27a1d27492d82fb1ae17d1cf1549262d367dba49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985326, "uuid": "b04a2620-e36a-4100-9fc8-2ec652264584", "comment": "Malware payload (RedLineStealer)", "value": "5d3ea61c5f0f5a86a356854cac092007c835f9aa4025799fc61ee3f4e18ce55cf624fda89782421f6ff925a5f02c8a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985326, "uuid": "7895e911-2ccc-4825-9582-baefb556cebf", "value": "62A633ED7126302DD07A94B3A51E74222FA02D3D3D9E9F8B7A21FAE61F70519CB5C250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985326, "uuid": "1f88cac2-6999-4c51-8cfa-ff47544759ca", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985326, "uuid": "768374c5-85f1-4ba5-b6d8-15634e48ef45", "value": "196608:mRmL/3ck9kIE45JVjL+k5ftYMV3J/uIlO+NLdOMV3:mc/3JnfRCX61uIlO+NLwMV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616985326, "uuid": "b40d5cc5-375c-47db-b1cc-eb7c0cb64516", "value": 10001946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616985326, "uuid": "5ddea015-afa3-4e39-a848-4eb9eaace409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985326, "uuid": "ceca83c2-64b7-4a58-94e6-d7791474fe2e", "value": "a9acb6b3a69d554e4326726ad9221e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e6ed97-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617001502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001502, "uuid": "99f05e73-cd6a-4e52-bc69-ba819841f101", "comment": "Malware payload (RaccoonStealer)", "value": "36860417430a205589b0e0243884b5ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001502, "uuid": "0adeddb9-d9da-4bda-be52-347f308e200e", "comment": "Malware payload (RaccoonStealer)", "value": "68e7b4aa89f3f204e8e2d158c4a0892ff43980870e1907d4ed1dc1b57295bd7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001502, "uuid": "dcc1c07f-c776-42cf-8e74-d1ed5872bc1e", "comment": "Malware payload (RaccoonStealer)", "value": "cec42f8164dcc87bc08772cd880a592c241116dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001502, "uuid": "1d4e489b-fe1c-4b07-ab34-56113c4cf9fa", "comment": "Malware payload (RaccoonStealer)", "value": "e0cba37ef3d0d9d6d0f5abfd3917625c292c3b220b1126f120962ab8fb5fdc172325ca33a7ab55c013c44714d378577e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001502, "uuid": "d50cfc91-e9e7-4578-b323-b68699cff39b", "value": "73A4021039B6D073E96525B48934C3B18A66FCB95B3159C77BC5272D7E312E28B3AB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001502, "uuid": "e2109966-4bd1-4b6d-8c00-e3672422eeb6", "value": "3ecbda6de31890eaa5cd272ab1b192ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001502, "uuid": "9d0a33c5-eac2-49ae-8eea-f46bb43c91a8", "value": "12288:yCYaA2+ZRpGKJ8bVGjMIKmHOua2hWuU6sYIEPJSaE4RU:yCYWMAGjUmHOuPgf6HdPMX4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001502, "uuid": "0c18ca63-0049-4909-9b2d-5d4041717cf9", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001502, "uuid": "d2f2e0d0-07a7-47a0-96c3-99cfd357ff74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001502, "uuid": "dd00b35c-3652-4fd7-a870-0c6ed54f1155", "value": "36860417430a205589b0e0243884b5ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e87022-90a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617030654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030654, "uuid": "26b1e7be-bf5f-4970-b1a9-68197a5df7f2", "comment": "Malware payload (Vjw0rm)", "value": "7c48ff776e798cbe5709a4d114b4dcec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030654, "uuid": "e617a77b-5ea0-400c-aa5b-39badd6ac2b4", "comment": "Malware payload (Vjw0rm)", "value": "69ed29c3223ea8445fa3d04daf3f927b568b33787d1cd5e5876f4f826cf4e3cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030654, "uuid": "27b405c0-e681-4bf2-b182-a82c657c88c6", "comment": "Malware payload (Vjw0rm)", "value": "1031738810ed792be345f81983a1bc8cf5750634", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030654, "uuid": "087a0196-efef-40e1-b958-b26ddd54e97c", "comment": "Malware payload (Vjw0rm)", "value": "a46c25ca4bd6596a73776a334dd30bdbd02e62757439733e70a8200e49e9a5c34fbb9b6a5be49a0a2b17d6a31f1c240d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030654, "uuid": "da0e5528-3cad-4b16-a45e-0f9f271258d0", "value": "A1220CD1F74D904F53E2126816BE3C089CAEDA7152F861F5FA77A464E438A2C839DBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030654, "uuid": "27081719-ec5f-4fe1-9f5c-2aa17938f3aa", "value": "192:Qjmf4F9ZFnJnI7oy4vESs7Slu+xCPM4tYujl54S8T:Qjmf4F9JI4pH/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030654, "uuid": "e206f1f7-4a1d-4c32-919b-fcceab57f123", "value": 9996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030654, "uuid": "9fb9b8c6-a83d-4ad7-adc2-4cf0dadbe080", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030654, "uuid": "b088b42c-176c-4f1f-90f0-5daba8eb3923", "value": "XZMNKOPM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bf1aae-9023-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616976773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976773, "uuid": "7e8fc874-b1b4-4b43-a33f-e6df322e2a63", "comment": "Malware payload (Dridex)", "value": "3ae276d0e6105e7a3483f642925ec0b5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976773, "uuid": "77f067e8-2575-42ea-9245-59aa0c0c013d", "comment": "Malware payload (Dridex)", "value": "6a1aed25de82171aa678c6822bb19948934d0957fcce8d93a87e581550c58269", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976773, "uuid": "e9012b66-d0fc-4e0d-b040-46ad5badad5b", "comment": "Malware payload (Dridex)", "value": "0ca20be500373ad977b5fa06c888572f3d97bebc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616976773, "uuid": "5e2f5471-017d-4301-812a-31e544538706", "comment": "Malware payload (Dridex)", "value": "a9647ce903762ae2e8d637639f0bc59d5bd427f3f76098265d0a8cb9496f7b5749e1ced8b6cc0649b3004fd0b4791cc3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976773, "uuid": "f1dddc87-0580-45d4-96e7-31919b907b12", "value": "7C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976773, "uuid": "50e7a3f7-5ada-4108-8727-d502c8ed917d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976773, "uuid": "be571c66-c1c9-4f15-b01a-e17bb7b6fa47", "value": "3072:a1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ii78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616976773, "uuid": "2bd94d1d-d4d5-4dce-985e-6bce2a8e61b4", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616976773, "uuid": "b75d9df9-e5fd-4d42-84fe-ebf04d6e2bf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616976773, "uuid": "5b829e20-e151-45d4-b562-28f1620060b9", "value": "6a1aed25de82171aa678c6822bb19948934d0957fcce8d93a87e581550c58269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d51b8eb-90c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617045405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045405, "uuid": "bf873419-f115-4762-9316-58122d0f0ae8", "comment": "Malware payload", "value": "67f0f93d82bcc598f5ea9186cf76ec54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045405, "uuid": "02aad88d-ce68-4565-b3cf-98e5a5639642", "comment": "Malware payload", "value": "6a61435c27762157a43c3043f953e82c3a912813d52bee0fe9aeb28ae3c36984", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045405, "uuid": "19cc235b-4863-4a97-92d8-ac8f3f2f1225", "comment": "Malware payload", "value": "57bb1991de4ae0e7c51c6ccc1d0751ed082dc310", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045405, "uuid": "692bb18a-f857-4fef-8b73-56b715de1b8f", "comment": "Malware payload", "value": "99a1bad97a1ada1cd9db7010c22c46435c521c4e2cd5cf04a86cdc087ca2f496a1566b3a96fc6577ac279f0e846ec895", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045405, "uuid": "eaa7cb35-f156-43d6-893b-74953e6e774b", "value": "27C3AD76F3C7F729E31BA0BC906D3CF36A8012E495E0846725829F184255F67229F9BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045405, "uuid": "ca581b4e-b771-49a4-b6ed-c68549679bbd", "value": "1536:YtXw1Ut8BufISzBAkIQkn8zQHQjXC7EyVVEq1z/2dsa/pEpbBeoCoAzbDr:B1UoRXEZsEKiGz/LaKpAoCo2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045405, "uuid": "2ae59a0b-80ee-4c94-84d9-6f17be26685f", "value": 126981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045405, "uuid": "b3abce82-a7dd-47af-a624-b90b667c1544", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045405, "uuid": "fd33cfdb-39af-421e-8e57-fd86ee835a30", "value": "Info_76762.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08d7dc2-90ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617035720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035720, "uuid": "f0a2e2a1-ff47-48d7-85e4-98a572ed9b3e", "comment": "Malware payload", "value": "55c39b778b77e844b72496da42d697f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035720, "uuid": "ed50aacf-892e-4423-b3f6-dd7288cc8c91", "comment": "Malware payload", "value": "6a952520b6f29786b7a2dd3ac3875482f343f3305e0cf7c16daf0e2f2696a166", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035720, "uuid": "a2789c4c-d51f-4591-8dff-f55e16bed081", "comment": "Malware payload", "value": "2ee2b4314f0b3d35094d78315bb5f72054b6c388", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035720, "uuid": "e58c10c0-c86e-445c-960a-30fe0ecc5355", "comment": "Malware payload", "value": "586e870b5ec73d81ef39df307647bfe990f0a0d6c081f0c2d9bc7a0c9bf8672dac482dee77285322fd893b33268d3211", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035720, "uuid": "107fd2a5-e9e5-46ec-8bb1-39aedb8cc873", "value": "D2F2E1D860F8B024CB67429CCB9A6144E9F15F854A862B2C3755C308CF52DE2CE7DEAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035720, "uuid": "ba5ef657-3a40-427b-82cd-9cf163388987", "value": "768:YMttZmeyvwho1eRzU2GcwpDL/jji7twjuO5ZrvY8fi3qm:YMvZvawaeRN8L/jjMqvYKi6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617035720, "uuid": "43a9dc10-2585-40a8-aefa-1c697329ef07", "value": 34818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617035720, "uuid": "5acff1fc-b4bd-4748-a5fc-2196ee51a8a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035720, "uuid": "18c72fbe-d655-4d41-82c0-30599e1fdc86", "value": "prepared (97).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19c4f24-90e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617060659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060659, "uuid": "7db85124-94a0-47c0-b73e-23d993b92783", "comment": "Malware payload (BitRAT)", "value": "f4bfbd7c225361d810409f7a2c4d1680", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060659, "uuid": "17308168-9c89-4d39-839d-c736bb5b3d50", "comment": "Malware payload (BitRAT)", "value": "6b5e00fefc79d8345cc80d0507f4602b587aa41f1f193946c306e8388d8a90f9", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060659, "uuid": "d06336df-d346-44af-8179-d6095107e741", "comment": "Malware payload (BitRAT)", "value": "3cf42c5a1e12dea4bde69ad342e2742b875caa20", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060659, "uuid": "f87980ba-635e-4a32-8842-c64fbc3bdfd5", "comment": "Malware payload (BitRAT)", "value": "84e52a2fcf5c6b28617ccd6303cdff029155b866007b79bda28cadd3a027185865679b1b1e12f9e0bc3f51c6490ed277", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060659, "uuid": "f56e0278-aaed-4474-89a8-836082ecd30a", "value": "B2E59D5D3350B6DFC817CE7689681C20EB90B97AA30BE353945365EC9A2D997CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060659, "uuid": "0830d3a8-1390-44d5-9a57-2b4b24306d89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060659, "uuid": "f44fe207-efec-4039-a1ac-b630c2b3fe61", "value": "24576:6Yu8NUuSbuP6VLpWmO/hd7zFQjfuwRNFgz5VXgWQ4KxHHvCf2hhrwS26Udi4U+im:6NuaueAvCk5VwWQbkOR9VPwefyodo76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617060659, "uuid": "ea2f5e21-cba2-4f3e-bc28-a4198247effc", "value": 3149824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617060659, "uuid": "a7b60fb7-8421-4b81-8110-39bf0a8868ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060659, "uuid": "376caa0d-1bed-4ffc-ad08-58a13776a6f9", "value": "f4bfbd7c225361d810409f7a2c4d1680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd15472-906b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617007691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007691, "uuid": "68b4a2bb-08e5-4a2a-b3de-21c23fff0512", "comment": "Malware payload (SnakeKeylogger)", "value": "405f1608aba95649be45636356b7e179", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007691, "uuid": "d1ccdfb7-f5f1-474d-b348-c03f432b715c", "comment": "Malware payload (SnakeKeylogger)", "value": "6bb79f4c134faf7c6be2a7b478facb0b2bb370ffdda416cc733bc07d8939c743", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007691, "uuid": "3171ad9f-2930-41eb-813c-e68d0f82b64b", "comment": "Malware payload (SnakeKeylogger)", "value": "c9f3703445e9a3fb6a6ffac2c3efa7193bccc2a7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617007691, "uuid": "0de4a50b-9352-4c87-bd2f-f13bb9b97937", "comment": "Malware payload (SnakeKeylogger)", "value": "12b64e7c2df176a5e46195ed5c7723990108a8964335e8386c626a25d2227c962c4608e347a01b85021827c1de6ac067", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617007691, "uuid": "a5ad38cf-63a2-42a8-a8c7-0e1a61b31df0", "value": "0E45B37C2EF9C2C6C5350A7842C9C4B946E51FF2CF62866AF5D40FCBE121BC5A50A52B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617007691, "uuid": "8d755016-bef9-4e8d-86bf-4dabaecf7660", "value": "24576:dgMhltyulJ1fI20et7Y/FVMf/Xd4KWYjwL:Nyet0dIXd4CjwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617007691, "uuid": "168d9d3f-1caf-4638-acd1-8e7ac3285f5e", "value": 1185792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617007691, "uuid": "15f1975f-20f9-4cb9-8fe9-4d57c576061f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617007691, "uuid": "30221b52-e9bf-4276-b147-a93480d58b0d", "value": "Dringende RFQ_AP65425652_032421,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb56d924-90e4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617059763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617059763, "uuid": "e061046a-e4a5-409e-bffc-cc9ebd6866e4", "comment": "Malware payload", "value": "910fe72c4f1bd5a451561f732d94a8b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617059763, "uuid": "3752e5e2-12e0-4430-b0ab-5934387e1d05", "comment": "Malware payload", "value": "6beb4a5bcbdaf33f697eea6a4f7f2e9704cc88c20c265d0ce42287d930d06345", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617059763, "uuid": "ba141007-2abc-4bb6-9290-0e842e90a8db", "comment": "Malware payload", "value": "a93ebdd16c5862b178d6e5c58d3e074df772a021", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617059763, "uuid": "3f881e2b-ac59-4c16-abf8-f84bf41fdb21", "comment": "Malware payload", "value": "cfe44d2d77ad6f579ee64faf57bf23f5900c4857725d9a79bb120309f192271da8deda1aba064e8b15bdc84868735340", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617059763, "uuid": "5393d3bc-ad1e-444c-9eb2-1165cf2afba4", "value": "F6251201F9D1C8B2E0221532562A67626D3A7C205F159E7FF7E86D6DEE341C1A234BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617059763, "uuid": "c03f22a5-7629-4c06-911d-b478669b68e2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617059763, "uuid": "14550428-3671-4e2d-99dd-0401ebda8b32", "value": "24576:KNcBtkaXI+ASdfCsNHHbMz9r4gcIsl2PBSCKu6P:NZ68fL+R1sIX+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617059763, "uuid": "621fdcff-c2c7-4e50-bf19-9a4acbb79a1a", "value": 980255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617059763, "uuid": "466788c8-bcac-4a16-91fa-d3bf6b8e66d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617059763, "uuid": "cba0d906-2e34-462b-b7dd-6a7826fcc5a8", "value": "6beb4a5bcbdaf33f697eea6a4f7f2e9704cc88c20c265d0ce42287d930d06345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2048df3-905c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001336, "uuid": "53429c84-3710-4dd8-9223-3dcd5f3adf77", "comment": "Malware payload", "value": "0233f8db2e03d1d07de84c4303f17ff4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001336, "uuid": "c3c48ac5-89e0-44fc-a6fa-efd79207fe0b", "comment": "Malware payload", "value": "6c5f54c938e3ea503bbe6ad47c57327b3acb79d25b7977b5ac91abbb1ee8b7e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001336, "uuid": "5ab50c6c-7967-4bb2-8804-2078d1e88267", "comment": "Malware payload", "value": "b2191882fc0a27bfa555815a8f348cd933d931ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001336, "uuid": "271da61b-8cd6-4ff5-a25c-4a9a44d87d0b", "comment": "Malware payload", "value": "aa2b9a8aa514e9a28e4dc5883e82bb3c2b3b3165fdc471308c0f7d4718d3558a27334c47efecb6f7cdd5fee7eb38003d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001336, "uuid": "391c0037-6a08-4b02-9e0e-d883b45f8a89", "value": "DFA302B8F26C4F416ED6BC92287AD30D946B0CE3CAE7F635E461005A5E4EA475D1C3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001336, "uuid": "e37a09c5-3323-4c04-bf3d-88904c572f8d", "value": "3072:/isLZbn38ArcYtXfGvjYld9VOyGY09go6n:/iaZjprLBfR7Cgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001336, "uuid": "58398940-21ce-41f5-b451-37aa6213afb9", "value": 100044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001336, "uuid": "6cf8b116-d39a-4afe-9bc8-75afcd1e7925", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001336, "uuid": "e17cacac-a170-4744-9b17-a31d5ba7d914", "value": "DHL_document11022020680908911.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f583bb-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001720, "uuid": "ee9f2d1e-e74c-4c5a-a4b8-a90852f59522", "comment": "Malware payload", "value": "a585644a22db39d447d375c8727fd90e", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001720, "uuid": "652ca54d-ff4a-48c9-9dbb-61ed96187460", "comment": "Malware payload", "value": "6cb53f11cd0977599235f756ad6883050db78dab6936da5113729a61cd93036c", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001720, "uuid": "f77c2e76-1363-4ab1-83ca-f3402dc4533d", "comment": "Malware payload", "value": "020d9d391030864ee5edcacf0f419d788874f201", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001720, "uuid": "cea24dfe-07b2-4dae-b2af-bd89d697a33d", "comment": "Malware payload", "value": "db1847f67d34e162965b4493a38e9ddb6ff92ed32bcbb78c83195a9e755d5276abbbc9e6ce9b1238e71cfc82c06c8c4d", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001720, "uuid": "793bb00a-434c-4236-b9e1-e8d9792ad137", "value": "2575CF22B2A08437D07F1E74DD5FC1855936BD332E28A49736E93F0C1E7568E7A27292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001720, "uuid": "24f81e62-4a24-46b8-a734-19d83889c10b", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001720, "uuid": "f7b41bfa-e63f-4688-8de8-e2914003e243", "value": "24576:qIZg+uicrPO37fzH4A6haDzcUZEIdT9TagtzCNCkyxOQBHk4daI6GPTcRQ:qgkrPO37fzH4A6hanqNCtvBEnI6KAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001720, "uuid": "a1e3953d-54d1-4940-b0d4-69a51d643aa9", "value": 1635256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001720, "uuid": "2560ba0c-db5a-48ae-8030-321c3fb71995", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001720, "uuid": "52166ae3-d2a2-43b6-8fdd-e97ea4b305d2", "value": "6cb53f11cd0977599235f756ad6883050db78dab6936da5113729a61cd93036c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad19e23f-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040412, "uuid": "863d17dd-84ab-49d5-881f-54bb214b75d8", "comment": "Malware payload (Dridex)", "value": "b23370039d6ccb1f076a35c0c70759ba", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040412, "uuid": "c69c9f8d-76e9-4019-8731-c9df85cd58e7", "comment": "Malware payload (Dridex)", "value": "6cddb2343cc162702114e64b2dc1253f161256c3680b49d172b1734d4877a867", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040412, "uuid": "a4f1cceb-2a1a-4d70-9a61-4e4f4cba915f", "comment": "Malware payload (Dridex)", "value": "4d606ed74fb216e01c2e1799fef708bd7b891a7a", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040412, "uuid": "c22dd317-7a1f-4234-911c-d62b9621dafb", "comment": "Malware payload (Dridex)", "value": "1234e10a74654fd3a18fe5c3845d38fbe5d73761c108582b1d68694880ae3c67271d6794d7b27941dcaa22cefeb48445", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040412, "uuid": "652f7d8e-095b-4ece-9833-225d1aefb4fe", "value": "0DC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040412, "uuid": "9e04ec47-f3f9-4528-b61e-f986ba503bef", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040412, "uuid": "5dbc12a2-429d-491b-bca2-6473db8379df", "value": "12288:lt+D1yz/1SXpqDaoWmNsFNHk3eBWIcQd:lcA1aLoB+0eBjcQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040412, "uuid": "051bf6c9-5345-4ebe-b742-95c16994d837", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040412, "uuid": "b33d88e2-d63e-44e9-9bf0-68a792752ceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040412, "uuid": "37ff574d-1870-4c72-b944-3234fa3cf211", "value": "6cddb2343cc162702114e64b2dc1253f161256c3680b49d172b1734d4877a867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7916151-9073-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617011197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011197, "uuid": "4f25ee66-331f-44b6-8e7e-a0eafcaaf399", "comment": "Malware payload (AgentTesla)", "value": "3e038a494474c69a3859249d6beefe86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011197, "uuid": "34e3b26b-9913-4562-a6a9-856b4f37f329", "comment": "Malware payload (AgentTesla)", "value": "6d4c989d7385878d0f73a182c98bb4e64442a13181e05ca6ca69f414b1ffd108", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011197, "uuid": "2acc2c3f-bf6e-4e5c-927f-8642d362e0c9", "comment": "Malware payload (AgentTesla)", "value": "5b462d22b8e89ebba641eaff32a2c443ef9a7cbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011197, "uuid": "8fb503e5-ebd6-4abb-84a9-e6f2c3c1a98f", "comment": "Malware payload (AgentTesla)", "value": "e5f6fa5532fed5f5038db91dbe7206b8833e9ad900c67f7747f6a8f9b7885debe3397033f05e89fdbeaba6ad864c0d36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011197, "uuid": "296ac409-bd42-4fea-ae5a-b326e427dd83", "value": "0CF423BCC73EBBEE0AC7599DC15FB5A9E061006A423EC13CE9075B68375601EA2C356D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011197, "uuid": "b75dc92d-6577-4570-a7cd-b147e859b43c", "value": "12288:BNbfnUQiDstB1l29F3oRsJqzdDaE8EmSVB399ZVjWITKfKKtLxjjq/D9s:BNbvURnFYRsBg/ZV6Iefjxfq/D9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011197, "uuid": "afbd8ea0-0bc8-4f32-a194-1fe69ccdc4af", "value": 740624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011197, "uuid": "cdfd6d29-61b6-4f53-9100-e8d7e3e78486", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011197, "uuid": "5a2ef4e3-91f5-4f6b-8abe-1c8530110b04", "value": "MV ZENKEN MARU-CTM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb9d327-9072-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617010538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010538, "uuid": "cb77b9c6-0890-448f-a6f5-239900a50b5b", "comment": "Malware payload (AgentTesla)", "value": "d50e26fbf6ffd4e8fb7e31532d9dd534", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010538, "uuid": "6f70a25f-b3f1-477a-855f-29760f44606a", "comment": "Malware payload (AgentTesla)", "value": "6ecd98656c1324474306c74782aad1b0e2fb84fdaad1537aa261f6dac35045cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010538, "uuid": "bf38ba3f-6dce-4dae-a3a5-c0d3892470de", "comment": "Malware payload (AgentTesla)", "value": "2354e37c5b4438e20379a663fb014eb31dfdf804", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010538, "uuid": "6f693416-c27e-480e-abb2-4d29a2f695ff", "comment": "Malware payload (AgentTesla)", "value": "b44472f3e52861c48f283c78e7a7fe6c75fd1c54ae184281853de0a539663fb549a4a7359135359c56fddf7d18731c61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010538, "uuid": "169ac396-86d0-416d-88a6-bb5fb3737ce8", "value": "79454A4C1E99C2C6E2794BB881D9E49943F96EF38F22CC79BDD547CBC130B41E60A625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010538, "uuid": "73d49be9-12a4-461b-a243-c55d60c6b941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010538, "uuid": "63dda812-775c-414c-8a14-a3512971d8a0", "value": "12288:nqHNi3w3aTcfdz3190V2K0sXWAXEdjE+d0GzLHu9ixtpGSw7oFDG4KMipFjNs:nqHNduV2KXWjE+7fHBp86AF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617010538, "uuid": "9e3ffeaa-4050-4729-89f9-fe101ee4f1ac", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617010538, "uuid": "aac7c645-9347-438f-b4b7-6688ee780355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010538, "uuid": "938380d6-5c21-43ba-bae1-4d86b8df2691", "value": "SecuriteInfo.com.Trojan.PackedNET.576.11555.31225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1370d9e-9093-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617024957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024957, "uuid": "5c472e1f-9667-4caf-940e-083b650e87da", "comment": "Malware payload (Formbook)", "value": "e3b0d20cd210a3f6760dc4e4fb2bc092", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024957, "uuid": "10bd8bfb-00c4-491a-9720-42e89943ddd4", "comment": "Malware payload (Formbook)", "value": "6f452820b8a7f5bc46c27a7dd2a92736194f8e2d99f16e509c15a56313e2d738", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024957, "uuid": "7368a8f1-e2bf-472d-8008-29925ec5099c", "comment": "Malware payload (Formbook)", "value": "4e53437e1ff5222c176db1fff5c124afc90a8639", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024957, "uuid": "8a4c5c7a-4a7d-4993-b39d-095674363a01", "comment": "Malware payload (Formbook)", "value": "f0ee0169f09631b42b92f540933aa88282ad8a1ae3d5e7a9be8514108600e3ec41018e429111b072d5f96ecfcaf5ec8d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024957, "uuid": "8c1117be-7a1b-461a-bc8f-adfc831c96c3", "value": "6C5423FC566EF5D6941822315B506E3E7FC3A377054D6E980A93B0F8178F8066A03AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024957, "uuid": "925f8cd3-a5ea-450f-8c4a-48b05c38f2d3", "value": "6144:9A0eY/H1SdE8cSQ9/DU9MxpNvvw1+A5iCk7cmSF5TfUe3:9A0eY/IdE8cSQ9U9UNwAA5075SbUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024957, "uuid": "42d4beb7-08e0-40a3-ae04-6c0af76c6231", "value": 287578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024957, "uuid": "ad5212ef-60f6-46d9-bf73-b9326be009b3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024957, "uuid": "e8798306-024a-42e6-8013-674d3f6e428d", "value": "New Purchase Order GH934782GHY489330.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41923836-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028205, "uuid": "66e84fb2-5c1c-4be6-bf5a-2ec4d0329225", "comment": "Malware payload (Dridex)", "value": "114afb3dfe0901abc1e68863bae47609", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028205, "uuid": "3e132683-2976-4ebb-87b0-2f43b55d767a", "comment": "Malware payload (Dridex)", "value": "702a899940b53cf8249e0e585f0086e815c7da66c501e8dea0a468b8f834aeb8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028205, "uuid": "2e4acb9b-6031-4270-b8bb-51beb8c78094", "comment": "Malware payload (Dridex)", "value": "8403fd25510882f878b1e47dc1e2be75974e3566", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028205, "uuid": "c194b330-72aa-4694-bbc8-9f970e6a4b0b", "comment": "Malware payload (Dridex)", "value": "fd377fe8d5a711444193ffa8770be4e24b9a99b3bcb253ad272c7e67bdf2463cb7f63eb29e8a09f4c2ec9b4a70f6de8a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028205, "uuid": "8338be6b-e9f4-4639-b918-8ed0818bd1c1", "value": "EC14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028205, "uuid": "31dd43a9-b6f7-4546-b096-5b953ab33184", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028205, "uuid": "3ad972c8-e864-4a54-9669-9a9b9a30624a", "value": "3072:mpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:mBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028205, "uuid": "510a94f6-8dc6-4143-8d7d-e7f0c46cfe56", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028205, "uuid": "df1badc0-772a-4ec3-91cd-26a14278a3d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028205, "uuid": "a05bf9cd-32a0-4e08-83d1-d31cb0839650", "value": "702a899940b53cf8249e0e585f0086e815c7da66c501e8dea0a468b8f834aeb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3710b6-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028227, "uuid": "a0286a0e-e51d-440a-9438-8a422ebd4675", "comment": "Malware payload (Dridex)", "value": "48f75233dd65be0c9f4a309ca610e51c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028227, "uuid": "b76526d4-2b26-4162-b6ee-30b45dc6504f", "comment": "Malware payload (Dridex)", "value": "7062a15e9df914fae0fbfe94e8185b7b39a8a44158d99a9b1ad23fb999ac39b7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028227, "uuid": "bf96d50d-e917-4f87-9c14-1dcae53de704", "comment": "Malware payload (Dridex)", "value": "f621545b9fe8a551c3a0509d6694788029283b9c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028227, "uuid": "d3b74000-bc17-48a8-9248-21b9f3174172", "comment": "Malware payload (Dridex)", "value": "b7dd0ae6d002fdfdd65b37ee6e2fadf648c4fb18f453c00e94d9d9a2c0faa9bf88cc14892cb2d71908bbcee3d930cdc9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028227, "uuid": "29936e9c-ed63-4954-a5eb-0ec65c58960e", "value": "F314AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028227, "uuid": "aac9e83a-839b-44ab-a8c8-e733364678df", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028227, "uuid": "5c26ac3e-3551-4cc2-9019-0a1cd193b26a", "value": "3072:QpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:QBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028227, "uuid": "81afa0ee-437f-47a5-aa2d-a97d7e4a1132", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028227, "uuid": "3c6bab9e-ff82-4380-837e-deb864ebc6aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028227, "uuid": "cf468817-cae8-43b1-8ded-3fe8e5266092", "value": "7062a15e9df914fae0fbfe94e8185b7b39a8a44158d99a9b1ad23fb999ac39b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba6d2b0-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617032142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032142, "uuid": "583e6560-7090-4689-8e1e-872a1d07ada3", "comment": "Malware payload (AgentTesla)", "value": "20647f3adee1ad64a685816f1ad9cce9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032142, "uuid": "d3bd13e9-376d-40ee-bea2-e2cd1d709469", "comment": "Malware payload (AgentTesla)", "value": "709f95b9c2fe1db214a46c8100e8fe1cd43775df2ef3ca8253e6eb27aa628037", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032142, "uuid": "de5c30dc-3c4a-4193-8f77-035ce58da417", "comment": "Malware payload (AgentTesla)", "value": "a4d68652c31de1c575d330810d8c8267c942be8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032142, "uuid": "d9f78ed0-2310-4473-8e41-1c8091c853da", "comment": "Malware payload (AgentTesla)", "value": "6ea4fb79c890935d5cc3610ac90fd4b3a7a2710bf65a595b98d675b929fe431cbeb69c6fbdabb88505ee6e5611035757", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032142, "uuid": "6dd77ea7-73e2-4221-bb0f-1b278b2a5e19", "value": "EC35F69224ECC790E425AFECD82B97F23796DD57D740E74738ACE8862567B8AC50240F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032142, "uuid": "71fb6827-d1d7-4733-a314-0e2d0f3ecc88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032142, "uuid": "70a334b4-f526-4670-a92d-be6038876f65", "value": "24576:PARftv0F8F/7/F95B8dCZ0auWDw+whkJU:yty8F59/8dSGmw+YsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032142, "uuid": "ba2e02e5-ed4b-4175-81f0-34f14cc8502b", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032142, "uuid": "a5a8fad2-ba33-4c26-8c6d-48a3d2f53dfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032142, "uuid": "29850584-7928-4e26-b4fc-2bf40b8e6313", "value": "2021249500-1274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff4d320-90c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617046859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046859, "uuid": "09a5cbbe-0985-4fbf-85af-6194e89a0174", "comment": "Malware payload (Dridex)", "value": "2ecdeb0a27d1d34396d672d74a7e51cc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046859, "uuid": "60770678-5851-4672-9bd8-1853efc8e216", "comment": "Malware payload (Dridex)", "value": "70a528592328bbaf45e98986619d269ea57c9cc606600a6d9af096e0f09f1991", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046859, "uuid": "7f3ce27d-82f3-46cd-8423-30863c9f2657", "comment": "Malware payload (Dridex)", "value": "b073175e35435daaa5c12f7e293138b1d9335e16", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046859, "uuid": "6c38b4fa-997c-4bb1-9eb8-d5a2781553b0", "comment": "Malware payload (Dridex)", "value": "a00d90c4ca849a6d8a05411aa868bdefe3634f28cc851a9001ef0d620fd138aa276222eb18632b2ec8f8c00cd09c594c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046859, "uuid": "4442ac70-7ab6-4924-a2ab-f1fbd5393c3d", "value": "2E14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046859, "uuid": "f5d2d4a3-ace9-4628-b647-c56e1b23e591", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046859, "uuid": "74d21a54-54bf-4042-9a0b-362084df5f1d", "value": "3072:91i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Pi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617046859, "uuid": "8915bd68-bd83-4e60-b1f7-b794746a2384", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617046859, "uuid": "77a912cb-b555-4c61-8529-001ecc7200f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046859, "uuid": "1c15d352-2465-4655-86f9-53d49a5f1fb1", "value": "70a528592328bbaf45e98986619d269ea57c9cc606600a6d9af096e0f09f1991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0630165f-906e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617008778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008778, "uuid": "f8bdf265-2bc2-48d0-8fc3-7016df5ff959", "comment": "Malware payload", "value": "b82c21c3cd01ecb07c872d4aad310b19", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008778, "uuid": "5423fc36-ef60-4527-9fe6-01d84cdbe3b0", "comment": "Malware payload", "value": "70b0aa28b3bf1ee1d7fa2d07dd61abf0509dcfca81e231b67a276fb6b2b04ccd", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008778, "uuid": "417c0ff0-483d-4906-8222-63b9432fe0f3", "comment": "Malware payload", "value": "a8f9dbea0ad27751bd651bbf66a9759e1944336c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617008778, "uuid": "986cc7b0-6ad0-4b37-a14e-33635df8b366", "comment": "Malware payload", "value": "86c7168e45b77b0b15e65ae61fc2574b9b0eaa06725ac9f3a99e5cb6c4e12153081409dc54a8864b392f0760c24be807", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617008778, "uuid": "45e77786-d744-4513-ab81-9dd91a612115", "value": "9DA53912BCE604BAC57EF130859697237A323869433377872EC86DA91A75FE46F2D311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617008778, "uuid": "6eef75c3-514e-43fa-871d-ed5f49f2cbb7", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617008778, "uuid": "29b7a8ef-3b30-4dc2-9a40-290833de103c", "value": "24576:xIXhYy70InAYNv2vqe7uS5zbvM0Hd9Tl22Ad9j1G8Ck7oL5P:xahF70InAwviqd8zbv/H5EljCmoL5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617008778, "uuid": "3d700e4c-0373-4ac8-b97d-c6e8f040b659", "value": 2155152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617008778, "uuid": "072faec2-0141-4bcd-bd5f-04ef28239107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617008778, "uuid": "442ce457-b0df-495f-a1b6-003fd5daecbd", "value": "70b0aa28b3bf1ee1d7fa2d07dd61abf0509dcfca81e231b67a276fb6b2b04ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85b0a3b-90a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617030606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030606, "uuid": "4dc21f50-15f2-4caf-b237-fe165fcc8462", "comment": "Malware payload (Loki)", "value": "33502beee733ebd8de79128a1c119fc2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030606, "uuid": "e5ebe1fb-9560-4b07-8977-bb0e465484fd", "comment": "Malware payload (Loki)", "value": "71c698b7b196d7ddd79497a5bba5bea8c6921669aa61012398ba31e666fd4d1c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030606, "uuid": "8b3af81e-578d-49d5-ba58-f70606c58645", "comment": "Malware payload (Loki)", "value": "ee0c219408bee3ac854d02d8b17d16bd3f773f01", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030606, "uuid": "6bfe97fd-d593-4427-8a7c-c7bd5876b723", "comment": "Malware payload (Loki)", "value": "c3436d76b520bfe70808e4c61985d12a76eaf190363cc31299099738977cf369338c6d150a1426aa08977435b4c05da5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030606, "uuid": "24926f29-ab4f-47d6-98c0-7ee6f1819adf", "value": "41E401083221BD5EC62F8DBB88972C509B70517B950BF3836CD726FE654DB8A8B41763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030606, "uuid": "ddd04bc9-7013-4937-8361-9fa3b6456ab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030606, "uuid": "10d436e7-5c7a-4d22-9835-ab55e7c33cdc", "value": "12288:x9ucS0k4r7cC5c549akoQekq1BEm0MC23//STH8hsgxy:x9un03rjc5+akoYm0MC23//schE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030606, "uuid": "fceb0562-54b5-4146-8965-4240a8333a6d", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030606, "uuid": "0716ad84-86a4-4832-9b97-b5ddc1f90f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030606, "uuid": "a171f804-9d92-4a88-a967-21b98d6d7cc3", "value": "p.o24032021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e869cb94-90bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617042659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042659, "uuid": "e4a61633-44b8-4b24-9783-0c607ff44234", "comment": "Malware payload (BitRAT)", "value": "0a3408b4eb840ecd8db1239304ea35c3", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042659, "uuid": "69e81441-c699-4dd8-8d13-20949a457eaf", "comment": "Malware payload (BitRAT)", "value": "725422976036f66aadde06633c41bc88fa4f55020051b22a644ee6668a3f7c31", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042659, "uuid": "9de1874e-0dd4-4b9c-80df-4e98b736b20e", "comment": "Malware payload (BitRAT)", "value": "70799d33a13e77b0ed4708f610b948402f042805", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042659, "uuid": "37f36181-d8bc-4c58-9b3a-6638fb0908bf", "comment": "Malware payload (BitRAT)", "value": "c1a48cc2b2bece2f6476c3b415e8396ad3c48a84cb7f802759ae41fdf711fe1b18dc3ce5bf354bfc95973c2b12f55d69", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042659, "uuid": "02a6888d-44d7-4051-b4f5-c1db7826d85d", "value": "2273CAE8DD5904FBF5FCFA748787250E6A71AC379611892B8986C1C3C8CE7426CD096E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042659, "uuid": "240ae66d-8810-4087-a28d-485dd680db43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042659, "uuid": "a67ba06f-9678-432c-b829-26766a730bce", "value": "1536:KW8dpdtldNBtJ5NCwppBTVX3xzzhFX0h1Y/LPrw1:KW8dpdtldNBtJ5NCwpptVX39zhFX00PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042659, "uuid": "9ef54b0f-2f8e-4d43-9bc0-b6404d147b82", "value": 76456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042659, "uuid": "a30e86c3-03c1-4d13-a93b-47113b46f03e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042659, "uuid": "e7b77e6e-5065-4182-8c75-6e9acc9d92cc", "value": "0a3408b4eb840ecd8db1239304ea35c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774c4aec-90ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617035168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035168, "uuid": "e715ac31-54e5-4520-af48-cefb2568135a", "comment": "Malware payload", "value": "1a6ce674162447c8e68ea6df63df1c0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035168, "uuid": "1088e5d2-23c4-4fc2-b270-be7c6b1e689c", "comment": "Malware payload", "value": "73a58087985cf95fd2f88b8305ea88a5aa1b5d9020c801f73fa434d2842f735a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035168, "uuid": "8f2d7653-6941-46e3-97e8-27e4a05b2569", "comment": "Malware payload", "value": "b7cbd6fe0476b3ccac79d1c618b00d5492a83695", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035168, "uuid": "087dc2aa-7d46-4dfa-9dad-17fedb607501", "comment": "Malware payload", "value": "b4921c8e34aba2dd8571421979c25403f43ba37a98b0de0d27727e4c6bb37d986da32d60053ea970113fa8f364fb832c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035168, "uuid": "0cd6db22-a140-468e-9535-2fcb51395f13", "value": "C4B3A482E590CCB5EB66CA7586E0F6680C67AD601DD156C3ACCD724CCB736CAA46CF07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035168, "uuid": "7541136e-e52b-417f-823c-54e71d75579d", "value": "3072:7Em/JqVVjKPVI0UiCiMiBha0IvFUX+tfP/:7Em/gtiCiMiB40IvFUX+tfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617035168, "uuid": "b364934f-b501-4295-b12d-810f625092b8", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617035168, "uuid": "89116f1b-1736-4c5b-9327-1733a5878d53", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035168, "uuid": "e40d1fb1-468a-484c-b15b-64af84eb5038", "value": "SecuriteInfo.com.PWS-FCWQCBA6E5A97FB8.16496.8466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c6e1ea-9091-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617023963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023963, "uuid": "7a5c4560-4af6-4bd2-8d52-ad216ab107c8", "comment": "Malware payload (AgentTesla)", "value": "4e5743de8ba7dcf0ac67060da79e6d4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023963, "uuid": "3cf3771f-5f3e-412b-985e-71a5c42b162d", "comment": "Malware payload (AgentTesla)", "value": "73b77bdd8bc6a9970ee92c82221d492a3fa91db8c1ccd09c48fcf732c81f459f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023963, "uuid": "c1f2d987-bba9-43d9-83db-7678294a430d", "comment": "Malware payload (AgentTesla)", "value": "fd3aadbe99baf4e343761ccf7b2731b917fc50ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023963, "uuid": "1042fc3b-c1fe-4d79-9d54-e168262232bf", "comment": "Malware payload (AgentTesla)", "value": "cce0f217eff86ba8ff64773d26ffb5062aa51b2a6a6876f0669acb8adf195117fffee803ff3ced11ec19a0d92f6071cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617023963, "uuid": "fcfff15a-2b00-4591-b6a0-6093435cb123", "value": "2845E48630ACE196D016ADBCC85BD7F33396DCAB8B41E74330ACF55A646B79AC51340B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617023963, "uuid": "2c7f0a3d-8f66-4388-983a-693a1aa3af11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617023963, "uuid": "0248be8d-60e5-4223-8503-0f4bb3f87407", "value": "12288:lCch2qSWRn6FpFw1lq0N/4Rc2/vlGca97GiGy/U4YkdT0Da3bR3:lKqXPAcqtg9qiG4CkWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617023963, "uuid": "c939f3e9-1574-4fc2-8b46-cc0dc81acd57", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617023963, "uuid": "3fe99d0c-b520-41f1-a85c-621c8a6ab1ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617023963, "uuid": "96d52a44-cba6-4015-95a9-92d90497dfad", "value": "MZE1fH3FADpILLo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9f2b95-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617031631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031631, "uuid": "f8876c73-fa3b-4790-9bbc-b6a344e1c061", "comment": "Malware payload (Dridex)", "value": "54fabe6ffce1ec0db98f36bffed67931", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031631, "uuid": "66aa2474-6b87-40d4-8983-c8dd7f7ba7ff", "comment": "Malware payload (Dridex)", "value": "73e36fd3121551d514b5169395343656423fab39a6ccefa04156745e37e97f8e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031631, "uuid": "1b631106-4a2f-4baf-9e94-4c3e44eb9956", "comment": "Malware payload (Dridex)", "value": "71f94d0c68004e3b49d9b006a0fdc0c49c9816e5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031631, "uuid": "125b0b11-15cd-42bc-8ed4-a9209b592e12", "comment": "Malware payload (Dridex)", "value": "ca4b39f859b1db61375efd8b0474af41fbbdbd5d1569a64350a0cc8722039f5d2f404a6b2e54975909564fd91a5135c8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031631, "uuid": "09b3b54e-faf0-43cb-b3d8-72a3d1b2dc2d", "value": "4114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031631, "uuid": "79351333-ebec-4a55-a501-2e82d209c2ee", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031631, "uuid": "560ee6d4-7fa2-47f1-891c-96c88d1cc5c4", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031631, "uuid": "42162f90-e2f3-444a-92d9-3c5a24d345ce", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031631, "uuid": "cf86565b-0534-4b7e-8a0e-4fe6aab141fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031631, "uuid": "8eb880a9-129d-48bf-9c04-e74a28104c04", "value": "73e36fd3121551d514b5169395343656423fab39a6ccefa04156745e37e97f8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac57abb-90e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazarCall)", "timestamp": 1617061641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061641, "uuid": "675fee0f-afbb-4ebc-b92d-32a6e80a90dd", "comment": "Malware payload (BazarCall)", "value": "6db26c9db14987acb16fa21fbc499525", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061641, "uuid": "484c0110-96ad-49cb-ab6b-a2f5ed4ce419", "comment": "Malware payload (BazarCall)", "value": "74da3ea957d693096779aceac7a1bd3ec775291606df62429f73e8a9d9cec682", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061641, "uuid": "641dc7ec-599e-4b9d-b8a5-c42d010730cf", "comment": "Malware payload (BazarCall)", "value": "578a9bc62b108f3e51267cb1765e4b2f01d95383", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061641, "uuid": "ce4c5b5d-8b55-47d3-8620-98c106e5f183", "comment": "Malware payload (BazarCall)", "value": "520ec0c9817b901a552e8c7a9e1249fddc42325fb7f76f45b3e34f4329d0105016f405411972c7f6c4a8453806b749b8", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061641, "uuid": "f0c3b13f-9748-4d92-9fee-b71790ac5f41", "value": "7744AFB875043CD6D67E567BCA96BDDD23B63722898BA8CD8064BBC30563731FE06805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061641, "uuid": "05216257-a0af-49e2-8644-1bc420d81fd5", "value": "042fc167bd0ac3b1819d7ffa36bc5920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061641, "uuid": "626e9be7-5857-434a-a8a7-2243f6b09b39", "value": "6144:C+Bpo9r5nwIa3DF6W2Kl2cxa9u/jfjMj6Idw3CDuiKB:XBpozni3D4s23aQ5WCuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617061641, "uuid": "eeb46a44-d503-4f59-a74c-cdeba0ea3d1a", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617061641, "uuid": "98049518-d8ab-4e5d-a064-db5dfc0ad73b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061641, "uuid": "a4b8fb63-8715-4f02-a9aa-f50bbc4b4da7", "value": "SecuriteInfo.com.Trojan.Win32.Wacatac.Bml.27845.2130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d0bab6-90c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617046164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046164, "uuid": "876625fe-e816-4990-aa97-c900f9f07372", "comment": "Malware payload (AgentTesla)", "value": "be0dcbb35189fb74f54022416bef2d88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046164, "uuid": "4d11fefe-df1c-4d99-886e-53ad3d8ff5c8", "comment": "Malware payload (AgentTesla)", "value": "754bfeeafeb14206fb725fa6da67561c5e4886b9255444cc5648f28babbed7e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046164, "uuid": "0e238627-15d4-45dd-8c67-e6ef89f4f554", "comment": "Malware payload (AgentTesla)", "value": "35b26b75004ce47cb7833e34f52c2c125e39c9b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046164, "uuid": "c232edb3-2d83-46b4-8f45-58ce3993c8d2", "comment": "Malware payload (AgentTesla)", "value": "5b276e58e645f60bd2c829b87751669d19b83ae45a30a7106d5e569597e27aa27f50018150f89e8a14ff7dd675c74010", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046164, "uuid": "b7ec814b-f32f-4ad9-9e9d-231ddf01e2f2", "value": "5CF433039D3B669E3921C76064A2EF91443BD4A77E9DC69102E180D6DCB3337B1E4F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046164, "uuid": "0d960013-3fa2-4e81-a106-5f670b4b8014", "value": "12288:YY9PDP2GjhBYiJQ0A+DwDu9wHoPJCrtqmB4fkyvyYJLPj6oosSXl/9RfeQtKME/:YEjpHYiJQTTuC7rcm+tnJLb6v3188KMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617046164, "uuid": "6ff074e4-7022-4e92-844d-dc9163ded81b", "value": 787499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617046164, "uuid": "37ae6699-a642-4040-9733-b380576a4146", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046164, "uuid": "d0941532-3cfb-45d6-a282-f7f9c6623669", "value": "PO#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e32cf2-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616997629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997629, "uuid": "01f1ec1a-c5cd-41fa-9383-41aa76077f82", "comment": "Malware payload (Formbook)", "value": "1b77ec38b612a2734b33d101ea92e676", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GodDaddy", "colour": "#2DA5F7", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997629, "uuid": "2d27f045-63f6-4dd0-ae4b-c87ad4a36336", "comment": "Malware payload (Formbook)", "value": "76011888566667e16bacb81e69b80201ff093568c3b4f6c53b74d3b8a523438b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GodDaddy", "colour": "#2DA5F7", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997629, "uuid": "e5f101fa-24a0-4467-b821-706b7fdf37a5", "comment": "Malware payload (Formbook)", "value": "57c8b59173176acdace1ba89f8c50dc82eaa1076", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GodDaddy", "colour": "#2DA5F7", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997629, "uuid": "67353851-dba3-4a83-b679-0d4f8b7efc1d", "comment": "Malware payload (Formbook)", "value": "501a202e4aa35ba0d6ee8f9896567e5cccb1d02986ca665514a612951d293d36b46c6de51e6df8415bb117668da52e4b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GodDaddy", "colour": "#2DA5F7", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997629, "uuid": "21ab9156-af64-4437-902b-180f77281915", "value": "B9C5331B76A3BE5AD0AEEE3C845755FC02134D54B834F912268E7B5B31B7038D392B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997629, "uuid": "e5b5fbea-2ad1-4113-b737-93a9b5d4bb6f", "value": "49152:451S42fRCZvdyfpvQ2KefkDkHY8xE+pP9Tv9Naw0Yej3hZOkfoomeWcfPVtQZ:i1S42J4kYykDKTEMTvn4bjxZOAjXnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997629, "uuid": "a55eda20-22f2-4ddc-a779-a3aa700217a4", "value": 2675712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997629, "uuid": "51229db2-68c7-4521-a8ad-a7f75e5d4825", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997629, "uuid": "9460e19a-556c-482d-9a58-17c537c7c5ac", "value": "50729032021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e539ba-9096-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1617025978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025978, "uuid": "83281cb9-9ce9-4ebe-bad4-7ac5053ec067", "comment": "Malware payload (CryptBot)", "value": "c64c77ce0a7548d644d3d79ec798bdf9", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025978, "uuid": "c106f298-69b7-42ae-9839-f12c8aae7f34", "comment": "Malware payload (CryptBot)", "value": "76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025978, "uuid": "3b0d90be-0729-4bf1-8298-dd8ef0ae9d5d", "comment": "Malware payload (CryptBot)", "value": "e97629c48229194c49ccbf08ac765afaf4740bfa", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025978, "uuid": "5ab9d914-c8c2-4555-a0e9-16af48d1b142", "comment": "Malware payload (CryptBot)", "value": "c4bdae44a4993bc0f22d96aca69db93668eebb00f47f5fe923d21ec014ea53237fe6a031d29ca541a26c9b0b8abbed85", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025978, "uuid": "8f5162e1-dd50-495a-98f0-a59b1eee9a16", "value": "8ED41221F5E2C033E54219754821D2B28D76FC765B316BC737943B6A9E3A2E38B32356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025978, "uuid": "fb41ef6d-f138-44a5-aa87-865d00249a02", "value": "2303a211a700e7d2299a8174d4e0e2e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025978, "uuid": "d641e3df-5745-4878-ab58-6955df747dd1", "value": "12288:IpNxwKT5fFRtD17qMMMmKKayotBZnFKDA20l37pv/KmyxmCGQDTVSXuzmzHub:Ifft17bjtrn8DA2k37pvSlGQDTVS+qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025978, "uuid": "435a4860-62e4-4790-a338-124d23e64110", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025978, "uuid": "2d0bc952-b6a3-451b-82c9-7a2152769454", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025978, "uuid": "a57cadac-2650-46cf-a429-8406bef4bb1d", "value": "c64c77ce0a7548d644d3d79ec798bdf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818a3c35-9087-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617019723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019723, "uuid": "aa8ee8a9-f04c-4a47-b58f-da43bc43d9e6", "comment": "Malware payload (Formbook)", "value": "1ff5a823ad5e7fe5c927a0e43029e804", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019723, "uuid": "dd016542-5dcc-417d-b474-387112dbfc79", "comment": "Malware payload (Formbook)", "value": "76dbacbb966b263ae5f6ef1022c1358d2c71c2069f0576eeaa084f42e5adaf33", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019723, "uuid": "c36602d3-4147-40e3-bc14-b5d6d9d25104", "comment": "Malware payload (Formbook)", "value": "8ed7bf677279d209633a587026929fd97c5f32bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019723, "uuid": "3db34c58-880b-407c-aec3-fdbbd4d91478", "comment": "Malware payload (Formbook)", "value": "10c03b7f6cca88030ec5b0095a7509d8c0eafbd702ebe5c0f7e791c58d11af1c04604de9ab8b8f749f7c1218e42be667", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617019723, "uuid": "64dfe40c-c638-49b9-a35f-1146712f6f42", "value": "BC25809124ECCD90D061ADB8CD5BDFF237168DA38790D7E636BCE4762573B9AD00242A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617019723, "uuid": "ec30be3f-0f2a-4816-8645-15ff99521dd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617019723, "uuid": "62aab405-1d31-4fc1-8a39-1b0c7abafc50", "value": "12288:qf6vqR1MKtQhcK52ntvE8Q0bnwAAjzZit4tI50:FdadntvEf0bnw3JY4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617019723, "uuid": "f4cb8698-4d2a-4dd5-b576-92869cc0d123", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617019723, "uuid": "0cb5bc85-027e-4f94-a588-04e5d773d456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617019723, "uuid": "c301d4ce-54e8-47d7-b283-ec8524271849", "value": "PO6543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e07575-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616997802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997802, "uuid": "76ad1057-8cfb-4036-a872-86944a196194", "comment": "Malware payload", "value": "04da7631314ccc8ebfae3b76e75e359e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997802, "uuid": "2e8a78dc-a74a-4fce-992f-4ecca06c043a", "comment": "Malware payload", "value": "7831d04c2d11df369d8c3dda50277a00b4bc798f0a4725faf234597e6a0d29c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997802, "uuid": "9a1c9ca2-d971-4366-998d-465cb7fbad70", "comment": "Malware payload", "value": "9276c5dadab815594192af0cbe36e591b8b7d811", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997802, "uuid": "942746c3-5d78-46c7-bc8f-6cd6e8688348", "comment": "Malware payload", "value": "16380b61a0cef67e64ba391b00b31f1d7dcfd4a56992b2708d1bc90928cc6f67ea7d88942943e09d119b0077178b7bdc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997802, "uuid": "8b202306-69d5-463e-971c-6b4d6de5476c", "value": "DF3733B8215833ACC46ECA749433BC44B3B8552D4DD7AAEE75C677807FE6620C847B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997802, "uuid": "97c60b40-23a5-4d2d-8709-fa1bc1db8468", "value": "69fae9604d8dbdf910c547b8bcd38884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997802, "uuid": "ab2b47a2-7084-4863-802a-401e9bd916be", "value": "393216:jDokqP3rHtoBAzK8BZ9lNwItV60tznbm9meWJsxFIpYj6VIf6g1PF7nac/tYQQ:jDM3TFztBV2qEWJ2FIY6u6gn7nxtYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997802, "uuid": "fb8ce115-aada-4673-b6fb-bb8fa5974c21", "value": 24148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997802, "uuid": "2cb0c830-ceaf-4816-bec2-8b952e12d903", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997802, "uuid": "92f25815-6d84-4cd9-9649-ca8ebaa7993b", "value": "t-rex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9938cafc-90c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617047250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047250, "uuid": "7f8a60d2-1d64-4f6e-a5a1-191cd8a03e49", "comment": "Malware payload (Dridex)", "value": "538ec258e88dd53cb7f1e97936f4c9b9", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047250, "uuid": "47d8e027-5ad7-412b-9bef-c7182cfd332e", "comment": "Malware payload (Dridex)", "value": "789f92b081d548f76d7a8e20876a4039b4fb142ef53c2ab75bb94d8051ca8290", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047250, "uuid": "b783d1a0-a73c-4a4a-9af3-fda77c8d56f0", "comment": "Malware payload (Dridex)", "value": "d4d65711a731dec511c74e3500668c0430e00a8f", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047250, "uuid": "a63d43a7-e769-484f-8a77-4e1ea082e985", "comment": "Malware payload (Dridex)", "value": "04532566d160b6569f4e800266a2f56e6abdb87044744f418f72412253d956f1ac3c1d293051a07a686d6b0fb96bea4b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047250, "uuid": "8a0dca39-aca8-4e72-8948-3fc23e5c7b99", "value": "2FC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047250, "uuid": "478aff6c-3fbc-4fdd-afbe-80b7f851de27", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047250, "uuid": "eae2b588-4ffa-450e-8498-9dcb160bd0d3", "value": "12288:Bt+D1yz/1SXpqDaoWmIsFlHk3eBWIcFd:BcA1aLoBP8eBjcFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617047250, "uuid": "e1c0c541-cc84-42ab-b70b-dae516a984ba", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617047250, "uuid": "95c3522a-2d25-4315-8efb-4da1feea8ceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047250, "uuid": "efe3d901-0eb0-4e9d-8622-3ef74e1c4d50", "value": "789f92b081d548f76d7a8e20876a4039b4fb142ef53c2ab75bb94d8051ca8290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8a1a9f-90c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617045028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045028, "uuid": "c050c595-4ca1-44fd-ab51-932f60159d5f", "comment": "Malware payload (Dridex)", "value": "bd4f52581f43477b31a387ed0b6a5684", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045028, "uuid": "73eca5a1-7893-4751-99a2-8924a2fc2853", "comment": "Malware payload (Dridex)", "value": "78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045028, "uuid": "e7573c34-b4fa-4cd7-9784-ace687bca046", "comment": "Malware payload (Dridex)", "value": "9e521d41d91082242aa811c8d4fb65bc8efdc8fc", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045028, "uuid": "855be411-0ba4-4c58-be49-5b910fa3a3b5", "comment": "Malware payload (Dridex)", "value": "b2f4209e2d7e1916f5030407499f3db0caa15456b3f537c436e540b270de9f98434fbce34e00beb977759eccdab55519", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045028, "uuid": "aef4f903-5bd4-4e35-a4ab-41bfaeb1b8c7", "value": "F984D01367D15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045028, "uuid": "48bca479-78b0-48d5-a072-d4c8dcc26439", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045028, "uuid": "0d1ea4e6-c55c-4dd5-9c0c-1c94c9165a73", "value": "6144:0bazNBbycfmKsyUlV6MdUFIk1KyHNwoAtpFp5xM6C1h:fzeTlV6/7HN+p5W6Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045028, "uuid": "f55d6cd9-9788-4ffe-a623-e00d15d15db9", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045028, "uuid": "4ba3c6ad-510d-4fdb-bf23-1b2dc006d681", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045028, "uuid": "424af5fa-1da7-47e3-a81e-808a83920978", "value": "78f9c1f6ae02832ac63c6697f6089cc903119a206e7388bb662f02985fee3127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fa4e4e-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "5081f937-c261-45cc-97dd-08964d46319c", "comment": "Malware payload (Dridex)", "value": "f2ca9a71f2f1dbb1edc8c26f6de4d278", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "5c82f7a4-294b-4beb-92ab-bfb1709004e2", "comment": "Malware payload (Dridex)", "value": "7a5504cf62463ceec889bf1fe61534c926998a5c3e2062fef0d2d7040e072d98", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "ffa36c05-8e59-4bf7-874c-53900482d3c1", "comment": "Malware payload (Dridex)", "value": "6bc1837546f31ca41c007f58c224ff4a467a418b", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033347, "uuid": "2e5d26c0-7882-43be-9f9b-d2a1924cdbe3", "comment": "Malware payload (Dridex)", "value": "fa86a9637433e3e9022ebaba28ab95fca57f54f4c59aecf8152554cd14e864cd7174599852da20cc30a2fa9a517b0c57", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "215e1d76-a7ee-4b62-8365-e064aaec0080", "value": "F684D01367D15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "612788ae-570c-4a31-8e40-81b8cdf3a798", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "f3c04a4f-2c4c-42ed-91e4-b9c15e8f5a67", "value": "6144:dbazNBbycfmKsyUlVHMdUFIk1KyHNwoAxpFp5xMBC1h:QzeTlVH/7HNep5WBUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033347, "uuid": "c6e08519-9d99-4b53-9db5-eee0ab7c44e4", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033347, "uuid": "361c35e0-03bf-41f8-a9eb-27deb3b294d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033347, "uuid": "a9892170-518d-4214-b124-e79074a294a0", "value": "7a5504cf62463ceec889bf1fe61534c926998a5c3e2062fef0d2d7040e072d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe6be7f-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040416, "uuid": "9c7bfe19-1b0d-41e0-ad93-64b92bc7d8c3", "comment": "Malware payload (Dridex)", "value": "072e3fad030e7dd10c69c0bb2d0be96d", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040416, "uuid": "192f6c2b-762b-4f40-bdaf-1846490c9bd3", "comment": "Malware payload (Dridex)", "value": "7a73964d7ecda75e7eabade839d6b3c2d230148191cf8496e8b099974fa2d23f", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040416, "uuid": "2a0b6ef1-d581-4bf0-8002-ca33e93ed41d", "comment": "Malware payload (Dridex)", "value": "73706ddc0d7836de43bd5eed4a8b8e3ea56aa532", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040416, "uuid": "a3f8b1f1-7ab2-476e-a2b7-10171209f49c", "comment": "Malware payload (Dridex)", "value": "8d9367382004a742d88731b1a2db6e6c4d19f195a401f815d3e57f78025452b5a13842e269b04b22f2244dfcd9768fff", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040416, "uuid": "80a4e3c5-4d83-4afb-868e-61ad58d3a031", "value": "C8C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040416, "uuid": "e1dac0aa-ccbb-4fa2-89bd-fba42c255c08", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040416, "uuid": "4d6dcd99-d189-4e27-ad1f-d0a1345ba41a", "value": "12288:Ft+D1yz/1SXpqDaoWmPsF9Hk3eBWIc1d:FcA1aLoBEMeBjc1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040416, "uuid": "27f2d75a-e069-4a4b-ae66-73111ac09901", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040416, "uuid": "38afd9f0-f9cc-4089-8aba-70c704306db1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040416, "uuid": "141b0ad5-ecde-4f67-b886-e88cdc92fb25", "value": "7a73964d7ecda75e7eabade839d6b3c2d230148191cf8496e8b099974fa2d23f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc64062-908b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617021330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021330, "uuid": "cfd47cb4-3176-4681-911c-5fa51e22d5ee", "comment": "Malware payload", "value": "7b3143110f469779135246b0142e53b3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021330, "uuid": "74762824-7d52-4939-a99b-748281197271", "comment": "Malware payload", "value": "7b552339590645187d01a69a7c3f6d7dcc40d59cf0d7c59bb220a6e8bb7f1e0f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021330, "uuid": "facd9208-9674-4628-97de-359d0d3deca9", "comment": "Malware payload", "value": "dba41003d56f47b57b6788a8a3b3fb14c82d7dfc", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021330, "uuid": "f578e970-5c36-471c-840f-54f171352c9e", "comment": "Malware payload", "value": "4acb13689fff025a749728113599d6a2e33ad885b3c886f2ab5bf85a92cab3b6385323b246fbbef42f30699ef36f57b5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021330, "uuid": "76ae8186-52ae-4256-9ca6-f75987873c39", "value": "FF73CF1BED418D83EA28C3B9BF070FCD9B09335D15557AF911A24ECA7F8114A0DAE05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021330, "uuid": "cb96eb1e-17f8-46da-a859-4742df8bde41", "value": "1536:DlxGP/UQbgQywBGmkla+bsaCaWyVvXmkXwhH6:Bc31gQxFklapalZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617021330, "uuid": "70efbdf6-3706-4b46-b641-0c0e88b5302c", "value": 75572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617021330, "uuid": "177209ba-bfe8-4bb1-8179-9cb0f1a0c839", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021330, "uuid": "b07f0f47-c111-45e5-81ee-8b40c7da6e7a", "value": "ACHWIREPAYMENTINFORMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9dae8b-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001728, "uuid": "cdc193a4-0a09-4d8d-ade8-b16616a87e9e", "comment": "Malware payload", "value": "b4c18286275126d4682c7e336566cb66", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001728, "uuid": "23f4d334-ceb9-4116-abc7-6161194524e9", "comment": "Malware payload", "value": "7c84f12d1931043664fde0954a5af1b0e30edd8f7fcc6b33cfe298fc431baa84", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001728, "uuid": "f53367bb-96d7-48bf-8df4-6a1bd6b6306f", "comment": "Malware payload", "value": "e1e3bcb27fec92d160591aca62e058654e2ef4a8", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001728, "uuid": "e8d50949-52f2-4469-98d0-b4ce32a54091", "comment": "Malware payload", "value": "850e793cf296a6c9fe03e162c91e89e09ffed805e8c7887a3d5252b29e9bd4431ca7364d2e300d5c20ef5b984e1a3ada", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001728, "uuid": "7a348b1f-5cdf-4c39-9fe5-7a044cf428d0", "value": "F0962332B1A08437D1732AB4DD67C2B59935FE002E24A95776F53E0F7E762817A272C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001728, "uuid": "42ec119f-571a-41ac-98ba-3f2d01ed3a5f", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001728, "uuid": "1f72e785-262a-41e7-9621-771673f11ddd", "value": "196608:6jqN6pnt2NzFFXmCXNvyZRJHWhf0IemjoBbeX:6txUNzL2ONMJHrIeMMbeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001728, "uuid": "d518ad37-939d-4712-b5c4-a92f78f761ef", "value": 9046968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001728, "uuid": "8e7db7d5-f723-4c27-9757-95bdb0867dac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001728, "uuid": "e4c872e7-6c9d-49d0-b818-f30a125da9a0", "value": "7c84f12d1931043664fde0954a5af1b0e30edd8f7fcc6b33cfe298fc431baa84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53d37c2-90a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030950, "uuid": "4f8a3261-a84e-4be9-8b42-487b06eb3e5f", "comment": "Malware payload (IcedID)", "value": "31d44266f6c526cface41800214c71c5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030950, "uuid": "cf0e060f-a49e-43ae-a681-57bfe5a8a7d9", "comment": "Malware payload (IcedID)", "value": "7cf57c6dc998850fde54fd12b5efa2cf4a99b4f10e55b5f54a058cb6b387bc10", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030950, "uuid": "e83a5bcd-4de4-4f3c-b37e-2d79cc726523", "comment": "Malware payload (IcedID)", "value": "d62dd549eeb072c5f4cee11d03b3603bc0f27fa6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030950, "uuid": "690440cc-a32f-4f82-a2d2-eebe321973c8", "comment": "Malware payload (IcedID)", "value": "55dde32a6b8aefa7d21369cd24e3b713a5fb809f1d164acfa63a9caf63872e0c0a5c5282234584feaa9d73ca55f28e3f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030950, "uuid": "899164e6-53b3-4b27-bb73-f440a5ce2c29", "value": "1B04122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030950, "uuid": "3fce3aa8-1d1f-40f0-9cba-c335bdb63ccb", "value": "3072:23XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:2nE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030950, "uuid": "50ef4fb8-be7a-4452-af2e-052f5e503b02", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030950, "uuid": "512c6757-b363-491c-82e5-f3b1407d88af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030950, "uuid": "ec46b5ec-07f6-4738-bbae-97e4410e52de", "value": "Claim132670780503292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8ba82b-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029590, "uuid": "34a025bf-1307-44cb-acfc-997b623b601c", "comment": "Malware payload (Dridex)", "value": "9096bbae88da9727a6ef36adb0ea9ced", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029590, "uuid": "9b771cea-6bfa-4206-a096-3289092fa717", "comment": "Malware payload (Dridex)", "value": "7dc626281511fd3444c415104514516c886cddbcad24b6d3458f06a8335a3bff", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029590, "uuid": "a21cdce7-7f8c-4214-97ad-dfedf1474358", "comment": "Malware payload (Dridex)", "value": "c069d0ce987bcdd47482dd6bc524003ae37239cf", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029590, "uuid": "97881fed-24ae-4be7-a5af-9b5705819b54", "comment": "Malware payload (Dridex)", "value": "781b9eaeda1725a1f591c81ba28f3b8b02448bc0cb8106020404d64df7ed944efb08a004d2789a62bcfa40bf4689f65f", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029590, "uuid": "64f193c9-bab3-4608-8fca-ea8a773b5ce8", "value": "1B84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029590, "uuid": "95836acc-35b5-4d9c-8a15-736969992a44", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029590, "uuid": "69e89856-839b-4dd6-8285-d262fee9bdf3", "value": "6144:ZbazNBbycfmKsyUlVGMdUFIk1KyHNwoASpFp5xMeC1h:0zeTlVG/7HNxp5WeUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029590, "uuid": "650b8ce7-185c-4a4a-a427-df28ced283eb", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029590, "uuid": "c57b07a8-300e-4c90-89e9-c5a7daa37305", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029590, "uuid": "5e92175f-8f67-4446-a1fb-1fdc6a6cb505", "value": "7dc626281511fd3444c415104514516c886cddbcad24b6d3458f06a8335a3bff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4592da16-90bd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617042815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042815, "uuid": "4f475b1a-2d9a-4201-bc58-01915067b66e", "comment": "Malware payload", "value": "59693f28c43c81dabff74addd9aa8635", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042815, "uuid": "7f4b4171-3b0e-4439-8a3b-488c0363160d", "comment": "Malware payload", "value": "7e8a4bbdc12c7caefb486b28be1eebf0e35a8ad5f745aae17abbe7f40aff661f", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042815, "uuid": "98791a4e-de32-4324-a0fa-87c80d7e4d3e", "comment": "Malware payload", "value": "c7abf8f201b804c2b4eadc19855e073a93433d58", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042815, "uuid": "0b71f59a-8cb8-41f8-8f6f-b0dc04c4277b", "comment": "Malware payload", "value": "4d3b8e6e42c4ffadfec58c46465c690393fd80dcb58d5eda2e3789d1e3e1ba737743734f3f3eb52fa5e6df37b91c8976", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042815, "uuid": "6ff3cd8f-e64b-4383-b6f5-b76ee2c99290", "value": "AFA36B5AB36410F9C8178134CAD25A47E7B0B42613B587CF4F54CA6A6F237E1AE3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042815, "uuid": "bc00c300-04f3-4a97-8c71-38fd9e7f6a08", "value": "9af8a1e8986904ce686ce863f2c07a32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042815, "uuid": "03355940-41a4-4b87-87f9-36f71bf1d411", "value": "3072:JBSetZFiOZbFSUkc6UwdNe/7ZIVC255d:qKFiOXkG/7ZIjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042815, "uuid": "2a93e5ee-ce04-466f-b1aa-00a49b504ce3", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042815, "uuid": "b513beb3-73ed-4190-9ef8-7efada853916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042815, "uuid": "78114859-42db-427e-bbdb-7242d1d6f3d2", "value": "4D86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7c4a05-908e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617022639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022639, "uuid": "5c3c897d-0111-49a7-a860-c99c7d82660b", "comment": "Malware payload (AgentTesla)", "value": "adf9ceb32003933494aa37d0951d734a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022639, "uuid": "a372b59a-9957-4005-ac95-0396893a35c4", "comment": "Malware payload (AgentTesla)", "value": "7e9b6f2d32de788dad568c2c5002a037ebe70757a48e4b9e0f890bcefabe1a45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022639, "uuid": "c1c842ff-fcac-40b0-b48a-861410239d02", "comment": "Malware payload (AgentTesla)", "value": "fea2d3bb360c430d93db7cc21269761d09c83e60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022639, "uuid": "b98ed85f-6c19-4154-96b3-a69f214a0745", "comment": "Malware payload (AgentTesla)", "value": "35bb83b8163b89678c8178f744fd8c7832a8cd00f2af2bfa62fda22312242527faa37b38e2b1fafb87019c4848f0761a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022639, "uuid": "53b7e1bb-e4e8-4d26-98b9-62ce60fdc479", "value": "80E423BA2ED9C261BF3383C0C47A602E29CDFB89BD1B553893E25487417589954BE327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022639, "uuid": "b5d9a295-4818-4deb-9301-78dbbbf07a3c", "value": "12288:Vwkli88Nq6xkx0iVjSvqjeWZcCZz7+vefTBpsGVLXpW1:4LQj+iVjSvqjnZcQzSCE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617022639, "uuid": "4959ddf1-cc28-44c5-ac6f-e62c8829b1c0", "value": 673872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617022639, "uuid": "e3420c13-5526-4642-af76-5b2f2a800575", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022639, "uuid": "9f2593c5-2860-4140-803d-924cf48ea994", "value": "REQUEST FOR QUOTAION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851d63ca-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "ec791c12-afa1-4c44-8b39-71d9043ee327", "comment": "Malware payload (Dridex)", "value": "0f4a82dea7c91f6998da0b7943140c5a", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "18e2130e-dcb5-4a1c-94fa-e28bb0d87653", "comment": "Malware payload (Dridex)", "value": "7ec6d4c4d98a1901c2a64bea8f5e1ca476ea85d6d52a6d6810531f56387e7859", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "89d69d53-07d3-4dc8-bddc-9d410055e773", "comment": "Malware payload (Dridex)", "value": "fb7addf012557bab1635571569491ff8fcf3de7e", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029607, "uuid": "f65e2f3a-ab6f-48ed-829f-c65801a1b064", "comment": "Malware payload (Dridex)", "value": "175071c8e52f67017815eac43ba3bde1ceec165c65b6a1c5015c07bece84a11ad3186b84a86aa0f92f8237abf4a5f43c", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "c7b241c4-443a-41d7-a955-bb022d89a185", "value": "3A84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "8993df28-44e4-4426-a179-8d9ee3bce2e5", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "571c5d59-afe9-4a42-bbf1-e1613989bfc9", "value": "6144:ebazNBbycfmKsyUlVyMdUFIk1KyHNwoA9pFp5xMqC1h:FzeTlVy/7HNWp5WqUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029607, "uuid": "e30b77da-5e95-4b6f-ac02-fb85457dfcad", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029607, "uuid": "2c6bd512-0e7f-424d-b8b1-9b4a02d1ae37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029607, "uuid": "28572686-9983-4307-9da5-8c253050a17f", "value": "7ec6d4c4d98a1901c2a64bea8f5e1ca476ea85d6d52a6d6810531f56387e7859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213640f5-90bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617042325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042325, "uuid": "fbfbf0f0-cd27-4912-904d-af4e9413954d", "comment": "Malware payload (SilentBuilder)", "value": "9db65511a016cebd7f922bc3fbfab092", "object_relation": "md5", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042325, "uuid": "30693be0-4282-4839-abf4-b760ef497679", "comment": "Malware payload (SilentBuilder)", "value": "7ed20e99d5772265a3f139972dab4c0bdb522d845627f3ac5cd66ce6518fa6a0", "object_relation": "sha256", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042325, "uuid": "618f0db6-1fb7-41f8-8413-9445fbc39b55", "comment": "Malware payload (SilentBuilder)", "value": "523feac985be24f99467cbf5efbc44bd1a10bfa8", "object_relation": "sha1", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042325, "uuid": "cd643cf4-2ee5-432c-a769-7a8bd820c95f", "comment": "Malware payload (SilentBuilder)", "value": "1e4dd20ce40c4f66dca5d89db050ff4b7fc6b2f74f84e44b5709f63b54e6f591eee3873322a374e4fae40647b3b6da3e", "object_relation": "sha3-384", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042325, "uuid": "0ccf7029-17d0-4664-bc86-1802656064e0", "value": "81A412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042325, "uuid": "96ccb39d-6949-421f-8fed-f706418d400b", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7Z:dEKXJ0MDs8QTjVJVf4k4ZiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042325, "uuid": "a9eeb669-6ea0-4091-9102-0d180dbb8c55", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042325, "uuid": "9c0dc0ea-0835-4d69-80fe-5d6550c34954", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042325, "uuid": "f15b8423-21eb-43df-904e-b103738ba8c0", "value": "inv_2025854996_1196073394.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5ffb8e-9098-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617027074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027074, "uuid": "a4759ce7-6f9a-4b9b-af8a-e6c372c3ba1b", "comment": "Malware payload (Dridex)", "value": "381c14cd6b4f3a91d89875cd0707ffd6", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027074, "uuid": "00dbce5a-0a2e-4300-a6a5-81fd5608741d", "comment": "Malware payload (Dridex)", "value": "7f081053e10330507c72146151e12768e4e65dcedab1f7d7e303e08791c26d9d", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027074, "uuid": "8c09d156-9777-47f2-b675-aef44cf2be0c", "comment": "Malware payload (Dridex)", "value": "f5e80e3bc257ef38b0c7084408aa8d0f73d4cf07", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027074, "uuid": "e36c7af0-67f5-4e33-8410-2e44effe5c59", "comment": "Malware payload (Dridex)", "value": "9c617fd9648097ceb9f93b9cc014cafc5a0c9a536a3a274dccd263d4b91a80c046741c7b9f075ed0b51b70d1470f92e7", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027074, "uuid": "514637ef-1445-45e7-8b63-5ead5098cd5d", "value": "0874D013B2E64432D2725B3808B7D6108AFF79D09AB4D4EB669D265C2B277C05B3C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027074, "uuid": "ebe2cddc-b81f-44d9-8fdd-d8854bc89af5", "value": "e7e490e0da58e39dbf299858321fb1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027074, "uuid": "fe1d7204-99da-4ad7-8e41-2af07943c028", "value": "6144:dNcV2VDdp8+t1yTdawJZ1b9A7Q79nP+ymljFmbolIWuh:zcVMdH1gxZUE7h/mjsbPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027074, "uuid": "5ed3f3bb-9886-4c43-ab23-1e4390f541f2", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027074, "uuid": "b7d3d62e-cfd6-40f6-b515-2cf7100d6ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027074, "uuid": "a65bd5b0-eae2-463b-8475-2ea184d97ca6", "value": "7f081053e10330507c72146151e12768e4e65dcedab1f7d7e303e08791c26d9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3843be-9063-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617004391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004391, "uuid": "d0abadb7-fda4-4952-90fb-1a498b10da63", "comment": "Malware payload (AgentTesla)", "value": "82f39eac95a80518206315c974012f8b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004391, "uuid": "227c7a9c-ed32-44ef-aa1e-8cd9d27af762", "comment": "Malware payload (AgentTesla)", "value": "80b5e4f0078513ca7070082ce023964ff3de11a20e93925b332fe2946c80f6df", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004391, "uuid": "a5db4ea7-deeb-4e8e-8c94-71d99725dd22", "comment": "Malware payload (AgentTesla)", "value": "410576e3d72739a61e56bf67286bdc5114fb0fff", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004391, "uuid": "9168f217-c8d4-4260-8470-c2617cb780c4", "comment": "Malware payload (AgentTesla)", "value": "58046f9be0261b588e012f634f6317a6e91186c5eba6e41df8b79c4bbb75f9f161cf0fa321e83254f5761f2f81119c48", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004391, "uuid": "8cc3bc35-4f04-439f-ab01-809f0acd0fb6", "value": "D823025B23F1E97E74D2EFF181CBFEE48C835D66125FB6CA04D74951E2DE84444A0268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004391, "uuid": "837b8aca-e3ec-4d34-8d96-27dbc16748c5", "value": "768:w1TPcg2adx2so+wHTssqM9zZ2xgVrqHRBcU+TE2p9XlbT/Wq+h05b5WavCZzlD/c:CTSa7wf9zFgHRBHUbXXRTk05tNvsNDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004391, "uuid": "21616bcd-40ef-4e0a-8d4d-c77eb5a162b0", "value": 46890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004391, "uuid": "db341b8e-3ad2-4612-8b8a-f9a258bfb0f7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004391, "uuid": "4717f806-0184-4e1e-a110-c2e0a6091785", "value": "PO 4648_9605.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97da525-90a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617032755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032755, "uuid": "73a22cf1-c097-4251-8c7a-14b6bd545296", "comment": "Malware payload (IcedID)", "value": "a259328d5f33962369d09c774a49c017", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032755, "uuid": "cbf09b3a-3baf-4153-8dd3-d3fd2572fb95", "comment": "Malware payload (IcedID)", "value": "80fa95a8d7a45e7209ac28ca06d9c91f4a781d17e2ee0477a72538e615db557e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032755, "uuid": "e31e3f92-d6cc-4f24-89e0-0ac5c88c2360", "comment": "Malware payload (IcedID)", "value": "de5488e2a868c1a9598d50ce3f86724159613537", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032755, "uuid": "31a3594c-252d-4026-a83f-25867739c9dc", "comment": "Malware payload (IcedID)", "value": "1ff9f8d172d651e8a3b9fe71ddaa969963a424b470ce85ed3bf6e4b235f77d5cd862508e386061c10517814be129fd9d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032755, "uuid": "039ae10b-527d-44ec-a241-7985b4b8dc8f", "value": "5C04122DC0568D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032755, "uuid": "cbd87d00-bbcb-403b-8079-67532e67d827", "value": "3072:w3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:wnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032755, "uuid": "ff55ad80-2c57-4269-9117-3a02975967a1", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032755, "uuid": "4d7cb5c5-fd1f-4ed9-9155-ee581f910e36", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032755, "uuid": "88566b7f-894d-4dbe-b87f-a489da604e31", "value": "Claim115189502003292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dcd3f8-9099-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617027652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027652, "uuid": "4d2f22fd-8a7a-4d80-9517-b2db3e5255b2", "comment": "Malware payload (IcedID)", "value": "7eb1e4617768702afe8b08eb2168bd9e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027652, "uuid": "f94afbd3-8e5a-4920-a8dc-a1017c632348", "comment": "Malware payload (IcedID)", "value": "81422242c5bc4bf3929e80e3aedb9324460d2deb9572afb2161a84acfc5c5d05", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027652, "uuid": "5b97323b-0ebf-4b9b-8698-2d367bac5b81", "comment": "Malware payload (IcedID)", "value": "0a6179b682d9ca573c523f71e90bce502a256bdf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027652, "uuid": "d1bf6af2-3f83-4955-aa70-9b5dd280a3db", "comment": "Malware payload (IcedID)", "value": "c3bdea201a712835f4623b6b07b18bd1b5d66b350121217f3fc8c866472cd7cf0e46d11fa7803cd88afd0e777d10ba16", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027652, "uuid": "9b525ba7-9d41-40d6-861b-e974b3fc4102", "value": "19B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027652, "uuid": "4378ca2f-761f-44c9-8448-2bfbd44a7728", "value": "3072:W26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:WLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027652, "uuid": "a34d7a4f-994f-4108-9ca6-3914aa327afd", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027652, "uuid": "15788d63-514e-4558-bf9e-2194c35d31a1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027652, "uuid": "ed5118ee-3ecd-443f-be65-6b6926407cc7", "value": "document-1994411650.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145854f4-90c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617046168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046168, "uuid": "f3bba99f-5a89-4237-b4fe-1a6390548319", "comment": "Malware payload (AgentTesla)", "value": "0b309efe8fd5584616a26f0f220c5400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046168, "uuid": "15850752-4069-4366-adc4-f9a70674a3d9", "comment": "Malware payload (AgentTesla)", "value": "8162cf6f133e3ca6b1d746392a3dea17cc8089a1cc8f46ea6dd8ad30567633f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046168, "uuid": "f1234158-4e2f-47bc-af7a-dcb1332e85cb", "comment": "Malware payload (AgentTesla)", "value": "003969be0698da9770aa1c9934ce8f845ae7c347", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617046168, "uuid": "4d525148-7a6e-4eb1-8f64-029353028a69", "comment": "Malware payload (AgentTesla)", "value": "833c3ef2c714d4749b08247f8351c44d1e53ea450100f68465c3a11b42c5685301d6d6791cacbf4016a36f1cf942f956", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046168, "uuid": "7563bcee-da61-4993-988f-915f2d812089", "value": "B855AD81F144D8B5F4033AF2187E9770116DADDE4427CA0D3646BA2A64F67CA2CDBE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046168, "uuid": "c6537bcf-ef28-4992-b471-bd75ca6f6a6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046168, "uuid": "7196d7d9-3a6b-4298-a95e-acae218d13ee", "value": "12288:m4HtPMwjfBYi1Q0AYDwDuxwHi9JCrDqmB4lkyvyYJJPj0oooSXliKwSiyyjK:VXZYi1QTpuWlr+miTnJJb0vTHwd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617046168, "uuid": "d503197d-2db7-4b7b-bdd6-677954f05d29", "value": 1309184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617046168, "uuid": "509a20c9-18c8-4e0b-ab17-8dd622a6cdb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617046168, "uuid": "c3d1dacc-55ca-47f5-9bea-3245bc2aaa56", "value": "PO#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaa85e1-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616998325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998325, "uuid": "7df7401e-47e9-4fbd-b668-1f7b4906407c", "comment": "Malware payload", "value": "b2a0ca9066e9b80804c201936a83fd6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998325, "uuid": "da6b5d35-7e5c-4245-90e8-8eb86fb3c0dc", "comment": "Malware payload", "value": "82027af4f14934a4dd48ec3b924450adab922eb45fc6868f13ebb3fdebcb0b84", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998325, "uuid": "56472743-5a0a-4d34-8ff2-962b00ac0413", "comment": "Malware payload", "value": "96da417ca30f5e31777670841139d7153959069d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998325, "uuid": "4c059530-febb-43ca-9a43-f6e67709d16c", "comment": "Malware payload", "value": "c73b548f6288140849f5e839affdb808e1c62204ece131206d34f42f6becf759ded4753f8a2ca93cd7a3a2e2c2bfd83f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998325, "uuid": "d0607750-1ba0-4b4d-bbc4-abdbb161630b", "value": "DF1733FE32843775C01ACE346913E909B3B1F35B46D586EFBACA36806FAB111D606B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998325, "uuid": "f63d978c-ff3f-4eeb-ab8a-e73ce98d0da0", "value": "ffe88fd04c0576b16a4b9be92200a140", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998325, "uuid": "ac976a7b-94ac-4005-97ef-005a7674106d", "value": "393216:OMmfRW0J7v1N+g4yuQ/Gd3eS0UIESy+VoWyL9:OG67j+g5/GdOS0BESyRW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998325, "uuid": "978a05e6-47ab-4361-ad7a-95dfa6da29af", "value": 18947072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998325, "uuid": "e8686e03-f7d5-49cd-96d3-4670051b8953", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998325, "uuid": "506ab7d7-c772-4166-a938-1eaa19438ece", "value": "t-rex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7a648d-9098-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617027095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027095, "uuid": "12185acb-9d82-4022-b3cc-b1f4eeeb9e2c", "comment": "Malware payload (Dridex)", "value": "1db7493eacd9f4d5362481525b9d84e2", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027095, "uuid": "0a7753d9-16f3-46f5-b736-b77376e909cb", "comment": "Malware payload (Dridex)", "value": "825a98cb1aee414ace5755d7e14198c459debfab8df674cee0d56ecb7ceba53e", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027095, "uuid": "50c2b61b-e598-4465-acf6-622b7fd3cbf8", "comment": "Malware payload (Dridex)", "value": "1a749dc96feef0c66f63b48ce801378257230448", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027095, "uuid": "84a4dc8d-6b1c-4c96-8da3-96429b3fe8b0", "comment": "Malware payload (Dridex)", "value": "f002e6f074d15b89cea1f7f657f8af4025d87aeae67513e67fd630273fce81916a4c513a202201181ab3a4d6a801fa85", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027095, "uuid": "f8d6c1be-d176-4d31-98d4-df8579ff0978", "value": "1B74D013B2E68432D2725B3808B7D6108AFF79D09AB4D4EB669D265C2B177C05B3C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027095, "uuid": "a038f121-7c48-4624-b071-b2d7fd01bf89", "value": "e7e490e0da58e39dbf299858321fb1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027095, "uuid": "cc6f3c97-2c75-415c-b717-5c3f5b7c8583", "value": "6144:kNcV5VDdp8+t1yTdawJZ1b9P7Q79nP+ymljFmbolzWuh:acV/dH1gxZrE7h/mjsb0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027095, "uuid": "92c2a839-3da2-465d-ba47-d67dc825b1e6", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027095, "uuid": "40d9aad9-e79e-4d7d-859a-9ac6b43149b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027095, "uuid": "6b3f24e8-909a-40f3-9fe1-7d604adbafe2", "value": "825a98cb1aee414ace5755d7e14198c459debfab8df674cee0d56ecb7ceba53e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035678a0-9094-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617025095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025095, "uuid": "7e793e27-2913-41d7-b414-ce8b289375fe", "comment": "Malware payload (AgentTesla)", "value": "2836b2d7735b903e3e32e3c0e62a4c9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025095, "uuid": "23f83dab-1dad-4eaa-8b60-1339b18c962d", "comment": "Malware payload (AgentTesla)", "value": "82d7d525f33e0863bc75c9eece754335318e33ecd0ba6b1662cc5795f602b883", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025095, "uuid": "47504a4e-91bd-42f2-832e-9a0c59e2d2d2", "comment": "Malware payload (AgentTesla)", "value": "f817e89052e540f152b20512e31850d9d225cd18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025095, "uuid": "d59f47cc-4e27-4a93-8a1b-8dcf02e063d0", "comment": "Malware payload (AgentTesla)", "value": "f21427d83b72ada615c6b7cb16745858411d6f287316b18b25ca0bf902db46e4c965d17f22ed9775bd80cf16981185e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025095, "uuid": "2cc8fb39-461f-4f96-8474-ba645604e32a", "value": "9255C0A8F0E1E279F804767119307F7007BD9DA0D862AA0DB99CF9D49135EE91BD3E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025095, "uuid": "65e97038-8561-400c-aeba-051fb997cc9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025095, "uuid": "811c2eab-04de-48f5-861e-d70bd949c0b5", "value": "12288:TaDL7k5CngYwiVVOhlkXmJCJxLy4yYngwNSTsCWyLeR0FiHlf/Or1iCsNnUryVP4:s/ksLOjkHJxe4yYngYgnLeR0merEKGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025095, "uuid": "aa153a75-e671-4e58-a188-ae7318ee3661", "value": 1300480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025095, "uuid": "e53d9ee4-8131-498f-a9a6-17f60eadda78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025095, "uuid": "11de8f3e-9b3a-467b-849b-468ae05a700a", "value": "Placement approval.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05b1cd8-9079-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617013869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013869, "uuid": "243bad8a-4ea5-412d-9ee2-a6aa3f96f861", "comment": "Malware payload (AgentTesla)", "value": "86bb545c0db12d08e6ba7f9e73bdab14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013869, "uuid": "77612398-3ea5-4189-8c6c-8ce42ad68043", "comment": "Malware payload (AgentTesla)", "value": "836aec7caf8b90b52b177c3d80a56726400d0c9a94625d1e9158af02e9b362b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013869, "uuid": "a8c1a0ce-e2aa-40ff-a734-6a13bd9d6894", "comment": "Malware payload (AgentTesla)", "value": "095729fec924b9b7381e4ad0618d48ee11ab3dde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013869, "uuid": "83dbaaf9-7228-49f8-a356-a3dc61e4013e", "comment": "Malware payload (AgentTesla)", "value": "b90f46384ed3dddc58e478c9438100870b80172560b552f4f3bbd9c96808b1e30f4b7642116f79a81dadccbb52411569", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013869, "uuid": "692891e1-78a7-4a46-b56c-fbc4d07ef491", "value": "4CC42312B70DEC99D2E8F6289CF49F401E5B16BEE113CBC044B85DAF0655CE989E72E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013869, "uuid": "405cdc5d-4a9e-419e-b6f3-20e1c39a8a3f", "value": "12288:7OKJ/A9vgW9TxjSCpLGYw/xqfR8deT00GHKFl3nEX6k:4paTWRC0Y8ZEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013869, "uuid": "ba764a94-d2a6-4aa0-bc44-978370c2cd56", "value": 558367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013869, "uuid": "b7e67763-fa27-47b4-9e47-9ae1386f6be0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013869, "uuid": "e4a25ab9-c16c-43fc-b65e-3080593ecef1", "value": "f828aa3580c2710424889e1653bb0d88.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a92ce6-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031536, "uuid": "c0b13c7c-20f7-4c6f-a917-4a8ce67b1166", "comment": "Malware payload (IcedID)", "value": "d566d83e8c0d38efeb07eaa8d247fe9a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031536, "uuid": "e82c39be-fdfc-44ca-b4ac-cfb6dd0a196a", "comment": "Malware payload (IcedID)", "value": "847af8ad14f7becfb1ff4ae58ee81d8f892b4675ebf6482315fd2edc643f8a5b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031536, "uuid": "ad5038e8-b1b2-4c70-bee9-196ce2bbf462", "comment": "Malware payload (IcedID)", "value": "af3082b5d8d56be30cf18bb1276c33d85833cd36", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031536, "uuid": "bec7e90c-b894-49e9-973b-092689a849f3", "comment": "Malware payload (IcedID)", "value": "8348efb7882eaebaa9492cbdac719bdeb9119b9ee03f841adbbf39a8bc2c0bff21e123dc94bbbb53f0579b7738edf608", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031536, "uuid": "44a677c9-a338-4758-8e8e-eb6e55bca422", "value": "AE04122DC0568D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031536, "uuid": "6fdcf888-f03a-4570-b794-74ebf9463f7f", "value": "3072:A3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:AnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031536, "uuid": "54d9aeba-a5d2-44ea-b86c-f3fa4d8e072c", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031536, "uuid": "11839397-8d62-423c-a66c-f64301c86204", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031536, "uuid": "f8ea2b8c-4fb3-406e-be51-5c92afe2e0bc", "value": "Claim92563680703292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f872fbe-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "64a0d2c1-feb8-4e37-963f-0e16dca719ce", "comment": "Malware payload (Dridex)", "value": "8d7e642de4b58f7cffe791b473087e09", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "fcac0217-3cc3-4432-869f-c8e6f9c85800", "comment": "Malware payload (Dridex)", "value": "8483d2c1e068a5d673a069416bb62b6a0d2c3beafeb09df00215d4b43873e917", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "d03cb813-433b-423f-ac6e-f05aa2f1b234", "comment": "Malware payload (Dridex)", "value": "a2f50774c3694d5202866f86c2eb08a371b1e026", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "7f71fb82-81db-451d-9042-dde57f944f25", "comment": "Malware payload (Dridex)", "value": "e7ab131e1ad04bb591805de9edbaa799904e7c54ab5ea994bead05019b478e536729f9cec9e7404946660e2b265a4d01", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "17187c90-c8a9-4552-b1ee-bce4c9425553", "value": "4214AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "01e7f276-d161-4308-8424-8d168a382a71", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "76cfc900-49fb-4dee-8258-a3c160924687", "value": "3072:/pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:/BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028175, "uuid": "5bf908e8-9f47-4553-a2c1-104023e5477c", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028175, "uuid": "a9c61647-239c-4583-a4d7-a1f0b2ca5d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "000386ba-0fe2-4ea9-a02a-26fbf3f022ce", "value": "8483d2c1e068a5d673a069416bb62b6a0d2c3beafeb09df00215d4b43873e917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa2b606-9075-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617011873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011873, "uuid": "64398920-2168-42cd-a4fc-0911410e58e1", "comment": "Malware payload (AgentTesla)", "value": "792542f2884ae573dccca28dc650af65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011873, "uuid": "fe8568fc-fd50-441b-a20a-911c522f89cd", "comment": "Malware payload (AgentTesla)", "value": "84e74d1f1ef100d88a9880caa9b26502f8cdef09869f27816fa1907086d18db2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011873, "uuid": "236661fe-999f-47e2-a2b8-e8beaecf5705", "comment": "Malware payload (AgentTesla)", "value": "6aed2f9439cc8040f8bd754f62fc23396dc2121a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011873, "uuid": "29093a62-ccd2-46a9-acb0-d39c9536d886", "comment": "Malware payload (AgentTesla)", "value": "f21b7e8716756e5e8a0557a6ed56bc84d0be7ae0d53858f579d4f065e50d5a82c0691a284dc59239b5438e12d7fea3ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011873, "uuid": "f697d1d9-564a-4eea-8a89-a359b59d68cd", "value": "7B45ADADD4452672DD79877159F6C936A2237D6D38B0980C28DA3E933BB7393204F60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011873, "uuid": "d0c95ba4-de39-446b-b212-e2508d22b04d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011873, "uuid": "7713abfe-3955-4ae8-a12f-aa64294da8b2", "value": "12288:KKOFC0j3LxV2S9mWEVQSwx1qvYmnthYUkzEuMxtRdiTWvzFaTmSsPro0xBJBAwB8:jOP3LlYDVQBmnthkAuMxtTiftsBl1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011873, "uuid": "f8cb00e4-7a50-4585-94b4-108ff639c97a", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011873, "uuid": "398f92a2-dfc3-4b0e-9c60-f12bb07d4a28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011873, "uuid": "5fb409fe-dfe4-4a75-83bf-60f83544aa60", "value": "NEW PURCHASE ORDER .exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e125f9-909d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617029100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029100, "uuid": "be8f5557-85e5-441a-a1cf-c18d149bea76", "comment": "Malware payload (IcedID)", "value": "cfb58165280201c5e31aa22a82f54b7b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029100, "uuid": "6de06f60-d7e2-403c-a008-abe5c41c6739", "comment": "Malware payload (IcedID)", "value": "851058ae164a79fed64868b78e7f1243eb158c61ad83cc368fd58eb0bc7e6690", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029100, "uuid": "20078334-b185-47ef-b6be-0f90ae2d0f5a", "comment": "Malware payload (IcedID)", "value": "c162d1fce10f951e4751fbf6f962314b0fe1ab8c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029100, "uuid": "18f93064-c5c9-4f2a-9b5b-dc59152619d0", "comment": "Malware payload (IcedID)", "value": "450b3dca27db13dd244538de63da0e463a33352974d88090fe2ed531cb1fb2ff0726d6e015040b42166758a30410f99b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029100, "uuid": "6da505d6-b7b1-4f5c-be64-4f5f8d962b58", "value": "D3B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029100, "uuid": "8763e149-32b7-423d-a705-3ec55eecfde8", "value": "3072:826TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:8LTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029100, "uuid": "c37de93e-78f6-4515-98ac-ec62d6ef692f", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029100, "uuid": "20840e55-73e6-4bbe-bf33-225927733c36", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029100, "uuid": "55f47fae-622b-4f63-9b0c-f1b6e2660e56", "value": "document-1833268657.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aea65c0-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617033375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033375, "uuid": "467dda76-2585-441f-a987-44612baffbc6", "comment": "Malware payload (AgentTesla)", "value": "83945a5f91302774e8f759087b900cdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033375, "uuid": "b2b9d58e-1af4-4c29-b68e-7458e9ee96a7", "comment": "Malware payload (AgentTesla)", "value": "858fa9633a49d55fcb5c7d79cc877cb6502a83d8310edb09fcae9ebf16e6a585", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033375, "uuid": "9e2bda85-b289-4110-b9a3-c4d2f47565f3", "comment": "Malware payload (AgentTesla)", "value": "658bd2ce29192bda41ac19edd5f4667dd519c0aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033375, "uuid": "43cbb38e-65e9-41be-b623-e95d72889ca4", "comment": "Malware payload (AgentTesla)", "value": "05d200deedcfcd5a84d1b0a2db5bf820cb42b63a2a9707569d7786d7c946f1707d75f987e2b7cd23402e1e26102623fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033375, "uuid": "7bc5b35e-37ab-4ffe-bd2e-c6ba740f098f", "value": "53E41204AB37BFD4D0B503F551B986638BF4EA0FA166CAFEDCE7608801279194AB4537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033375, "uuid": "cf4b1c94-40f4-4ffe-a2da-fb874a88f02b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033375, "uuid": "e68f6c89-1930-43b1-96ef-a10e4ac48702", "value": "12288:mdG0cMTB5UuTJoHuXxGanjKsITgy4Gh8YL2XRAZh8m2So:9MTBhqHBeFg4BGh8m2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033375, "uuid": "6ca80507-e8e8-43c9-ad30-f558e14da561", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033375, "uuid": "f513e0ae-a20c-4dae-b0ac-d9cde083dcb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033375, "uuid": "b0726e6f-dea1-4229-b2c8-6151d9992f8c", "value": "ECLISPE SUPPLIES-1212009300,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34030ad6-9074-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617011432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011432, "uuid": "de538e96-fe3f-4c30-bcc5-689336f94cb3", "comment": "Malware payload (Formbook)", "value": "14ebd58b4efcee9abc9ad62708550424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011432, "uuid": "bd459ab2-4a78-45c0-b95f-2c2554983d6f", "comment": "Malware payload (Formbook)", "value": "85b4775a04277a6a2273bf9c72b75f9154dd3d89f6f504e08d6ef32588f8ca2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011432, "uuid": "d54c67fa-165b-4f3b-bebf-389099204ad0", "comment": "Malware payload (Formbook)", "value": "95960efd403c557028f78808cca631198404c18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011432, "uuid": "881cd56b-9973-4790-8d1e-92a028e18d2f", "comment": "Malware payload (Formbook)", "value": "aa80e635515104beedec1a129494dd391685273750f9a8d67977c212e22d4e2053d1248d3f19d3972f0fa8562602f722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011432, "uuid": "86f0bf89-c733-4b43-970e-8588e5f3e202", "value": "1825C38C6E99C1CAC5390BB842C9C4F646E95FF34F22887AB9C45FCBF431745E50A626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011432, "uuid": "129c3f71-8aaa-46ed-b083-9b6de8db34a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011432, "uuid": "ba5b3464-667c-4b75-8db3-7cf9db666964", "value": "12288:1ggMhltW9J2iN9lGEBDnsZmEIH+B0x+/i4djckqyuSei9:ygMhltW9J1hdlsZS9x+/iKay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011432, "uuid": "a09d6747-036a-484c-916e-fc1c7b877561", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011432, "uuid": "3a90b60d-552a-4c05-b4b9-a6f6d34d6edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011432, "uuid": "26846418-2ba5-40bb-9c56-9773867414b3", "value": "DK Purchase Order 2021 - 00049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b742202-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996144, "uuid": "76c40a15-c63a-4a2a-a1fa-dd40ff5e6e63", "comment": "Malware payload (AgentTesla)", "value": "70bb4ef12733cdeed0c58b3e330332e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996144, "uuid": "92e57f3d-81fe-4c98-8c72-5713c396ffda", "comment": "Malware payload (AgentTesla)", "value": "85bc6624c9e44abc68ac6cba4760fec0b3384721954e2419eb6d3f8e86ae300a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996144, "uuid": "74d2cab7-c859-4af6-9450-309c72189abe", "comment": "Malware payload (AgentTesla)", "value": "f270de361230aede3da68db6ceb4ce26223f2c10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996144, "uuid": "6a42aef4-728c-4d39-a0b7-aa2c9dd038c7", "comment": "Malware payload (AgentTesla)", "value": "0dc08fc5fd51024e5755092f6adc47eb4d0562f5fd56cb9bd9d67ce004c0f77b71c9098e2c82464cf26f66d8632b8de7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996144, "uuid": "b276c497-561f-4348-865a-e3b5d3c40406", "value": "75F4333D99CB820F78E04535E2C6A508D7AD4BE3FCA7835936E66271F37A3418867C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996144, "uuid": "8e66a6a7-de83-4bfe-b568-42187fd1bd36", "value": "12288:yW1Mqig2s8gYMZCdiJMqacF2woHyb9jQLj8Ztoh2jyYqDPhlmEF8dhXBCd:/nig2oZCdiJg42woOjij8ohSfq1bKdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996144, "uuid": "90a235c8-4c57-488e-b1f7-e59031f9568c", "value": 790725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996144, "uuid": "7923b234-abe6-45a7-b77d-6e998459dcf4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996144, "uuid": "72a9fad3-233a-4482-b5b6-266398a93ff0", "value": "PURCHASE ORDER COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9721fbeb-907b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617014605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014605, "uuid": "bc191235-6340-4d3c-8f74-28732cd06802", "comment": "Malware payload", "value": "3963c2012fef7414e2ad1f73340a5dce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014605, "uuid": "46716697-56b2-44e1-9803-647aa1adc3bb", "comment": "Malware payload", "value": "8611bee8b26122cfd49657ef2658e9eae7aa6156b6cfe89f9196cd7bccf1b053", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014605, "uuid": "3db79597-13ee-4720-950c-0e0d3b821586", "comment": "Malware payload", "value": "86dda5618ecbaa5a4b3b1bce87b28eb3b6221a67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014605, "uuid": "71cc7327-2ec7-4d7c-a195-9496b58a366e", "comment": "Malware payload", "value": "663cb676246ce80610be945a2f9f9f436ae1905bc4dba0a2aead64140fab3c47fa4dd7d8244034396938f56f58d70502", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014605, "uuid": "66b13c34-aa0b-44ec-9c0b-bbcb7ae4b573", "value": "83E4236497BB10C55AB81A0C350E74622E5BD577E08A9FA7FDBFCB869800107DAEF018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014605, "uuid": "07b6f82d-c842-4daf-bb69-ace755a245c8", "value": "12288:76rSj92itdYFbvu34NTB9tyxWPT4i6OzujkmsN4FLJ9BnGf:GU1LYFb23U9t74iHzujGmF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014605, "uuid": "ec0c147f-d42f-4aaa-850f-e40245a5d373", "value": 663693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014605, "uuid": "62688d96-8fda-45c8-9c7e-0db9bc140dd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014605, "uuid": "42070b18-4fa1-4b85-be1d-98087fa96cb3", "value": "Fatura _893454.pdf.UUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222458b2-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617031589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031589, "uuid": "bb1ac924-f84c-4b03-9ddd-2ef42d4e57fa", "comment": "Malware payload (AgentTesla)", "value": "e0eb607e1dd6811d7e8fa5438e5fcd43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031589, "uuid": "3cfe1aa2-56c4-473d-aa5f-c8b8dc015be0", "comment": "Malware payload (AgentTesla)", "value": "863f758864b7bb25ee87039da8e25ccb9b62221b44bef2b0f27cdbb92c9debab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031589, "uuid": "ad576ab4-9f4d-4ed2-95b0-65de444520bc", "comment": "Malware payload (AgentTesla)", "value": "e7330f0f68eec6c876b0cb75d1922d39058b522a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031589, "uuid": "f2168174-a2b2-4345-b2b6-f40a9a006a23", "comment": "Malware payload (AgentTesla)", "value": "eefa7130b914aa8c09163715fd380b6754fb479fe80b6285b1ad4ac85dcfde4732b67827d60ee47f590befe81ce7e137", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031589, "uuid": "7176b652-d836-4097-8c18-c54231d90c0d", "value": "DE1533BFC1A5082F6A3A19D108774A1292B6ED217BD58E7C622CB273E7F6C474B70D11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031589, "uuid": "6d7f4a8d-73e2-4dc1-813c-1c77e67a9d96", "value": "24576:piiopcuDmxyidJi8pzbYz4BvyvviZbBZN:siy7DmxRpvY4hyvvIbB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031589, "uuid": "6cd8bd4b-895d-4d02-889a-be3727217857", "value": 915219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031589, "uuid": "ab660e98-182f-4fbb-8181-42a09151a958", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031589, "uuid": "f32176c1-b015-4fee-b8c9-41913b306a04", "value": "GS_ PO NO.1862021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02700293-902c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616980425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980425, "uuid": "be76bb66-1a45-4c15-ad1b-7b72919f9e48", "comment": "Malware payload (Dridex)", "value": "483b2d8b68fd803d67153d13d33c7e73", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980425, "uuid": "37fc90e1-cfbc-4ee0-9f3c-52abc7958102", "comment": "Malware payload (Dridex)", "value": "86a615a1d7b74d90d05a59ee4dde369275c777c800a042e2635fc1a79aa5f232", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980425, "uuid": "503c66d4-4fd7-42ff-8cbf-b5e4cc4cf35c", "comment": "Malware payload (Dridex)", "value": "a62f7de20043ca919ba3f95ff2dcb7e46991df07", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980425, "uuid": "6aa8d48f-c576-49c3-9994-570f9640edb9", "comment": "Malware payload (Dridex)", "value": "fd7f3f293312a5cf5bb729bd14326a9baa0eef279ab9dd078460804cf2f15820d851b3b92baa475a1bbdaa7a8986d2f5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980425, "uuid": "24c38fcf-f8de-4fcb-bae1-589071107c0c", "value": "4014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980425, "uuid": "60b6d8a0-03a8-4a7f-afe8-d8d6ac14fc83", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980425, "uuid": "4e4437e7-3fe9-4f5c-be9b-6bfb8479c80b", "value": "3072:x1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ji78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616980425, "uuid": "bd7eeab1-a1ba-4d6f-b248-246e66b36b35", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616980425, "uuid": "00a48522-00e1-4a30-8f82-cd9d7d2df8de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980425, "uuid": "e6d107f9-7ca4-44b1-95eb-50354735348a", "value": "86a615a1d7b74d90d05a59ee4dde369275c777c800a042e2635fc1a79aa5f232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94542db0-909f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617030062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030062, "uuid": "1a573cfe-29f6-46a4-bdc0-accd492586f7", "comment": "Malware payload (AgentTesla)", "value": "21ab2ac2ad94d3efb18cf32f74245361", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030062, "uuid": "e9455f59-c147-4275-b0a8-8caf486a1100", "comment": "Malware payload (AgentTesla)", "value": "86c0efffb98c554dfefd3b5b53759c9205a5ce5612ca89ee822b801882ee9f38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030062, "uuid": "11fe5b46-7d53-4b41-ba94-7b40b50ac3f2", "comment": "Malware payload (AgentTesla)", "value": "85725ede536f977dce80395ea5fa74a9bad9c13e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030062, "uuid": "4d24d770-4266-4c44-aa13-775477dd916e", "comment": "Malware payload (AgentTesla)", "value": "9cefe752a5960108a33d5e16fb96e07bc093e58f59e23e97e3f4d72b3f43a6b18e11915772a8de0fb04e6af7897f6b04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030062, "uuid": "9227c50d-a870-4d11-84dd-9e22ac4db542", "value": "909423490F444162F76FA3BF12E294E8A599C1C2893D5EAD591C877DA7332CC1E2E24F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030062, "uuid": "a29d110d-eaf9-43d1-9bf7-f85dd6344419", "value": "12288:hzTmPblKFrl3kRSR/ZFfVmCxLM1Huyg3Rb8WOj:4PUNTXYuvdfOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030062, "uuid": "560867ef-f2a1-4ecb-bcf1-fa1de66e61e6", "value": 439171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030062, "uuid": "34d46674-8307-4357-9dc7-86537965130a", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030062, "uuid": "37d5b6f5-4a29-440e-b597-fa7ba1f5645b", "value": "Wrong_Invoice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a011df41-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996152, "uuid": "a4437d5d-f7ad-4fdd-9afa-603e5aef2054", "comment": "Malware payload (AgentTesla)", "value": "842d1f8a5cbd90f4d85c644d3eefc401", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996152, "uuid": "16bc5e40-91f7-4e66-81a0-5b59996e6e0d", "comment": "Malware payload (AgentTesla)", "value": "87833ac492bd1cad8d4fc8b809b8c04b77a28684c7a07721c1911a3847945d62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996152, "uuid": "718d8555-179c-469f-aca7-1410b9a94877", "comment": "Malware payload (AgentTesla)", "value": "140503b65db1b7aade7e4218cebfa7f5415720ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996152, "uuid": "ff990975-3fd5-4cf5-8a59-6d1d01405a74", "comment": "Malware payload (AgentTesla)", "value": "8d462621e7c7074345d9334fa90f599981be211b3353cc33313276c0e4b23ee3b5b8f20ec660077a51d96e4c72c61122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996152, "uuid": "354acec0-61e2-49bc-bc18-5fdcc9057af1", "value": "0E45498C1E89D6CAE0780B7951C9D89887FA5EF38F61C87EBDE517DBC170B40E606126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996152, "uuid": "bf82ffaa-cbd1-4d44-adcf-1eacc5734251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996152, "uuid": "3aecedca-fa1d-4cc4-a66a-8eca74f8f852", "value": "24576:kCs6rQivLrNWdiJw42AcoTcn8gbiBq5z1xNz:TQivLrsiFlTcRb35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996152, "uuid": "1df80692-6156-48d9-901c-3341ffe12713", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996152, "uuid": "2342f847-42e7-4d38-9168-e15b20608625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996152, "uuid": "1c65b117-4a53-4fef-8d92-f869b60fa186", "value": "PURCHASE ORDER COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb48e21f-90b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617038369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038369, "uuid": "5b55ddaf-ef0f-496b-a0a4-42b0dac6aafe", "comment": "Malware payload", "value": "c6d075bc6fcf4d933f3fa8ba85a0c253", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038369, "uuid": "436ee011-217f-4308-8838-a8e28f1527cd", "comment": "Malware payload", "value": "87a90a46cee92bc5dd281628f12b2431fc418f3eab21afb6bde86d59d470ca5b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038369, "uuid": "bd45d4de-496d-440d-b7d9-7aaee77868cb", "comment": "Malware payload", "value": "2879a51e386f8ac3c97b8dcdc821cfcbad0bca10", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038369, "uuid": "8ac943e1-58ea-4ada-a8f7-fb5f690ae1f4", "comment": "Malware payload", "value": "4d953aa4f6a640aefcb1eeeaf9e29f793da2a1b4b892923a9367f40c20c3835cfeba7f6ac5ec2ad5ebf56f59347ee6e0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038369, "uuid": "f636f3eb-ebd1-4652-98bd-193b356f4f9e", "value": "21A5D0F4216095C0D7040A8B581DAE491B57E7A78AE04207726BF6FE3FBF1E5971ACC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038369, "uuid": "b164fd5f-89e7-446d-bd03-d474e77c352e", "value": "12288:5a1qi2jtZ39xXvvvvvvvvvvvvvvvvvvvvvvvvj3rR5Z:R3n3z3R5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617038369, "uuid": "854ff470-c727-4ca3-9d2c-512343eccb9b", "value": 2209038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617038369, "uuid": "9ccb30aa-9282-471b-8c52-386448678318", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038369, "uuid": "1d053c97-d90e-4196-9842-36490bcb469a", "value": "PO33273-CSFM.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e88136-9064-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617004501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004501, "uuid": "efc01bcd-90ce-4f2c-bac5-a86797505ed3", "comment": "Malware payload (Formbook)", "value": "76c3eeee8909929eaec81823d585d3c1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004501, "uuid": "f83cc6ae-4309-4452-8e99-0302e3be1edf", "comment": "Malware payload (Formbook)", "value": "88463063759b35f484a352bd52dfe73974f6d7d85c76a993111ae6466c918752", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004501, "uuid": "c3f2a273-e852-4bc5-8eec-2f8b6956decc", "comment": "Malware payload (Formbook)", "value": "cc75b546834316d31c8d8ee7cd134536e26642c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004501, "uuid": "c9cb7610-aea4-4535-ad01-b25d0aed0071", "comment": "Malware payload (Formbook)", "value": "849193afea7e3ac9c924467cf79fc6d694bd71897f79e14d786ab759958b6fc0c596bd1015e961465c8f2e30c3514516", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004501, "uuid": "7d4cda2c-bea5-41f7-9145-27c30f7ad333", "value": "BF24125E76D04A37F913D0B32CFA5638EABFC3016322645B27AC4D6B355018ACD67297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004501, "uuid": "e4024082-b908-4164-8525-d1b5fe5f6ef5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004501, "uuid": "8fe0808b-5d21-4d74-94f8-c7db6a04165b", "value": "6144:HAP+UGyc0mA0SaS7z4AhT0QjAw5QZRda3Uh0jxSb:QGzpSJ8AF0hw54ej0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004501, "uuid": "3680ed8a-d957-45d7-969a-a4551c28dfcf", "value": 209591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004501, "uuid": "a584ffd1-3ba9-4e30-bde1-5daa013c9d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004501, "uuid": "295d515c-699c-42f8-88d4-45ef27226108", "value": "salescontractv2draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f428867-905e-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1617001922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001922, "uuid": "c39b3b12-c544-462b-8801-69c09b4a4120", "comment": "Malware payload (CryptBot)", "value": "55cbdd54452f5a937b4d21384e0c815d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001922, "uuid": "d27673df-a1c6-44b0-9739-d4851022c277", "comment": "Malware payload (CryptBot)", "value": "884837b998040b03adc5dead61073ad9314ef82754ae0cb415e685297f25a776", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001922, "uuid": "4fe633ee-8daf-493c-8531-0221ce0fc73a", "comment": "Malware payload (CryptBot)", "value": "e54c1ac865da556c10dd82b40f9257f34ab10d74", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001922, "uuid": "fe76b340-d0f4-4cb9-8560-b19d738f6b4e", "comment": "Malware payload (CryptBot)", "value": "c31f72ebe43a3fd722ee5cb592a4391674031f3f69a43e565dc8f10ba76834ca8ec08fe24112b6202ca364f13c32f18f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001922, "uuid": "1a937ef9-1927-4853-8853-71fb274e3341", "value": "C2D41231F5D2C133E65605724856C270063AFCA09B21B7CB3BD46B6E9F362D28A7A747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001922, "uuid": "90fd4108-3b61-4e3e-9368-99980b74e85c", "value": "1b9a4302f0d59f5d4c40f6b7b971caa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001922, "uuid": "8dda5ae3-10d5-463f-b5af-252486638724", "value": "12288:TxppfcauCX2Fb3JAMsPfCD1g9tdoXe1F0K/hFGnm0XwKMpwpTl:TGauCX2Fb36MsPmg9Ysu1gnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001922, "uuid": "6d494985-e5cd-4891-93cc-6b1442b436a3", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001922, "uuid": "cda86702-8b31-47cd-bf7e-3916708d0d5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001922, "uuid": "76d5a929-13cc-43a0-b674-3c8d704897d5", "value": "55cbdd54452f5a937b4d21384e0c815d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f672e7a1-9099-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617027650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027650, "uuid": "62b59660-25ee-4d8e-ae38-6acb21c85cbf", "comment": "Malware payload (IcedID)", "value": "bbe6e53df020ce1632acc6a71645f673", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027650, "uuid": "c905fd45-3043-445e-81c9-f06288292b7b", "comment": "Malware payload (IcedID)", "value": "888bc5a873790913562da6f18a23ee07cf5be26080974df2c5fd459e14017c30", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027650, "uuid": "ddd17d6c-5bbb-4434-8c55-cbd31a3429c0", "comment": "Malware payload (IcedID)", "value": "c1d24ea75eeedbb3a9c943ac65ee9263a631afe4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027650, "uuid": "51c5093b-89c9-4173-942a-ef816217c6ac", "comment": "Malware payload (IcedID)", "value": "07f15edfe7e5335f377c647d8593f71f5e8a598ccd947e28286f5f6a72881606dc91d1bae3b918bedc487bce652b038c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027650, "uuid": "9e0ed16c-d48e-447a-8842-2ffaf9547a71", "value": "10B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027650, "uuid": "df0a575e-41f9-437f-b0c4-bbcc18736055", "value": "3072:u26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:uLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027650, "uuid": "f935a924-db46-43ce-afc9-f4d2108a9737", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027650, "uuid": "4351776d-a13d-4cdc-8ee5-ced451eb2c7c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027650, "uuid": "d1386543-40fc-40b2-a4d0-46cd2aa4ff4d", "value": "document-585033175.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4763f128-9080-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617016619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016619, "uuid": "eaf443f1-36f3-49e2-9a73-3f15cc7ec0ee", "comment": "Malware payload (AgentTesla)", "value": "b34ecba3c7c12f94c364d4ae9de9c625", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016619, "uuid": "2dd2ed3e-9bf2-4604-8c26-a67f52455a15", "comment": "Malware payload (AgentTesla)", "value": "890eb83134f4b9a83b215b5e229ef8b339ec4f990fdddc908e5334b7563bb7f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016619, "uuid": "e13d62d1-3058-4b43-8b0e-fd2acff9722a", "comment": "Malware payload (AgentTesla)", "value": "df1a22f5c6b7e4a44d6872d77bbf1e82a1461710", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016619, "uuid": "35ebd233-5865-46fb-b835-ae87895fa024", "comment": "Malware payload (AgentTesla)", "value": "b83bb9c3bb53575dcc51baf9a2e96223d7192ee7b27a7e58ad65708c6816acf11a4b9630d74bd09ed25398f2df84266d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016619, "uuid": "29b97b04-1753-4267-9296-2ab2271fe6b2", "value": "B4B423839260920D1A57E551FA36DA3268763EF6080CE4A3D91F9EED2E75C0F16D807F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016619, "uuid": "c5ecf1ee-2320-44bd-81a8-5beb5ef01675", "value": "12288:9sinvzSUQKQCkErCgBkB8lRH4eH8BWb9CFvQmCnyHK3dh:9tQCZrvBkB8lRlcBWJCF1UwK3dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016619, "uuid": "e283f6d0-c9e9-43a9-9670-93f0f29d76d2", "value": 524819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016619, "uuid": "62a86200-237f-4243-a239-f2398d7a520d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016619, "uuid": "a379da32-17b7-4297-992a-dc1f2b7abb68", "value": "Purchase Order #07916813.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f287ca4-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002378, "uuid": "bb192ed4-c23e-4c8a-a2b4-0726d5e8a531", "comment": "Malware payload (AgentTesla)", "value": "e5ce952fda32caa726f6da20416451a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002378, "uuid": "f7a4ad3a-7a64-460a-959a-cc5987bdece8", "comment": "Malware payload (AgentTesla)", "value": "891418a29b28bea02e73e761ffd8f9d8228e4d3c6421cdb84e30139b47436568", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002378, "uuid": "05aa875d-450f-462a-8db7-e299b038f56e", "comment": "Malware payload (AgentTesla)", "value": "6b119ba50b5e2f5079f7d90a843928edc2327cfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002378, "uuid": "941f994f-7b89-41de-a428-ed9204625de2", "comment": "Malware payload (AgentTesla)", "value": "7608f1705838612cb14763337ad5e46841bfaf4c31650cb024e5f714548e1bce0b7231d32d3daeb2206941886853eae8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002378, "uuid": "24bd9f86-164d-4aff-a4df-50b07788d428", "value": "7445494C1E98C2CAE2794BB891D9E49943F55EF38F22CC79BDD547CBC230B41E606626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002378, "uuid": "958c807b-15a0-40fd-beba-8f60e117cea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002378, "uuid": "e40e21f6-89c0-4356-8d7b-bfc6602f57d5", "value": "12288:pcjgbgwxMjpIW4M9B1kMOPgCh0uyW/Mt+jptZd0WxcOeXwpzEROwbZq6Jt/gTthe:p44MLNOPgwDzMQX/teXwJEROwbZrzcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002378, "uuid": "e3e11e29-1f1f-4c6c-a06e-ca312f2f64af", "value": 1165824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002378, "uuid": "5bd5b6f5-c1ed-471a-936a-c8f2d830b0d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002378, "uuid": "2da9178b-aa30-4c13-b45f-bac04ffdc028", "value": "e5ce952fda32caa726f6da20416451a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd48811-9079-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617013918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013918, "uuid": "f3804413-c7f0-4452-a362-2d9c1e033c6f", "comment": "Malware payload (AgentTesla)", "value": "b0aa91a17568c0d644c85ab862ecc80b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013918, "uuid": "021bf711-f59e-46e2-af6f-f5e4480e122c", "comment": "Malware payload (AgentTesla)", "value": "8942022e0a4d701eb39c483c716d246eb9f803afc7a87f778721df1b72a46ab2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013918, "uuid": "ced88426-f1db-4b03-8a45-747d6fdcecf4", "comment": "Malware payload (AgentTesla)", "value": "188407976b3911b3819a9d30fa63f886545282eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013918, "uuid": "0078e3ba-5455-4370-aa7c-01ac376de1d1", "comment": "Malware payload (AgentTesla)", "value": "a87ec3c852611e558181340738d34d029b46f11c311cc0633f3c83500f9f72f0b92d1657b49601846e8c9d76c8fa592c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013918, "uuid": "7a66f1c8-83db-463e-b96c-8e53c83ae6a8", "value": "09F4B38C5D9EC1CAC5354BB882DAC4D906EA5FF34F22C87AB9847BC7E132745F506922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013918, "uuid": "45549ef9-88d3-4e8f-9bbb-3bdab2470c74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013918, "uuid": "97e46c22-6950-43f9-94b1-e5197791ef66", "value": "12288:TRUh0EsrS2TgVuh+EpbnvEoNamFYqKAPbJfuJvDu+/0UFs:TRUh0jO2YS+EFnvETmpVJfuBu+/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013918, "uuid": "e7d97d18-5bfa-4ebb-80e2-c688484fd761", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013918, "uuid": "1418ec66-ca90-45a0-a14a-03cbf0247f6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013918, "uuid": "c7e5cc0e-da98-4148-bcca-1440ed75eb78", "value": "DHL INV+AWB5501980113371714001.pdf___.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a53ac4-9083-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617018148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018148, "uuid": "4da693da-7dd1-47cc-be5f-9a9d0b20c9d7", "comment": "Malware payload (SnakeKeylogger)", "value": "53d87c8b2e309b72d5a50c6f18f17313", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018148, "uuid": "5d3e3516-329f-457a-bc9b-58eb2710fbda", "comment": "Malware payload (SnakeKeylogger)", "value": "8a07dabb59bbf0d69a99e25e885fb512ea2982e70eb8732adea4041a2876c941", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018148, "uuid": "374b9cbc-0538-4a60-b65e-939cb971fbdf", "comment": "Malware payload (SnakeKeylogger)", "value": "d3d6c1c1733c7b41ade467e768bf89c47c13ee6a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018148, "uuid": "e958e1e2-045d-48e8-a423-5cb5195c44d8", "comment": "Malware payload (SnakeKeylogger)", "value": "16efba50d33a879daee269cb1823fa54e8ceb12177e8cbf6ae3379c4dcde7af4562ceb176d5746439c6fcf490a33af48", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018148, "uuid": "12b695e3-0401-4dcb-a4b7-60015b4e4d2f", "value": "03552A4E5E58CACAD1794BBA83E9959447F57EF38B11C8A9BFC4B3CBC130740E60A521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018148, "uuid": "a8d7d91a-5f0d-47ce-81a2-f141788e5b10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018148, "uuid": "bd898dd3-3b96-4ee6-b90c-4f35b2a2acef", "value": "12288:e4f5ioQ85gWbLv9FXz+Srdv0gGu+XVr0KMOtEi5OpCL6F3QdR9aT:eqvj5ew+FoKNjeCWFPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617018148, "uuid": "7b5ab5c7-5053-4996-83f0-42012b925342", "value": 1302528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617018148, "uuid": "278ffcee-6f2e-47a0-a1e4-c9ae521d1495", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018148, "uuid": "995f4f64-975f-460b-b9a8-ed64d662f17b", "value": "New-Order098167.pptx_______________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0ef46c-907a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617014295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014295, "uuid": "26fd1b29-0ae8-4abc-94e5-05b49b91ef67", "comment": "Malware payload (AgentTesla)", "value": "d652db68861597f6786c37937e2cfaa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014295, "uuid": "4e19a50d-e366-4dc3-9345-2fe9c9404bb5", "comment": "Malware payload (AgentTesla)", "value": "8c48b2b1ba3a112945a1bd20700ec1295b9a46228aa18369ffa31097786a7991", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014295, "uuid": "bdfc3ec2-0724-4c0f-8a4b-8b1135bcf3a3", "comment": "Malware payload (AgentTesla)", "value": "af2d45d98b320f58fa6494c71a1323189c1f9afb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014295, "uuid": "42e5f418-8864-4ae9-b215-f7343c2b42fe", "comment": "Malware payload (AgentTesla)", "value": "8d4e5f4cbfb0abe18ea1654ddef538afe727bc58ca3e7d99c67f1eca6c23c7c448a942ccf643422a3d58342e36179e52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014295, "uuid": "9d797092-f50c-467d-b834-95bdf2c74aac", "value": "CC05DF7E24A72B33C5BAC7B58CE51553B662A42A3091DA0D58E31BC11762B5339CFB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014295, "uuid": "9b81da16-a626-489f-95fc-5cdc08adfc3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014295, "uuid": "88361bde-5a15-4087-886d-591eddc3839c", "value": "12288:J8K9ZWTLm6NKIq2hR8tDkyJplsgB3Fb5jhb98lf03yebrwWKiz6:39Qm+g2hR8SydR5j198lf0imKiz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014295, "uuid": "77338ce8-5243-455e-a553-92a571a89f02", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014295, "uuid": "dd03fc1f-2b4f-44e7-b02a-3f9e9a4c13bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014295, "uuid": "27f3b648-e7f2-4d1c-a3df-f03efd0968ee", "value": "TT payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1e311b-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616997620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997620, "uuid": "f033b398-ceaf-4328-86b9-c5d3d471794e", "comment": "Malware payload (Loki)", "value": "8f82d2bfe96ff716614791821142e59b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997620, "uuid": "422791e9-6fbe-469c-987e-a7dc8a9c98ba", "comment": "Malware payload (Loki)", "value": "8cafd50f3a924709b60017cd2719ea324bed1a1c7b8412d9c87ba9b70940452e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997620, "uuid": "4feaf076-905e-4bf9-b36c-f9e80f39bb31", "comment": "Malware payload (Loki)", "value": "a4e6f588d7da8935bf7af06fab927250bceded31", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997620, "uuid": "f4208119-58b3-4f79-abd0-4985df507e51", "comment": "Malware payload (Loki)", "value": "94b1c677fde0106022a9d306e583280c89e3df1703357f92150da9b7941d35070fbb7a25693f71236b221af3783baf16", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997620, "uuid": "2e471cd8-83a8-411c-91ee-8f278a05bfd9", "value": "35C5332988865B5BD06B59F952CE796CC23ECC026E40DEE6EB1D755C3432231ABD331E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997620, "uuid": "12d7752b-7a12-41fa-8836-4efbb2f91012", "value": "49152:O6UPdh+MqjbUYA52drVOIevGyyUzOcuoxUXjiwdp7:ORh+M8bUYyyYI96zxcjiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997620, "uuid": "233accde-92b7-406b-99c9-a639bd2437f8", "value": 2691072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997620, "uuid": "07d2681a-0f19-407c-8f16-44f2c8368c96", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997620, "uuid": "d6ddbffe-84d7-4fbf-8e87-644e92333da4", "value": "Draft Shipping Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2342fbfc-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616997660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997660, "uuid": "c8148c1f-63d7-4459-a3ed-5e111e7142e8", "comment": "Malware payload", "value": "fc6beee99edc945497d4147e1c57b452", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997660, "uuid": "394c5cc1-2705-406c-ab9e-947b1df80b3c", "comment": "Malware payload", "value": "8cbfe1d61485c145fbde8c79b2c87afd9585ad810bf584ab5d87a81244f24738", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997660, "uuid": "2b1a21c1-9f15-4142-8457-8c34e217428f", "comment": "Malware payload", "value": "9460dbf14d4ab220ed6fdc9b76753cec46b40ded", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997660, "uuid": "d04efa90-7dc8-41c5-afea-b9b4891c19f4", "comment": "Malware payload", "value": "3b0b0321b254b03ce13da002fed717b63f7b4872530c328b7700b6c5b7002b7babd37838f9c8b3a88f6b2c37999aef5a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997660, "uuid": "849180a6-03af-48e5-855d-e4488240c3d4", "value": "2CC533594EC3C742D0AA0B3A4E65668C0A3DDC480B529F5FE36CF76A34366B0D7CA528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997660, "uuid": "1513d53b-8f62-4638-a1e6-efed62870095", "value": "49152:lADU+Cwuc/hp0sckEayKb/IEvXBwA0DM03cSpWWajvAZ78YBUNVdkSNaNm3:ug+Cwb/hpYWbA2XBwA0hvV+48cCkpNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997660, "uuid": "3cbdf3d4-45c3-4444-b62f-87705493645e", "value": 2609152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997660, "uuid": "d79b7eb4-12fe-4ee7-8200-f6d1a9e5b525", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997660, "uuid": "7a0aa9ba-d962-4e04-8ee2-a1bc871b34a4", "value": "Al Rabiah Trade Requirment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfb3ade-90ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617036065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036065, "uuid": "7320b9e4-a3be-45ac-a44d-ac2c77d71205", "comment": "Malware payload (AgentTesla)", "value": "8e1b264e09e60b004146b7a55d9b899b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036065, "uuid": "b4b0f52b-ceea-4d12-abdb-d4c8bef92e6d", "comment": "Malware payload (AgentTesla)", "value": "8ce7b849c89bc5618b6ea314d834869950c284b4d9f546364a9aad2a967b14d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036065, "uuid": "0d9821e5-a34a-403b-9ca7-505d4912be89", "comment": "Malware payload (AgentTesla)", "value": "f1753d75ee482400e5badc50fed07cdcb0a37f26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036065, "uuid": "4b298709-c4c1-4aaf-a067-5161bd99559a", "comment": "Malware payload (AgentTesla)", "value": "2d75cdf73ab5e430e490f00b8cb45063e9f201c799712428176f55c9dea239ac65c8e2e45a672e9005aaf21ea719a795", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036065, "uuid": "a22816bb-9814-4e09-bc41-bb5fefe54c2f", "value": "249423B45375F154DDE88CBBD7438224E9DE12422ED72F4FD810102A6E08729BFAD9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036065, "uuid": "90e05df2-ff74-4553-84fb-6618b925075f", "value": "6144:6kUex/i3g5f4zBtIQ5C+21DfHzHRM3VlX40iNZZ2aq6pSGyZRxCcVGxxJwjy97:6kPx/iQ5+L5CnHzROVlX40q/hqFZRb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617036065, "uuid": "6a5780bd-968a-4f86-9794-012472217e78", "value": 445798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617036065, "uuid": "8a96c69a-2b5b-4b74-8f57-1310c949b88c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036065, "uuid": "f14ff400-d09d-41f4-9f6e-2af201cc4a63", "value": "DHL AWB522947284...zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316df592-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002409, "uuid": "46298931-0a9e-433d-9312-5d9bd541ec2d", "comment": "Malware payload (AgentTesla)", "value": "4a2c7fafd4717304873fe54442d4bb1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002409, "uuid": "c83e1504-207e-4ac1-8d19-f63c564d0604", "comment": "Malware payload (AgentTesla)", "value": "8f2166421ce0ba2dc8ff3d7bf339c83813152d6e4b6d1b6fa644168c4e535b56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002409, "uuid": "a7fc2b4e-de2b-4d7a-95ab-3bdc32d168c1", "comment": "Malware payload (AgentTesla)", "value": "b96f71bc670033c667037983ce495c24af3d4fcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002409, "uuid": "b3eb972e-b1dd-4ab2-bf37-40dbb043071a", "comment": "Malware payload (AgentTesla)", "value": "4d1d9c578a9211a87411265a9b9fb0b3f0351af713999b491b1da10a972977524453959c9c14081874ad488984accb2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002409, "uuid": "f9ef979f-ba1a-4d40-880b-6a977c958ddf", "value": "7735494C1E98C2CAE2794BB892DDA49943F56FF38F12CC79BDD547CBC120B85E606522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002409, "uuid": "171a9c10-fa58-4342-a1a1-eff9aa88f96d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002409, "uuid": "f9e6a23f-2c36-461d-8dd4-11ec130fad8a", "value": "12288:DW/yDgd2Hpeo9GDPYfsGsVPcR7aJOpzrn3Xi9DoflPhuH8fFt+5eW:D/UDEWVPcReJqzD3yAsuFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002409, "uuid": "3f89c159-3b3a-454d-97f4-71eb8dfeb251", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002409, "uuid": "7eef2ba1-c32f-4c86-8d7e-1170a14edf2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002409, "uuid": "befa51e5-9691-4a7f-8bc4-058f65f2739d", "value": "4a2c7fafd4717304873fe54442d4bb1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e849c3-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1616996512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996512, "uuid": "fbec8a15-1bec-430f-afd0-9a72bde9b89f", "comment": "Malware payload (GuLoader)", "value": "896ca3527c7fd85f224350fe3ac62a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996512, "uuid": "cac9e29e-154e-447d-bbbd-c21effaa0182", "comment": "Malware payload (GuLoader)", "value": "8f62d4cfca764d43abd41f5c7a27e2364eccf566c10d48b8cd52db58cb7c9d55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996512, "uuid": "25d12f0f-cd70-4d71-a3a5-4329e6c41203", "comment": "Malware payload (GuLoader)", "value": "23356bd1bb243ef5b7a10a2b6272857de72f5357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996512, "uuid": "fb4dccdc-4c6d-4cc4-8395-a132319557a5", "comment": "Malware payload (GuLoader)", "value": "37285a375124c3b490b4dc8e0c97aac2a59dabbb8091bee4833e016bd92ab808013586ebbcac96e00e11bc3ec940c272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996512, "uuid": "3d5e6301-fc7b-485e-8976-46dbc37d7b9b", "value": "91C34A607C3C3892D73358319C729B76D112BC639C638C0F760AFA675879A6349F0A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996512, "uuid": "9919bfb2-a819-4610-ba53-188184a54c0c", "value": "3a1dabb0c190b6a5ea3886c39f544c6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996512, "uuid": "91c8ad19-8441-42f8-ac5d-fb81f6d9b266", "value": "768:wT056XVNe1Etzk8rulgy1kezveZR3T227J2kz61k:GXVG4uL1tzWZR3TLNF61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996512, "uuid": "89962091-1814-4749-98b3-0c595151915d", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996512, "uuid": "9b2544c7-df89-4692-bcdf-1bf5c9b924c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996512, "uuid": "20315dd8-81cf-4063-b76d-a5cb34bfff06", "value": "Specifications Of Products.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f46fe5f-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001734, "uuid": "e9e76590-234e-47d4-96c3-bf14a41b4108", "comment": "Malware payload", "value": "c064791c824a5c422d5dcfa02edf65a3", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001734, "uuid": "2c11b8d6-cdc4-45e1-a94e-ffc70d4688c3", "comment": "Malware payload", "value": "8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001734, "uuid": "8caa9b5c-6a13-4955-841a-074940523cd0", "comment": "Malware payload", "value": "263f71b65c1f502bd199105b21b3a27f76bc589e", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001734, "uuid": "0f809ea4-a42b-4d1c-a204-04f980c0ef55", "comment": "Malware payload", "value": "62da80c729d409a0894fb0e54232ba2ef1d9f8d39598dcfb6b4aa0094f4a9f007e40c0ace58a6b92bfd6623a5440d86f", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001734, "uuid": "d74bab48-b4b4-48a4-869d-2638ae6dfdb1", "value": "40C5BE22B3A39433D17F1A749D5682855536BE103E28B89736F93F0C4E75F817A2E392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001734, "uuid": "69399363-a6d6-4760-847e-7b33bba87433", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001734, "uuid": "6c37fef6-344c-4d71-b7d6-a5fd1a6b9d02", "value": "24576:pIZg+ui2rPO37fzH4A6haDzcUZEIdT9TagtzCN14yxDQBH1mHJfSN5MQ4+3Yb:pgOrPO37fzH4A6hanqNz0BeumQ4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001734, "uuid": "3521f645-0d03-4634-b3c0-8e68f4527896", "value": 2555280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001734, "uuid": "a226965f-cc0a-4f37-86ee-a1e1ee901489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001734, "uuid": "c2f81e00-ee3b-4da0-9488-7144ab63b57f", "value": "8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08ff648-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616996636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996636, "uuid": "5155cc16-3843-4373-a450-0149679d9653", "comment": "Malware payload (Formbook)", "value": "5cbe6cba43bcf4671b5da2bd0439ddd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996636, "uuid": "db7f9da5-a04d-41e1-a7a2-5c376a78cbca", "comment": "Malware payload (Formbook)", "value": "8fcade822dc1b07f474d920e50e3030f491983aad270ad6b9bb68755eb17998c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996636, "uuid": "7d6d16e0-c6e9-4ef6-9c27-b2176c89ab09", "comment": "Malware payload (Formbook)", "value": "ed9e970824ca10073f3a15679adf5da368847d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996636, "uuid": "d00ce105-9b01-442c-b4db-35502430c554", "comment": "Malware payload (Formbook)", "value": "f74f75c4d5ab41177e7040a668cb4538c3564107e155cc427da45e88fdf1cb1ca7bcfbee5764287f1fb0097395bc8b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996636, "uuid": "e6509fd5-74e4-44d0-8136-328ecd8dd0d1", "value": "2ED4708C5D9DC1EAE6354BB842C9C4AB46EB5EF30F12C879B9C68BC7E020746F516532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996636, "uuid": "2bd7638a-515a-4579-bf14-c401cec7238d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996636, "uuid": "2702e59b-cdde-45d6-93ed-d7de4317b052", "value": "12288:rW4udJIb1qoOrGaSsmF1nGfAIML7mO6I:rW4uXIb1ID0CAIZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996636, "uuid": "8ff76c5a-5bc3-4a95-a3bf-57494e35bb61", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996636, "uuid": "275afd53-2ab7-4b0e-936b-75eef0c5cd20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996636, "uuid": "cd400c78-65ea-4924-b659-09d7195e939a", "value": "DK Purchase Order 2021 - 00041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4ab581-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616996363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996363, "uuid": "eddb7501-bb33-4019-a0e6-d64e3c1a6a80", "comment": "Malware payload (Loki)", "value": "a5e200aa252e73c48f06e6a016c1f692", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996363, "uuid": "52245e57-39ac-4dc2-a51d-e70a7a2efbb5", "comment": "Malware payload (Loki)", "value": "912e7cdc2cc5879415742b5d7b16147049d3ab557fa2a4c14d8d20ab420d8f80", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996363, "uuid": "3834c598-922f-4920-b0c0-6cd61961b1b3", "comment": "Malware payload (Loki)", "value": "13edf062bd5f01d592e6410802b08d737dabbde5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996363, "uuid": "a5f33366-8697-4edb-813a-a8eaebd3c9bd", "comment": "Malware payload (Loki)", "value": "98d54cdfc3656604676d4daa59bd5ecf11fee669caafba4932a38f3d416b82d7ae21eb8984576df9917f32bb0e361db1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996363, "uuid": "198c5e6c-7040-4663-a268-30fc9d8e4d62", "value": "DBC533CA44CB5E12EC2F497168AFE59C1665EE10B7B5A682334DBB5421735B03ECA33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996363, "uuid": "253ef2fb-ddb3-43a5-93b1-d6b820e65103", "value": "49152:D8T+lZxr2aBxs33If725U8taEXvAjnHSYd9lcmFeljhhJwnaz:2+tzA3m2esa+A/9msqjv6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996363, "uuid": "e808d27c-2f38-4dec-a803-b8b45452b6ce", "value": 2658304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996363, "uuid": "a02b3987-db23-40f8-a3a7-1460cec45dca", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996363, "uuid": "a9108331-a37c-422e-aadc-64f0b50d78e4", "value": "Vsl Stowage plan _Particulars.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fd88d9-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "98748c0f-cfce-4d81-b1b3-f3f4630fc8c4", "comment": "Malware payload (Dridex)", "value": "18fab774889da6bd458269f0e3f4a859", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "466157f5-ff7a-4a42-ad50-91d6828bda5b", "comment": "Malware payload (Dridex)", "value": "9167df70d2583be5229bad993766436d9e179d8e3261fdea2750ad6300644a24", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "3cfd3e12-b66b-4caa-afec-05181d35969a", "comment": "Malware payload (Dridex)", "value": "c731a469567f226af80aed351ce777f8f1c91f87", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "87a80b7d-188d-4922-a5b3-2c2872aea2d3", "comment": "Malware payload (Dridex)", "value": "977278c45efe98f2652a7ab1bb7f0b8deec8b67603f78caf4edc9977f7537cc6ba83b2202b0bc39c06b84cb5fe1c0223", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "fd852bf4-bd60-4874-a0fd-c4f5e7bd63c6", "value": "E784D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "f2ba46b5-e481-4e34-be11-d6f3522a7f0d", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "72e7b10e-06cf-4595-ba6f-1d127e69141f", "value": "6144:7bazNBbycfmKsyUlVBMdUFIk1KyHNwoASpFp5xMnC1h:SzeTlVB/7HNdp5WnUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033337, "uuid": "e157d6cb-09db-42be-b412-f221e9b03de9", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033337, "uuid": "32a0aadb-f051-4004-800e-70c9dd3ca028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "e350894f-2c58-4d47-a9bb-268a33c7273e", "value": "9167df70d2583be5229bad993766436d9e179d8e3261fdea2750ad6300644a24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4ea571-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028086, "uuid": "296dbb04-e2ae-4612-89d4-ae99dc76e934", "comment": "Malware payload (Dridex)", "value": "b8d942489928ec2e686823ebca95b776", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028086, "uuid": "e400fd5e-2e17-48ff-8e4a-59530d131a7d", "comment": "Malware payload (Dridex)", "value": "929b750071140fa9372664178017db3fed6e119ab6937c8ccf7cbf2f2c892001", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028086, "uuid": "e9c99339-03f2-43aa-a586-f3bf60a7eed6", "comment": "Malware payload (Dridex)", "value": "382486a2eaf948240228e1b3d885c27600a54aeb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028086, "uuid": "b87fdb01-72ae-4eba-a251-a416c81afa41", "comment": "Malware payload (Dridex)", "value": "ca7dadd8d11865a49a149df49dce510ecbf0ed4a4027ad3438ca97082d4ca9e081482764b6b3a07af05276288aaf1cbd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028086, "uuid": "9e7d676a-eb3f-4cd4-a35b-2e9082aa23ca", "value": "2F14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028086, "uuid": "4c8daa7b-98e2-4e97-9ae5-496fecab16e8", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028086, "uuid": "f5655316-73b6-41b0-9c9d-f084ee3f7cf7", "value": "3072:dpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:dBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028086, "uuid": "aeb57f01-fafb-4317-8122-186024cf2a6d", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028086, "uuid": "b1287dd5-e62e-4fe2-8688-710442e18d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028086, "uuid": "1d842e95-16a1-4097-8197-b4322fa548e8", "value": "929b750071140fa9372664178017db3fed6e119ab6937c8ccf7cbf2f2c892001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bf254c-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617029399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029399, "uuid": "40f70265-d934-4c3b-9758-d1c86bd04ed3", "comment": "Malware payload (njrat)", "value": "42f672f78b9c71fd542d3162af32fa3b", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029399, "uuid": "14d3b96a-80e9-468b-9270-58f5989d1a58", "comment": "Malware payload (njrat)", "value": "92b11183a34d5b832d8848a1b57e41765845ecc2f79050606e2ad914b417f336", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029399, "uuid": "3ac33b4a-96df-4dcc-a39f-53f2f1416eed", "comment": "Malware payload (njrat)", "value": "2682ec05de87ec4e8f2580c6e92ff05b3af74e53", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029399, "uuid": "351fc101-36a5-488d-b8a7-887c223bc6b6", "comment": "Malware payload (njrat)", "value": "2a158d07d67f241bf29c2cbdca5a0b37edb6a4d5b69c5d136c6305979f9b52ad126003545447cbbb663dfe6645f80bec", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029399, "uuid": "778c3988-1c8c-4cb6-b070-82c289086402", "value": "CB74D1EC26709472D95FCBF3CA129DE853309F246BA0874E217076BA1BF61E5DC051BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029399, "uuid": "ab8d3532-023a-4be3-b823-dc9f985247bf", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029399, "uuid": "88d3f954-e517-4f78-8bdc-f43db76fa4f2", "value": "3072:VPA6jXFN2McHrCId4VKASmsqhjBT5t5JTu5TJ8UGub4K1GyAwz5Dg0IJs8:VhjmvrCIdJqhdT5t51exGucsqwW0Iu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029399, "uuid": "bf85f5b3-e2b6-4d71-9dac-c3d19b982313", "value": 343421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029399, "uuid": "e5f63e0c-483f-4c99-9059-c0bfe1f90756", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029399, "uuid": "1744303e-4010-4a81-9f5f-64c33c404afd", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395f7084-9099-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617027333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027333, "uuid": "633c04ed-3e91-4b5a-8758-e77dd9f25ae7", "comment": "Malware payload (AsyncRAT)", "value": "e593fa98ae74529162bc5061e1a10149", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027333, "uuid": "d5472c97-f705-4da6-a01b-b8d59c2e2da7", "comment": "Malware payload (AsyncRAT)", "value": "92e530fa9601b80190668eb15bad89205d4b8d95a53ae8d297273b1b0b1d9aae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027333, "uuid": "7939c426-7ee5-4779-80cb-b401fe8ac9a3", "comment": "Malware payload (AsyncRAT)", "value": "1c9cbf6d73822f5048258053d9097de099d76af6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027333, "uuid": "d82bfe53-6212-4043-9b13-35df7c6de73e", "comment": "Malware payload (AsyncRAT)", "value": "0d8b9cb03b861b6142456b709c8452c1e438d905764d8650f1a1f1c7d666d0cf26c58cafa603bece58998fc3791adab8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027333, "uuid": "e0aabba4-cc5a-4e37-baf2-735e6a7bca0e", "value": "5014D0137BE1C6BAE1E212738D5667A656F9F6300B2488C3A7C04B0A6E707D5DB3D391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027333, "uuid": "316516d2-8154-489b-bbcd-235baf246b63", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027333, "uuid": "05e0d717-fe5a-4e78-a377-2d358e84b40c", "value": "3072:nPilggcq3keH+T4izDTBNLXo/SYaaFPnO9DNmiXAOeegzVpuHtkcySwcPjI:nalNcyRHmPLYSYaatnmDUcwe5Ne4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027333, "uuid": "a3d8c3ef-149d-48fd-bbb5-0b9420b6a467", "value": 205110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027333, "uuid": "f52d1ec7-79ed-4bf0-a24f-26740c4293a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027333, "uuid": "88265792-1ead-4679-8df4-3a96c2dfd3be", "value": "E593FA98AE74529162BC5061E1A10149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a634b7-908d-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617022231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022231, "uuid": "eeb534ca-4465-4e1f-9cb6-daa87bbefb04", "comment": "Malware payload (njrat)", "value": "d5b7adb4ba73f96fd1140a5d53504b77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022231, "uuid": "a83fcf87-12ae-4c31-8c1c-4c39e813c13c", "comment": "Malware payload (njrat)", "value": "93bd7d65c1fbd9d30821729ef65dd01281375dc9842999b25acbaa041337231e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022231, "uuid": "04338d70-99fd-4674-bb38-a16a35b8416a", "comment": "Malware payload (njrat)", "value": "beb1846ca709d91a8ae077b0241e9a9c4b6627a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022231, "uuid": "ec8c85de-0e6a-476d-bd29-5763210f6def", "comment": "Malware payload (njrat)", "value": "f68dd0d77e4b76f327982746184143bdf75bcadf703b232128248970ec27928b4fd3b7b224834fed129b9714b55f0c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022231, "uuid": "2491afaa-b12c-4318-9324-fc5ba37e1f4c", "value": "DD938F431615D760FF88C934C6698A0497787F5A0A84F6D89CCD7C2836F5F98780AFAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022231, "uuid": "7aeff2ea-7631-4711-bad7-23d12ceeb86f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022231, "uuid": "baedeee5-26ca-494a-97dc-8096de3d2d13", "value": "384:C+MQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZaEkvTTTTTTa:CwOaxVULRpcnu4kb7FrWIOOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617022231, "uuid": "8d6ebc61-5003-4d77-b2b6-54a1cb81dcae", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617022231, "uuid": "e18afee7-c436-44fc-8671-bedc6455c9b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022231, "uuid": "acc3d2ec-e3f3-4ed9-8619-731a65dc752f", "value": "D5B7ADB4BA73F96FD1140A5D53504B77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d67ee5-9063-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617004382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004382, "uuid": "94f03c23-15c5-4d3d-a936-4880286c3f42", "comment": "Malware payload (AgentTesla)", "value": "46534bb3b2b2c2ef5c62aa2d74fe4b70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004382, "uuid": "07de499b-6e95-4d0a-9797-5a84292f46c5", "comment": "Malware payload (AgentTesla)", "value": "93c5bfb2b4a47759762d3ae4b1d80c2de8a4d41860d18c55cafa7607a8e7f1c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004382, "uuid": "13e95d72-ffe4-44b0-9dff-3fbe2b45f36e", "comment": "Malware payload (AgentTesla)", "value": "702540c4b69c4d144a9ff42f3f3d906baa955b9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004382, "uuid": "c684d390-93c9-4f14-b3b3-e6f6b6f09c9a", "comment": "Malware payload (AgentTesla)", "value": "5eed9d06a6b7aa043c2d07e94a28a1b5974f81a70a5bf31dacc23b045f8c2334209fecbdaf4320eab5b89831a16ea3ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004382, "uuid": "cda8773e-9f1f-4f10-9c1d-dfd6d01782b7", "value": "9ED3F8E4E9048CF7C9ADFC3680A935063EB9A5F7AC01590B859F41E7E9267932CD412F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004382, "uuid": "cc64fb07-a516-4932-bcce-1319e95fee8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004382, "uuid": "c41f4cb2-80b5-4ceb-ad6e-1f24281d52bd", "value": "1536:nHWhhImOXe1vHEWhhImOXe1vjgWhhImOXe1vXLPA9HdZZiD3yzVv0HAB68hR0Gzb:mfRr9/k1huOglqB36yMM1EYmE04KXel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004382, "uuid": "e6e9d192-8f5a-4599-8531-c7140896fd94", "value": 132808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004382, "uuid": "363054fd-c0c1-4d4c-84c5-e925310aa5f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004382, "uuid": "f7193def-1a0d-44ae-a960-68c091720d92", "value": "Purchase_Order494774374.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a380b00d-90a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030947, "uuid": "6baca182-70b7-4158-8a7f-0b8bd6cbda0d", "comment": "Malware payload (IcedID)", "value": "15ad1fc00276a12ddefcd250cb398d2f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030947, "uuid": "040d3764-4051-4d72-a87a-c67793cdb222", "comment": "Malware payload (IcedID)", "value": "9454816187ad8dfcea28dd662af0deb0131bc22b0bbda4f07bb257e10f4962bd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030947, "uuid": "c84cbf43-a462-45c2-a95e-200a8cb2eee4", "comment": "Malware payload (IcedID)", "value": "cc7a37a83711129587e8d506e55440f06d93fd2f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030947, "uuid": "df548ceb-a4bb-4ed7-9a52-8f0d794924e2", "comment": "Malware payload (IcedID)", "value": "b9a12cd51d87ae21341685f8790c21ebd8e3bfc846194fc01cbfff74ee87c0337ad94af27df7b17a4594c3328064da61", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030947, "uuid": "ed1280e3-3701-49c9-9db0-63110ebbaa15", "value": "5504122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030947, "uuid": "c9ee011a-6239-4ee6-a6c3-31c1e277ecda", "value": "3072:G3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:GnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030947, "uuid": "cd35018b-cc65-49ba-8395-7684d4522e4d", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030947, "uuid": "4204155a-5638-421e-82c4-b6f0a22cc183", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030947, "uuid": "aed82bef-d303-4e5f-92bb-9c934f8bc3be", "value": "Claim132783257403292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af0b986-90a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617032543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032543, "uuid": "f0d4c16f-969d-47ab-86b9-3d059aa95c62", "comment": "Malware payload (RemcosRAT)", "value": "2dfd1925b09604191c25391a57d08ea1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032543, "uuid": "ce33e451-b893-40e6-bed4-e877b7c843f6", "comment": "Malware payload (RemcosRAT)", "value": "954f0af6d2a449a9094c4cf018bbf28ab66deefd6bcc00b892343b497a580032", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032543, "uuid": "e9eb3db8-ed32-433e-9b1f-9af6ad4740d8", "comment": "Malware payload (RemcosRAT)", "value": "b1afb7c81d3c51d63ade451583d6ef104fc0b693", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032543, "uuid": "c408f5a8-328d-4a87-867e-3b4c7bd14be2", "comment": "Malware payload (RemcosRAT)", "value": "d9cbaaa208a3994df7d115d6a3f6e319bee8e660df001446dc8c51dc725d4296ffb6ed179cb3e0867cff0bbce3c49d5c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032543, "uuid": "753a5212-01f8-4e87-8512-18166c446487", "value": "9815AE7D24511B27C0388FF168D16643E7B9AC2A35A4D709CDC1B2E513BAB53258FA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032543, "uuid": "9326c864-6a51-44bc-a6ed-5f6b9fa4cb6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032543, "uuid": "7ac4ac7c-0990-4419-8dcb-7acda8e60c3a", "value": "24576:fKeca1LtnrEgGufIxp+Ufd9e0gbXj9p3ZOw:5ca1LtnILtL+Ufd9FgDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032543, "uuid": "4a1d2fad-e876-4b08-bc33-eff89eb72147", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032543, "uuid": "61a4f3ce-cb7f-4792-9225-2de752a95fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032543, "uuid": "8b27d02b-6e04-4b6b-ae50-dfdb8e6a6547", "value": "\u0936\u0940\u0918\u094d\u0930\u0917\u093e\u092e\u0940 \u092a\u094d\u0930\u0924\u093f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28eebb5f-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002394, "uuid": "be09be29-5a43-43a9-a147-e7afaa0e0ab3", "comment": "Malware payload (AgentTesla)", "value": "35ffbec6d8f7ecec39e510ff91579e1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002394, "uuid": "f1b7b14b-1566-4ba2-b49c-490360e9ce62", "comment": "Malware payload (AgentTesla)", "value": "959f34ff3a9e32492949f0e138893634c824d45f0d872ebc331da4850a48f762", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002394, "uuid": "d672b495-accf-4642-b4d8-1f401265d0a3", "comment": "Malware payload (AgentTesla)", "value": "8d6b94898326c2119cfa46409916ff1284134d36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002394, "uuid": "e617547b-93cd-4ccd-8e3f-f10912872d73", "comment": "Malware payload (AgentTesla)", "value": "1384401d919009856e52c8f271c505eedf7df9fb16327aa15dab10361f9b0093367d4e5391c4931ed07e113c0471a725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002394, "uuid": "d6769bf0-2523-40a2-afba-c6baae789cd0", "value": "46454A8C1E98C2CAE1794BB891DDA49943F56EF38F21CC7ABDD547CBC230B41E606526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002394, "uuid": "d1ceba69-b8e6-4c24-9585-8a223025b51c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002394, "uuid": "40ecd0fd-5a36-4f10-a141-94b828f8ea5c", "value": "12288:sPdwuS5IejAyAPRd97oFfVmBAcRQ5mdWFM5iC0mFp4X4d8eYvPoxpYsB16xDb+Tk:sDZJC9muVqtiC0mvCk8eA8SyYDb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002394, "uuid": "2fa814e2-4b75-4a6f-b6e6-271b56592ca2", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002394, "uuid": "eb734277-8702-4b35-9981-1b05cab94218", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002394, "uuid": "f8290c1a-cd96-43bc-bcbe-7db6a0025811", "value": "35ffbec6d8f7ecec39e510ff91579e1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98017fd5-90aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617034793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034793, "uuid": "76d38404-1d79-49c4-ba4f-a4c1a3dfb5c0", "comment": "Malware payload (Formbook)", "value": "35ec286fff021ec808486bdeff3b320a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034793, "uuid": "cdc16bff-b55b-4076-a9cd-71a4ea50b769", "comment": "Malware payload (Formbook)", "value": "95eedb3eaf98ec12d5f66609278d43f94e1f635420d413ee0672bbf9434aafa4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034793, "uuid": "126f2677-74f6-4056-9025-98da26b8453b", "comment": "Malware payload (Formbook)", "value": "ff73383bcbc869b82e28f4399dd8b08e28a9b4de", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034793, "uuid": "8ae3b809-661b-4f55-80aa-487b0c03ede6", "comment": "Malware payload (Formbook)", "value": "827d33c32ab748bc1d182c2130f3df0d325b2364981b367437d58cb1511b03278b023477659b6f3ee42ca7e7cb7d6874", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034793, "uuid": "049a16b7-6ef6-4b7b-a79d-bdaa29eba7a8", "value": "172412AF22E198EBE48149F005A2DD7BF2BB97193720043357326F7E35516C2ED5A48E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034793, "uuid": "fb3423b8-e039-4f87-982a-0d2594b1b88f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034793, "uuid": "270b1ae7-1688-43f1-9c07-6fe2d18b1c9b", "value": "3072:3Ts3BxJNmJ8Lghnhio9IWKuJnJsxoEtbntlg+1DFNSh39VYMvAcyyVzgEDbvIur3:3APnghEaKuJoT7g+1DFm3nxoc5FzP6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617034793, "uuid": "86596f59-4c5b-4267-a505-e70744387dd0", "value": 217264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617034793, "uuid": "55307c54-b7f2-478c-9604-1741ba9a5cea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034793, "uuid": "c5ef4cde-4f4f-471e-a446-a9ea705cecb2", "value": "SWIFT001_jpg.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a523cc6-9074-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617011362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011362, "uuid": "388bf335-3b8e-4e52-a6bb-12fc8a47bb9d", "comment": "Malware payload (AgentTesla)", "value": "c9a80a3a2484a1abe3a16f1ff532f757", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011362, "uuid": "34a028be-a7d3-44f2-a116-47145559b396", "comment": "Malware payload (AgentTesla)", "value": "961b0d1fdca9f4024ac4a3a8d90227433276a7f0e204d0aae55291fa98006284", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011362, "uuid": "52f19710-0f07-4eb2-9925-0059cd01208e", "comment": "Malware payload (AgentTesla)", "value": "a8e4b3ac1e47e7199da318799229bbfaa26ed145", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011362, "uuid": "a7e51776-42ab-4add-8a66-e6a58ae8affa", "comment": "Malware payload (AgentTesla)", "value": "4591143568f2ad8c7c9589ed15a130463afa223f0d8c8a3c2f7d56096b10fdc9dee0e3ed4a6b30d967f5a980736d01ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011362, "uuid": "2101b33d-441b-41c0-960a-e4a0ce11416e", "value": "34258D1213271626F1763BB81010F3753BB1EEE5A13AF6A59ED43C93B8913C0A97AD74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011362, "uuid": "c69d3135-75c7-4305-9f0c-edbd858b6d0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011362, "uuid": "90ead9e3-b251-4f21-ae20-f62f801720fa", "value": "24576:oul45Fpn6ZXxUd3Jo1QxpB6r6KECvHpJdY:or5FAx83J5l6Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011362, "uuid": "db3c1b4a-68b9-441b-b94b-c921d212a24c", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011362, "uuid": "9b0c5ce5-d668-43e2-a73a-18350622c4d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011362, "uuid": "b31e0deb-9016-4bb8-9d76-02f3f3d5c132", "value": "DHL_document11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1ffbf7-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617025946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025946, "uuid": "3e99af3f-ed86-49a7-9feb-0a0df46a757d", "comment": "Malware payload (AgentTesla)", "value": "29330051fd2e5fc2f75661b5eebb827a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025946, "uuid": "eeceb34b-dea0-4555-89c7-77d2ef06dbd3", "comment": "Malware payload (AgentTesla)", "value": "9676d4521e442df6439e414bf467a7add53780ddd857808efcb5ffc359a80a68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025946, "uuid": "fa5dbd28-6292-45dd-88fe-4ec9b8eaaf16", "comment": "Malware payload (AgentTesla)", "value": "d3a8d4199f8d1a5c0fccdd729a15c96aa0fe7897", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025946, "uuid": "fb8ba9d3-68b3-46f7-ab45-577753b5fb27", "comment": "Malware payload (AgentTesla)", "value": "6e08c39a9825357c16cacebd68621a1c02865f3accc56c8b5c6fd2fd6f38a1c6d22e583dc87441b5e674ad1f6c88a5f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025946, "uuid": "49f1a743-4bf4-462a-8440-bb9799569058", "value": "3725D48C6E99C1CAC5390B7842C9C8F646E95FF34F22887AB9C45FCBF431745E50A626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025946, "uuid": "d3aa9620-0d2d-4a2c-9770-cfa97a94aeb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025946, "uuid": "706de64e-c2fe-414e-808b-9d4225a79855", "value": "24576:fgMhltVUssEciJ1sg+F4x+ZuV7mVDHeMS:TKg04xJ7mFeMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025946, "uuid": "80a4138b-0252-4883-baa3-f5601f3f14e1", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025946, "uuid": "235f72a5-c13a-4d52-95d7-cd5f156ef2d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025946, "uuid": "c83a412e-0b93-414a-a451-ecda5182bd73", "value": "29330051fd2e5fc2f75661b5eebb827a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d06c25-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031241, "uuid": "dd861100-cb67-4b89-b4d2-7e340fc9ad6e", "comment": "Malware payload (IcedID)", "value": "d4f59a456600cc66f4a826a02a9dfd3d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031241, "uuid": "daaab37d-843e-40aa-9b1e-f92095bb844c", "comment": "Malware payload (IcedID)", "value": "9787e15fcaf690b6d7ace0c2d93d07eecee9fec9bf58a6655947e1bd7715d48d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031241, "uuid": "4d62146f-769c-4a9a-a55b-27c85b9b0140", "comment": "Malware payload (IcedID)", "value": "a0cefeaea4599c067f7e753eb340234f497e1bcd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031241, "uuid": "68faafbe-bb49-400d-99ee-a4c7ee97f7a6", "comment": "Malware payload (IcedID)", "value": "fbc94de1847d16b7d30714c6bfd398dd66843222dcb2eac7956b00ce233d6beecdc8d21d7ce4a9c41446b8be3a9cf4bb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031241, "uuid": "613ff782-afa8-40e4-8a96-6b854494c71d", "value": "50B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031241, "uuid": "9ad6498a-3093-4bef-930a-1cc4c21994a7", "value": "3072:M26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:MLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031241, "uuid": "bc3b49bf-fa0a-4c08-add8-4a61ab2bb6fb", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031241, "uuid": "a7793b6d-925b-4f82-bf15-22e5a989b598", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031241, "uuid": "64aeac9b-9e79-4b58-8147-7669c55e06c9", "value": "document-2074639396.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ed4dd0-9093-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617024965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024965, "uuid": "ec1c5a42-dbbd-4047-bf37-214149498b8f", "comment": "Malware payload (Formbook)", "value": "72f0cc7dfb652a7fe1977633981f875f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024965, "uuid": "133085ea-5af5-4a3b-8f39-c98b9bf474a8", "comment": "Malware payload (Formbook)", "value": "97d4de7a9478320c718f18c0f57349cfc611f5dee0aab5271304e4670e63d2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024965, "uuid": "69654e2b-25f0-44f2-a3f1-2c6ddd9bb39a", "comment": "Malware payload (Formbook)", "value": "202672e2efd4d0d45662c3ddcca98969e561d112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024965, "uuid": "cc772186-29ed-47f6-848c-e9f70f9c0040", "comment": "Malware payload (Formbook)", "value": "81a072cdad78b346791edf193637928c99a9a1d6bab6ed56baa2c37fbeeae3409e2b0ccd1bd3d48197dbfc8eab3f6abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024965, "uuid": "e1823aa5-caf5-4097-900a-b9933ce907a5", "value": "F8847D1B92CB75C1C40A27F30D3C68DB9FA66EC43D799A5EC6E8FC20D77A5911A8C016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024965, "uuid": "62a2263c-ab59-4f34-a1f4-e77fe26545e2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024965, "uuid": "da01b200-e8c3-4eaa-aec0-c6f67bb51361", "value": "6144:3APk/N5V8d4/lMB7gWVFo5INIA70keP/BnaXmqF2OFq5b6c:1N5adklM6ZeISTmnaWLB6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024965, "uuid": "ea2be690-c579-48d8-b770-dbc0e0599687", "value": 401745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024965, "uuid": "3ed9e480-1319-481d-97ad-0030f3f998b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024965, "uuid": "5a520e69-5f13-4c87-8537-967ebd66192a", "value": "New Purchase Order GH934782GHY489330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845a0783-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029606, "uuid": "2571303f-c553-43a7-9993-cad879ffed1c", "comment": "Malware payload (Dridex)", "value": "53fc11e15a2ec1311f8706d77524f539", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029606, "uuid": "7de39f20-7665-4b8e-bcad-96976f63a5b2", "comment": "Malware payload (Dridex)", "value": "97e112177ab77d10b015285637e89cbc4bb9c9260bcc260acc4e6b2ba7759f86", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029606, "uuid": "e93feebb-5e77-48e7-a9cd-384d6e9f2187", "comment": "Malware payload (Dridex)", "value": "64bae7a307d0091de3e39c8afe5cbbc27408e084", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029606, "uuid": "2f7a3bda-b2e9-43aa-b06f-27e78ff465a5", "comment": "Malware payload (Dridex)", "value": "0b1463ea67f80a7e683a8b3f87e00f394726e62252ca68039c998693c5c7216408a6618a05ef94a75fc2d49a3b486a02", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029606, "uuid": "222b7c6a-b02f-4f77-9dce-2a72cf58cd8b", "value": "4B84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029606, "uuid": "0a902ca8-2023-47d4-afc2-209bf5e8e019", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029606, "uuid": "626035da-f5db-4aa1-bcf9-5a24bd616204", "value": "6144:zbazNBbycfmKsyUlVcMdUFIk1KyHNwoAFpFp5xM8C1h:azeTlVc/7HNup5W8Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029606, "uuid": "a5652b49-1705-41f0-9239-4f1e635d7a05", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029606, "uuid": "de3e41f5-3b58-4291-b39d-97d363455cdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029606, "uuid": "eb4e9526-2088-4e15-a57e-37c3b2a31a0f", "value": "97e112177ab77d10b015285637e89cbc4bb9c9260bcc260acc4e6b2ba7759f86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af212df3-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001760, "uuid": "a196fbe5-8c97-4b94-9d5a-b84e0a22a014", "comment": "Malware payload", "value": "72bd252201771166ec7522d0534025dd", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001760, "uuid": "953a8e96-6280-4cd6-b1c0-6b6f5fa1d277", "comment": "Malware payload", "value": "987506b904adf02794b1c51f8b166aa4ea284454607e133ef0d5d003aba64b00", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001760, "uuid": "5110a927-8112-4337-9dd8-ce3ee304ce65", "comment": "Malware payload", "value": "744d0113296a443202061c81d81fdb718d6090ed", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001760, "uuid": "e872e193-6179-4fe3-9f09-df25d5df75c9", "comment": "Malware payload", "value": "e9495dfc30a74b79a7919829a437903b3c9b55b7b731fd7becddc9c50c9b7de519faf5839b45292997ee1d9f3d4a5c5a", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001760, "uuid": "a897eaf6-c0e9-438d-a096-c2b07679efc3", "value": "1BD633862E544080FDF36A37CE9F576731646FD05A8C48FA73122F3825E6A15CE24AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001760, "uuid": "4aa1933a-71c8-44d8-8b31-1cbc6f438091", "value": "393216:vCC7p7Avb3HKmWktAiOg6GvjwPO/tAjAVnOd9:vCC7BOJWrHEzSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001760, "uuid": "16677d1f-f1b3-4f19-b149-5c0b3c5a1856", "value": 13485968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001760, "uuid": "5b080174-6b5b-439d-a235-e5aadd1f4712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001760, "uuid": "46a2a572-29c1-4c5f-89a7-69cf48b8ba98", "value": "987506b904adf02794b1c51f8b166aa4ea284454607e133ef0d5d003aba64b00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1afbcd-9092-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024435, "uuid": "98579b4c-1d29-4088-b166-ed8f11aea038", "comment": "Malware payload (AgentTesla)", "value": "87b319e6d37a5006d9040dd12b0df205", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024435, "uuid": "7d8c796c-fdd5-42b7-bb60-cad5e2b0ff97", "comment": "Malware payload (AgentTesla)", "value": "989f330817cadbe60308cdd0977792aa3ee8fd2f55b2e92ed32d2416de16c32d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024435, "uuid": "d4c24207-ee3a-46c3-9669-17a4e1ecf08f", "comment": "Malware payload (AgentTesla)", "value": "91b9df226d7bd856867b6a4b8d82f5c9131072e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024435, "uuid": "f40c67af-7015-482c-9272-ac9ef97a20fa", "comment": "Malware payload (AgentTesla)", "value": "8be57f37928a395c668323d9d2916c25eb9c027c3f769fb58b7e71f9531b95d4068136dfffb6b3d6cb2595a784fa8dec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024435, "uuid": "2a8a4b5e-224d-4df7-b3cc-4e454539c0f2", "value": "75B3D6D4A9D404FBD5BCFB36C0D67506726BA4FB2812592B488B41D7EC32A832CD991F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024435, "uuid": "53a446c0-a864-4061-99e7-adda060c9400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024435, "uuid": "054b0814-4595-485b-9fcc-38f62603f9b3", "value": "1536:csQtXvvVI4RcFgpQv8ch+oeqFknNmnDAC9k2IxaRNpmyC16/:csQtXv57Q+qFkNmjS2aaAyC16/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024435, "uuid": "51ef87d9-357a-4e48-bdcc-14b981299e8f", "value": 108712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024435, "uuid": "d90ac6e1-02f7-4731-b9f5-8275e731b357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024435, "uuid": "49a0907b-3422-44eb-a57d-bd70fa6fbd94", "value": "DHL_document11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94eb0d1-9028-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1616979041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616979041, "uuid": "9b102c45-eff1-4540-8013-4f3e0104f975", "comment": "Malware payload (BitRAT)", "value": "a8d2022b7ec6bf909bf08b9762747ad5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616979041, "uuid": "9a61d455-6b8b-4054-b6a4-fe88ae37a760", "comment": "Malware payload (BitRAT)", "value": "98f10643b82275794bc9708dbffdb248e5f715a7207e1c4a4a453cd7cfa7a059", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616979041, "uuid": "dc61b8f9-7afe-4ece-b5dd-6ea68e11a6b1", "comment": "Malware payload (BitRAT)", "value": "f4be2dc8d02e05c656cb3e90b89f6ff39e9f47c5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616979041, "uuid": "0e25a767-a115-46a0-a841-9b2b8fbb7aa7", "comment": "Malware payload (BitRAT)", "value": "df7729473ed169a8ba0bcd73c6d43e3086e49f8eb5f187485b80cbbdcb88c17e9e04aa00ad720acf7b09ab24a513bab0", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616979041, "uuid": "b06c2143-6738-44d6-aa2e-895b2984a54e", "value": "F6A69B32FBC3C761D357013CA97D7E7B0328A5E407D04583628B1E585AA5FB16A27A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616979041, "uuid": "71b8e2e0-9bc8-4f9c-83c1-6a485447047d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616979041, "uuid": "8d22af70-4dff-457b-8ffd-38991b57a9ee", "value": "196608:AOPP4XkAhs/zpA4xv0Q4InlElYdFSQp5yTI/sj+Zzlgccpf:TxZlaYdIQ+j+ZzUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616979041, "uuid": "818c2a85-5052-4346-8634-d6bdab1a4a17", "value": 9498624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616979041, "uuid": "9e1b56bd-c060-4455-94d8-b12d576bc46c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616979041, "uuid": "b98110d8-e705-438e-9a1a-b79fb0da53a2", "value": "A8D2022B7EC6BF909BF08B9762747AD5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0f877f-907a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617014155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014155, "uuid": "864f02b1-0218-4868-aa08-4dc2f8fc3ecf", "comment": "Malware payload (NanoCore)", "value": "b868c83456fcccb2f3a724629d32a8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014155, "uuid": "b860207f-9ccb-44ad-96d0-b651b8a12951", "comment": "Malware payload (NanoCore)", "value": "98ff46d3e4e597b5e13ad608b3d375688e3c2be42b5c69337023726701c964a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014155, "uuid": "bc4db9e5-fc4b-48b0-9e07-672888637cbc", "comment": "Malware payload (NanoCore)", "value": "f46c453a3dfdc97240d344aaf3e1d41d1d5651c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014155, "uuid": "74fed176-6b22-4076-b3e1-7e1d89ae7cdf", "comment": "Malware payload (NanoCore)", "value": "841dfa5253354e79ae338dc8bc02bceb9f2de3737e435db86d6b0731cdc0f0a5a26f25118a1e3f934a9452bb24842014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014155, "uuid": "3f5f74ea-0ae2-437a-bb36-f7b9750c09b1", "value": "DC041205E765473ED0540E346ABF0AEE27FDC9460725F60FE352DAC725A06EC4E83A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014155, "uuid": "b28780f2-277a-40ac-b0c7-cfedbe8d82f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014155, "uuid": "5e262cfb-6526-4dd9-ba18-ad187b9c70ca", "value": "3072:uZMeWzGaOR/IzFsS7tC8Rd8cNhMYa7X1AsFgantVx4vklXWlOhrb+Ui7b:+M5Sae/Izm2t18Z7X1A6nV4clXJXO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014155, "uuid": "f8fba91f-a9e2-4d57-8701-afe13b758d95", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014155, "uuid": "00904eaf-4416-4f66-9242-d9a613bb5168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014155, "uuid": "cb80ece8-ff5d-4361-a5a8-e5019838d1be", "value": "B868C83456FCCCB2F3A724629D32A8EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658288a1-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617025689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025689, "uuid": "c1c68eab-26f7-4bdd-8b79-c50e815e335c", "comment": "Malware payload (NanoCore)", "value": "43765717b01d03954f97d466756547ee", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025689, "uuid": "7559df0a-0839-4826-8622-eea61264ef8c", "comment": "Malware payload (NanoCore)", "value": "99ab5700d6f2f6a8482941baf8bd5e984c5772710b63b2431baea9d26f014474", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025689, "uuid": "b1beb3c5-5ca5-40f1-8635-520b52d4f592", "comment": "Malware payload (NanoCore)", "value": "933c0ab688d77ebbc5937e55ae133a459237c7b3", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025689, "uuid": "af49c1ee-d2e3-41f6-9a61-d14152717f8b", "comment": "Malware payload (NanoCore)", "value": "5734cc923d2caec51815c44da5c18b3e053f5b2589e187067f167f14b5211f05a34f6b51aa1c66222fa055ec5395b9c6", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025689, "uuid": "2171255b-a217-4863-9fb4-8856d69f1c68", "value": "79C53321AFCB9F03C82D5B72DA4B60A855AA8C006F5DCC1A3B1976353737570E69337A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025689, "uuid": "259acc78-58c8-4665-a8a0-15c9ec6cc347", "value": "49152:WgF8KnzYDi1uBlMTM3CsWVXkTnFDndDt8HC2I3Agg076wEo:WghzjT2UkxVt8i2I3Agv7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025689, "uuid": "f02ac71c-199a-4ffa-8d7d-9de5b078108d", "value": 2571264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025689, "uuid": "3e1b2eb0-217d-4c59-a928-c679c8bcc574", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025689, "uuid": "f5ca08a2-770a-429a-a15d-283016261eeb", "value": "Ref 19117030.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95492349-909f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617030064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030064, "uuid": "33562541-2a8d-4c37-b60e-be2597fba00c", "comment": "Malware payload (AgentTesla)", "value": "c00c56cc3d27cd9eb2676e170fe20c62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030064, "uuid": "01d27474-a826-4ce1-b5a1-9af0f0cab6a2", "comment": "Malware payload (AgentTesla)", "value": "99d6404e4262cbe32a216ae2493bb98d809345d69b8195ae7266b0114d16a587", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030064, "uuid": "b7eeb155-e405-4233-a886-7157544f82f2", "comment": "Malware payload (AgentTesla)", "value": "1fe7286e08fcf993b3af10744f9b48f474554c3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030064, "uuid": "4560a855-82d0-4cca-ad2c-19d7853c903d", "comment": "Malware payload (AgentTesla)", "value": "b5d0dd84aa61cff3d797d8a23999dd07aaf9b6bbb5053094a44772cb95109e6ed8bbd0d1ff432b30535265c7644660f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030064, "uuid": "d0122dd9-14a9-428f-9bfd-ccba29444279", "value": "9CD469A321FC31EFE40AA33955570A5E5F507F72AA378D0E903639F86739F858522C92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030064, "uuid": "297bcfea-4dcd-45ef-87e8-9b3133bde325", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030064, "uuid": "76f0c9ed-e498-4cca-af8a-e4147132fc09", "value": "12288:oxyAHcUYLMLCCPMMWKFrl3kRlR/ZFnVmqxL31Huyg3RmTsC5:KjHS2NgJtuvPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030064, "uuid": "88df300c-5f00-48ec-83e5-d6ddf1339dd7", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030064, "uuid": "9df35935-66b7-4527-964e-20afce7b6bd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030064, "uuid": "4737e856-0b9b-4e68-9d01-1f53ad5295bb", "value": "Wrong_Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ca9ace-9080-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617016784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016784, "uuid": "fc924445-7933-425d-bf1f-3d983dbf7396", "comment": "Malware payload", "value": "9eb6815612c774d4344eb82a1a2113cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016784, "uuid": "f38f23fc-66fc-4820-975b-b05155b12008", "comment": "Malware payload", "value": "9a80d362fb152ee89fc8bb35e54d65eb9d229b516a57ce43413f2596daef0c8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016784, "uuid": "22c36224-cddf-4e19-a12a-ef8bef57e217", "comment": "Malware payload", "value": "a0dd83d7e2dc15a65a8c09edcf97d10055ce4f07", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016784, "uuid": "3297f8b7-3701-4cd9-8094-11d10520e429", "comment": "Malware payload", "value": "f4f5112bad6018d9598d7038729763e8358a478bb2ac63ade631d72f903a87a1bd2ab3284ebcac7ae8dac33bd642ab8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016784, "uuid": "14fb0591-32a8-4687-82fa-6af7b9dffb40", "value": "1CF3132742C6E6147EA9198D8CFF8C9C04692D7910C4F181AAD68D06A7FED0BDB6EC5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016784, "uuid": "da5e8f4b-7d85-4850-9d3b-298de52bd8dd", "value": "3072:cQVPF6L6JTeXqxKk+9xMWohaoskOzqu+yd5FE5DXdEtae9cgvSaTQ3tGQR7U0k7o:DdeXqoFvMpsXq0dWDNEtaacgvLcGEFkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016784, "uuid": "3feb7dda-59d2-489e-bc71-c225502f315c", "value": 172977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016784, "uuid": "5e8a6863-b33a-4629-b205-cbefcc44c4fb", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016784, "uuid": "fb9d27a2-2374-4505-a30d-4f3358809aa2", "value": "Rfq Attached 202103_Top Urgent (9).gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f87491-9062-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617003730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003730, "uuid": "d7e2fba3-987e-47c2-a3b0-2bf34ab4e8be", "comment": "Malware payload (NanoCore)", "value": "6a71c61c1ab9ca5447a643340d16a7a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003730, "uuid": "e566dc57-604a-4e77-bca2-42ed24ff59de", "comment": "Malware payload (NanoCore)", "value": "9afed327a87143bc451d2701dc2b662bc90b640009b5a1f717b73860291cf559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003730, "uuid": "44a510db-7a84-4d72-9239-93c688fc8a27", "comment": "Malware payload (NanoCore)", "value": "bac14cc45b2655b51a3ebcb7e854ac6fcbc51ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003730, "uuid": "33e8c93b-2228-455d-a61f-a08c644bcee0", "comment": "Malware payload (NanoCore)", "value": "213b8a187f40210642a36e4a1198b90d39dc30459bbdf7111fb4690dc0d8ee5c2d34cfba3f785e970cf32b8df11c451e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003730, "uuid": "8e757555-9d9a-4d71-b998-fa949fafb64f", "value": "F1E4AD2272540BA5FC3A7379443B852413F2BE99D632D71E3DEB77665FB36820063A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003730, "uuid": "b20e0368-3c23-4246-9c7a-f3a525e5818f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003730, "uuid": "e52ab01a-0a84-4602-87bf-5671684d6fe1", "value": "12288:A4niO5yvAioJexddHAias3RLkhOhUyOUr5d3VDGK:Hi9obgdHvBehYUyOm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617003730, "uuid": "92c282df-1f03-407d-b1cf-d46fc93a2774", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617003730, "uuid": "aa871576-7e96-4595-9c3b-733604023bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003730, "uuid": "b825d361-7fa0-4f68-9833-4604d6e48706", "value": "New Order 567w43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efde154-90d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617051528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051528, "uuid": "3181e490-7426-4c4b-a6b7-8ced719a8476", "comment": "Malware payload (SilentBuilder)", "value": "2b0e8b9cee363d0d50b3501f6e99849b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051528, "uuid": "01d80040-1227-416e-8da4-d2d6a8252deb", "comment": "Malware payload (SilentBuilder)", "value": "9b1c03b0cca23a94f2d6988c66eb0d246ec2648623765e83dbf20548ac874837", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051528, "uuid": "a1a2d739-8258-44bc-b7eb-90fc7a6bc474", "comment": "Malware payload (SilentBuilder)", "value": "1a2e1545d7bd19940e9db02795d093ed577e32e5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051528, "uuid": "91414882-288a-4ed3-a52f-0597af3a96c9", "comment": "Malware payload (SilentBuilder)", "value": "7e78f4891c6502312b8c7223ab955c4a7d852556402547f61c3e803ec68750cac0bad26f833924f43b968143da85f57c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051528, "uuid": "3034b5c5-4bb9-4d1f-b098-20d527a355d1", "value": "1BA412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051528, "uuid": "206d6211-6582-4bfe-974e-d386c7a74809", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7F:dEKXJ0MDs8QTjVJVf4k4ZiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051528, "uuid": "dc6d9a5c-0e1c-4e58-a2d3-bdba5c4bab3e", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051528, "uuid": "88ba3fc0-0e93-42d0-9fb5-7c32e79e3b84", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051528, "uuid": "9d81af13-a4a7-4a80-b4b9-cef6928cd719", "value": "SecuriteInfo.com.Heur.6869.19144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0637a3bd-9096-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617025958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025958, "uuid": "6d97fa73-1109-4a18-9704-fbcc7f43b6b1", "comment": "Malware payload (Formbook)", "value": "96975b94c21fe69fa2fd6b7b6ba05d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025958, "uuid": "a71c0020-c505-4c3e-a689-add134180b0d", "comment": "Malware payload (Formbook)", "value": "9ca3fc285954513515ada3b50fc29e54e92d73af802b736abc3402c5ac03cba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025958, "uuid": "6c1238aa-3f0f-4f08-ae3e-70adec7940ac", "comment": "Malware payload (Formbook)", "value": "40b26d236ac178674a0cbc6c8e16a340ac653780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025958, "uuid": "efcc2e96-697f-4996-992a-e17bd1c29aed", "comment": "Malware payload (Formbook)", "value": "fb05beee38f54b790b00e93b9cf1d948491584f3c22ec612dbda65dddd5cb9345e6b1ebd5b2c6b9691698880f599b94b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025958, "uuid": "5c76263d-a170-41de-afa1-351d6974216e", "value": "D515B28C2E99C1CAC6390B7842C9C4F646E95FF34F22887AB9C45FCBF531745E50A626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025958, "uuid": "52c67570-5560-4929-9d52-fe19bd541d03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025958, "uuid": "0a3a79be-b8a5-4982-b506-298284604ce3", "value": "12288:CFgMhltXSuJ2iN+GVj+YMZpjqGVgKtuhycsPHL:wgMhltXSuJ1fSY2F1PYyP/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025958, "uuid": "6daa5157-90f0-486b-ae65-85cb8586a3e1", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025958, "uuid": "73f3f61b-1f6b-41f9-a96c-8bc184e3c313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025958, "uuid": "fca34bcd-9c85-4a04-b675-b227e7192ea8", "value": "96975b94c21fe69fa2fd6b7b6ba05d7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e2cda9-9058-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999574, "uuid": "f727c118-514b-4d3a-8875-f9294856cde2", "comment": "Malware payload", "value": "f45d1c78c5edb4b1d7ecc4caae17fc67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999574, "uuid": "1b7c8d27-9302-4fbe-a4dc-93202b078d61", "comment": "Malware payload", "value": "9d45441d58ba7689af370aeab758105e7b39f22b1cd1d8d0c7fdd47b7b9db3cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999574, "uuid": "e98545d1-23aa-4a9d-9585-e2841d7878c5", "comment": "Malware payload", "value": "4db9f5d8d9a37d7a11aa4e6d500e705393af421e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999574, "uuid": "539e3005-3198-4028-8a7e-b3fbf5bf2449", "comment": "Malware payload", "value": "56ef92b2c3221712db898694c29391a3760f7a3af60db6c701f2e583c9ce628bc77d900c8bd7830884089d98afb2bed6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999574, "uuid": "dce3e1ef-3d4d-4801-b67b-8a9cad4611e3", "value": "24E502E4B7E4A567E1801C41912D7184581BF16984C2ACD4F0F9FFF70BDB2B9F96A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999574, "uuid": "e8db323f-197d-48c1-8e57-773583daddd1", "value": "49152:gwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwFwzD:XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999574, "uuid": "72bb0747-0cdd-4d5c-af64-6e1c0c31cd6f", "value": 3195939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999574, "uuid": "3a5f4c4b-bc46-4ae7-a0f9-a3e090ad540c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999574, "uuid": "dfe14fda-4e07-423b-89b1-22d67239ce87", "value": "OC CVE9362 _TVOP-MIO 24.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f8b820-902b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616980215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980215, "uuid": "5b55d494-fd52-4b65-b865-89be391d9a1c", "comment": "Malware payload (RedLineStealer)", "value": "f79c39f4f1e046a2e2cf7debe15bfbd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980215, "uuid": "027816e5-24cf-4542-b232-2c74ec9efad8", "comment": "Malware payload (RedLineStealer)", "value": "9f6213768398115934da0a8ad4c3a6c021f6faa1103c25bb9d994153b08b9e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980215, "uuid": "10a41ae5-d418-4447-953d-df88a44b3030", "comment": "Malware payload (RedLineStealer)", "value": "fa99bb348a7b8608ba5f628516c443f545eb39bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980215, "uuid": "8c007629-4c46-4bb6-9ec3-2ac360af3d1d", "comment": "Malware payload (RedLineStealer)", "value": "3b60d58daf7c0c76ce514a817614a96f97e290784484254a25d8e96422f89e721843dfc9e159c7adcffe4ab83a8e94e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980215, "uuid": "a1e0722c-287f-4535-801a-25fa0ff7d80d", "value": "AF8412713516F82FD602AD37D57A83390BA52E111CD466137B207BDF6E365803E2F2A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980215, "uuid": "af72390c-3374-4cb3-938a-788ebd089212", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980215, "uuid": "113c0499-8659-4ebe-8c1e-27b6178aff38", "value": "6144:wY8ikha6ECtZev0rZRW79P7OOOx3jLn3jOhaJhbO6jCoUbZ5WRHe6:6I6dtM8loJPiRTDTOhaJ9O6jCoUbZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616980215, "uuid": "2f36e027-cae4-46f0-9c21-83d8693c6076", "value": 383052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616980215, "uuid": "cb331e6e-2fd2-480a-9076-19b1a4757a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980215, "uuid": "283d3952-1402-455b-8409-33e0d30fc343", "value": "f79c39f4f1e046a2e2cf7debe15bfbd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c540e6d5-908a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617021125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021125, "uuid": "e0a8091b-4a74-456f-b06c-c8eb6b9dbe15", "comment": "Malware payload (AgentTesla)", "value": "56a926b5b6704a0494dc8a403d37af14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021125, "uuid": "d7bbf23e-b37b-488c-bbb3-110cc5e69ab7", "comment": "Malware payload (AgentTesla)", "value": "9f750eae7b19df541538b955b7da6ee7963c407523d53c32dc7a1968b2c47e1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021125, "uuid": "0e8b3635-32ed-4d59-9b3c-38d43600529f", "comment": "Malware payload (AgentTesla)", "value": "75dc727d1e019edce9536eef96c002d60ccf1162", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021125, "uuid": "304dd815-f483-48af-a206-604d4f302e1d", "comment": "Malware payload (AgentTesla)", "value": "086071594c972f1602f765b6f7df39f718e847a8ae34ce5f25d60f16047524ecd5ba6d0fc57b0caa0b0969fa836a7ade", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021125, "uuid": "ccb00b15-0feb-46cd-9c82-fd1161128f20", "value": "13E423DB98CD9F09DBB6BE2A6E9A5010DD0118CB6699C423F344D293DD3F9472C98D32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021125, "uuid": "5dcf2fa7-b196-42e8-9bcc-ff7a8228af04", "value": "12288:sZtcyGhal0SWjFZZkoJfaSzAcHoeg0bH5INnTDv/VJu1Zv6czkZYJ8gdO8vHlfz5:sZtcyG4l0SWjFcoJCuAotT5INnTDv/76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617021125, "uuid": "7632c7fd-b71c-4b38-a01c-2717fb672085", "value": 696540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617021125, "uuid": "66613417-8cb6-450e-b4ff-b89b4bb3c91f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021125, "uuid": "854e62fa-062c-4106-abfe-824116a0821e", "value": "payment TT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4532fccd-9088-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617020051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020051, "uuid": "8cad9c73-05e9-44af-b3a1-a033a751f2a2", "comment": "Malware payload (Loki)", "value": "3897247033e12d0208ba5e1cf3a5883b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020051, "uuid": "a47021de-4a32-469d-8495-9673fa64051c", "comment": "Malware payload (Loki)", "value": "a05b241f585a7d3582d4772160ee960f38e968a64b37b07142d1e86cc7299f6d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020051, "uuid": "42d59ae4-9d41-4393-9220-7f2aea31b8ff", "comment": "Malware payload (Loki)", "value": "5a786ce6362ee430423db00aa4ac6fae16f2c9b3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020051, "uuid": "54f1f82d-1f86-47ac-9763-d09a2b44e4d2", "comment": "Malware payload (Loki)", "value": "4f1b0e1361fdd51a3ba0d9bb4089b70960b3952dea1a15d8f635d251d0bfa9e76f950739210d60d2f5c4ebece44feeff", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020051, "uuid": "ce42102e-0a3a-4f3c-8406-86576d685ce6", "value": "28F4014035506A4FC62E3F7648531C2C9B7069B6EA2BE3436CCB12EC596DFC287817A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020051, "uuid": "f45e563f-42c1-4414-9310-76dba000efc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020051, "uuid": "c7c03843-722c-4841-9187-ff840876110c", "value": "12288:5ELd58kqA2WUOO2TJp0GsEiInOt9vIlTHXeZs1ADtnqljZK85Wc3405I2iqIaeDo:5EJqbWV7EGsz37YTOC1AxqljZK8134cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617020051, "uuid": "86594b44-3019-4153-80be-b861f71060e3", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617020051, "uuid": "24e1d0e7-d56c-407f-812f-04534cdede4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020051, "uuid": "a823d8d7-a84f-45c7-9c0d-ca269d9a8bae", "value": "REQUEST FOR QUOTATION RFQ LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42dd254-9064-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617004829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004829, "uuid": "02855e98-39da-472f-b3b2-eeeee4989987", "comment": "Malware payload (Loki)", "value": "4db88d1edc70270d4c760f76ccdbc6f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004829, "uuid": "a071d1ef-6197-4b0c-9f0f-2196ab9b5a71", "comment": "Malware payload (Loki)", "value": "a0c19d0a4b1083074781fec5997bcb590d1a689f964416952f53943cee8ff16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004829, "uuid": "d9345e34-ff91-4d4c-904b-75f58e29876a", "comment": "Malware payload (Loki)", "value": "300352a1f1a70cbb738f86141e905ec33e4c985a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004829, "uuid": "244ce987-0003-4b79-acf3-21b893477995", "comment": "Malware payload (Loki)", "value": "f03cc6cc82d605c323e0ece96bb63f3a2e69ba2ffa9fdeec463d7315e5c760014420e9ee15a217c9a61659862c736241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004829, "uuid": "63c40632-cb25-4180-bac0-c3ef0f9933c2", "value": "5E25E0E4F804E6B1F52436B62A3163720A6DEEE21413DB5C7648F6DA2479ACC5CCBD43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004829, "uuid": "68ad23dd-d142-42b2-97fa-7b43147f3078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004829, "uuid": "94daf579-b6b7-4ea8-ad51-ca3cf1c1aeaf", "value": "12288:PXzTiZmzDg/UBgKLKcEY+xmxKtm596AmqZxn5Qtr+BOoZWX:yqiUBfWZxmym59nmCwtrQOCWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004829, "uuid": "66d4b119-9b8b-4c65-a7d8-46f0bbdb7e3a", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004829, "uuid": "ab2e37c1-3b5b-4317-beab-018e83ec65b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004829, "uuid": "78766bb3-bc0a-4fb4-9550-1d5a3e5f7484", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1ca4e3-9093-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617025086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025086, "uuid": "ea18befe-2cf9-4b2a-8691-fe760f705fde", "comment": "Malware payload (AgentTesla)", "value": "959d5a57d0d4b49dbf5c556b68879be5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025086, "uuid": "5e152f19-7e23-41aa-9c0f-12a7cb86add0", "comment": "Malware payload (AgentTesla)", "value": "a14ce75c877e9dcc62156bae2a289d4270bec15e94932fe8e2dfaf6249414bb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025086, "uuid": "48695c3b-b214-4da5-b4fe-2e072ef03e29", "comment": "Malware payload (AgentTesla)", "value": "63cb2523d81eeb412c2a1a4539cc789f22855f44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025086, "uuid": "01dd46d2-b2e5-4907-b028-2211b729930d", "comment": "Malware payload (AgentTesla)", "value": "e26e18fc7fa471459ecdccd85b34adab700132e7a79767dee4336831671df70886e7a4e3f1a407f83fde74205777d54e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025086, "uuid": "34da6cb3-000a-415e-b1a4-f7c31c505cb8", "value": "64F423E8D3F37A11A4AE5CA87D14C98CB411C38962DB21DE52B5467EF27937A8F180F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025086, "uuid": "e8e520ab-cd22-4dd8-8bf4-80cfda8f63af", "value": "12288:gqwzXj0qhshwAKhObTM7qt4tHQVrdfCmXVHsTNV/EJw54jcNmnbB304JOjU:gquXvsCAKsH+tc7XVaN8wmoNO08OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025086, "uuid": "753530c5-e6a6-4389-bb1b-2cb004133b69", "value": 757713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025086, "uuid": "f6459b40-b0aa-4654-b0f3-fcfc30e4564b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025086, "uuid": "9752872f-522d-49bf-958c-0ad5bd00f4cb", "value": "Placement approval.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416c603e-9076-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617012314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012314, "uuid": "2cc7bb2c-dd16-4ff1-bc38-e1ead5930f7d", "comment": "Malware payload (Loki)", "value": "bbc48f1b529687c6b7ef82af9ce9a8dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012314, "uuid": "2eff22a9-1fbd-4bbd-8c55-d351818a962e", "comment": "Malware payload (Loki)", "value": "a1b2f21597f29eb7a637a8d5bc717abdd8a532724db22c41dcfe1806f8e6fb36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012314, "uuid": "16211751-d3d6-4c33-82ac-5b86fee8a7b2", "comment": "Malware payload (Loki)", "value": "10db06f711173311cdc8191fbd0783c676c35c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012314, "uuid": "4e726065-9708-4d63-bbd1-3ed308e084bd", "comment": "Malware payload (Loki)", "value": "490653d5aafddd1bc3053d24d7c8690b25ffa73bec3bf1043b55cecc0869956ab538f130c8c41fcebe56172c480e594a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012314, "uuid": "b5c6153b-91a7-4b0c-a96e-dc1643b76880", "value": "8925E0A0F845E6F1FA1837FA593163720A5DEEE114139B4D7A08F2D8253AACC0DD7E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012314, "uuid": "4b08f2c7-edc8-49f4-a4cb-fccb98a0e195", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012314, "uuid": "bf35c71d-2e96-4e4e-a20c-9d59e792332c", "value": "12288:lDLwCljOP/aq6cEb1CzhqcukTQluzHUlENEQ8Qo5Ye:1wCdOX9ChfkbYCNEHX5Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012314, "uuid": "04e1f0e0-d44f-4fd1-91f2-00b8053c15fe", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012314, "uuid": "5f278dcd-6c29-48ef-8365-37fbff20fbe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012314, "uuid": "e564168e-199e-4e6c-9732-4844b75f3c13", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1483c299-9093-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024694, "uuid": "57ea5aa6-c40a-4db2-b662-430e720dc9d3", "comment": "Malware payload (AgentTesla)", "value": "f92978d542915fd8147ba9ce4a920cfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024694, "uuid": "cd4ea208-7a40-425f-bfb3-db964bf05e3a", "comment": "Malware payload (AgentTesla)", "value": "a29fbade0216acdd29a4e524ae955178ae0769495627fde4f38740528582736d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024694, "uuid": "514eafbf-f614-4e0f-9e24-f3503778d568", "comment": "Malware payload (AgentTesla)", "value": "b76a3cc1b30b864583c80c692bb6d36a16fe5937", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024694, "uuid": "3d84cce7-4f77-40df-aa04-212d9adc6e77", "comment": "Malware payload (AgentTesla)", "value": "cb25e29480c088f05bef6e8c74a9f51d4d6a6f5f64a101179f2973180d4be23112d20149ab7cce3eee8cdc7c3cbff68a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024694, "uuid": "464e0839-3c82-4d2b-b3b8-cc74b733600a", "value": "E9155A7B21FC79DFD4069B3948571E295F103E729627DA0E903338F8673DF968A118A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024694, "uuid": "035996f0-7e4b-4698-a24c-612f6ccc8006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024694, "uuid": "d438f301-cc32-4b7f-8983-c2dbace74b4a", "value": "24576:7IVhe54uqakskFB6q5gew/fresAPlNCh4ISJi4nWgw:p4DIoB35geqfrOChsisJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024694, "uuid": "69b1a6e1-c5bd-41c0-bd20-a1d22903b989", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024694, "uuid": "369b6540-79e9-408c-abd8-ac88a3213871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024694, "uuid": "ddcf40e1-aed9-4bc4-8c6b-2ca675a1340d", "value": "Account Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8f8efd-90cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617050588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050588, "uuid": "f65375d7-02e0-416e-a19d-8a5874a1ba5a", "comment": "Malware payload (Dridex)", "value": "c0c142b2d5553faba8ba91674c28fb9b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050588, "uuid": "dd16d88e-b07a-4518-afed-32e4da109a2b", "comment": "Malware payload (Dridex)", "value": "a2a25f3df75e2c0935465751ff0f13d3f8c2abd2816aa031ba006a979d298596", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050588, "uuid": "264175de-0a8f-49e3-884e-5eacd1c15510", "comment": "Malware payload (Dridex)", "value": "5cf6f5d4bae0950a581c5a154889b1818398f3c1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617050588, "uuid": "ff632f59-969f-470d-a41e-4c46bef61b30", "comment": "Malware payload (Dridex)", "value": "68cbc01deb643e7b22892ef487a12a75b49609da4bcb5b0dda788fc7fca5c96e960caa5d73219dfc950277aae74ea7fb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050588, "uuid": "9463d342-2ee3-4d31-b5dd-daf197b7c87e", "value": "8314AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050588, "uuid": "7f19cceb-f73a-42ea-8efa-264aeb65a1a7", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050588, "uuid": "4eeda423-e9da-4b75-9dc5-9dc80460259e", "value": "3072:D1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:xi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617050588, "uuid": "5dec025c-1890-485b-9c0e-2f7117f77795", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617050588, "uuid": "777bd9f1-3ac2-4e3e-b353-1bc25c0cc458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617050588, "uuid": "bcc2857c-4358-441e-88fd-c26e4d9285bc", "value": "a2a25f3df75e2c0935465751ff0f13d3f8c2abd2816aa031ba006a979d298596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec89963-90d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617051957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051957, "uuid": "07b61744-5ab1-4c00-923e-26d6b740569b", "comment": "Malware payload (NanoCore)", "value": "40be18ff344e38f80cec056f5bd97f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051957, "uuid": "d5653ce9-b1a5-4645-8b3a-55844b3e6ab1", "comment": "Malware payload (NanoCore)", "value": "a2cdd57742b2a5b76d9b385c249e3f267f049b8029a39f3aad4110ac7b9fd9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051957, "uuid": "7e5c9ac5-0f09-48e0-b962-7b4fa982416d", "comment": "Malware payload (NanoCore)", "value": "cc5c67953d854570f2d56a16432f73783c0511db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051957, "uuid": "f3446d7b-5477-4557-95f5-fe9b2bc114cb", "comment": "Malware payload (NanoCore)", "value": "385877cb1a414874f7d3d4da8a0ae4295892a853ff943e71f151a95f018b7ef6253c9bb2e94204a53e1598efcf70fdba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051957, "uuid": "9dc5235e-15c3-49ba-8d6b-87007876514b", "value": "92258F4C1B99C18AD5760A64C1D983F902A96EF2FB22CC6BA5C47FCFF5317C1A506623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051957, "uuid": "ed52d98c-8844-4711-b944-96494c673d51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051957, "uuid": "03a5121b-0c5b-4fe6-972d-08aa43e06363", "value": "12288:So4ElIFsZW3jPtGWrP6gbheNeP8KwwzZl29Nf:SonZW3b7Zbhws5O/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051957, "uuid": "4b4eb348-9a0a-4911-a2e7-f45633d62926", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051957, "uuid": "3f3bde30-a39c-486d-8418-e6d1adadac4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051957, "uuid": "925657f1-6ec1-4a81-9bf9-85b5f3656c82", "value": "40be18ff344e38f80cec056f5bd97f21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3525f48e-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1617001556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001556, "uuid": "cecc5dea-db07-431c-912c-1624bb9a3037", "comment": "Malware payload (FickerStealer)", "value": "0b5410174129f6dbf798c41730efe2ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001556, "uuid": "95de7633-1243-4b6c-941a-d82348b1d9a1", "comment": "Malware payload (FickerStealer)", "value": "a3087f89fde08c1c5c69dd52168abf42d64658abc53d3c094bb886b9942d2f8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001556, "uuid": "df4f3f42-84bf-40bd-927b-7ec4d1aa7e3e", "comment": "Malware payload (FickerStealer)", "value": "5a121c20e0b230fb2408286aca5eca9193f62be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001556, "uuid": "0ded5fc8-e4e5-4254-99cc-3de3b38e22f2", "comment": "Malware payload (FickerStealer)", "value": "39f416f3411b6183a1c29fcc1c37ddb3c0c4c25471a8df6e9d6683144b36c1d0b707c8074c4464f04f551a1a1c0fcff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001556, "uuid": "039bf7fe-b378-4a6a-82f7-d53c82ad1c52", "value": "AB54DF017AE5C83AE45259B68935C3B14667FCB25F7155CB3BC43A2D9E322E28E31B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001556, "uuid": "27213ce0-e2ff-49d3-b9f9-2c5dfe6a18a7", "value": "3ecbda6de31890eaa5cd272ab1b192ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001556, "uuid": "f356b174-a927-41e4-839e-69e6432819b0", "value": "6144:VCyS23ASLjGJUj3slA/oZ9cZiBfgenRw3M:VCH23Gaj3slA/UfgenR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001556, "uuid": "ce8a3ecd-64be-43e4-ac41-dfb9b7fadbcb", "value": 290830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001556, "uuid": "20d5d7a5-aac8-452a-a276-2edbb6095f3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001556, "uuid": "014a7984-6420-4ee6-bc71-3b99ab95a4e0", "value": "0b5410174129f6dbf798c41730efe2ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190ea3db-90e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1617060350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060350, "uuid": "9ecdcf73-440f-4672-82b6-6da537231e98", "comment": "Malware payload (Stop)", "value": "f3f35dcb69fca49ae55a22812770ecb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060350, "uuid": "0cfdbb03-a044-4aa8-ac40-c5b6678adeca", "comment": "Malware payload (Stop)", "value": "a3d26db7812778043abdf20ad3ff5caf68be3752fcd33de75d1bea8f515ed3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060350, "uuid": "61891f11-ccad-4cfb-a785-133c610d6f2b", "comment": "Malware payload (Stop)", "value": "eb8c95dc050978d10c05073b0d5311f86da986ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060350, "uuid": "05fde0ba-6186-4539-9a55-cf557ef1b582", "comment": "Malware payload (Stop)", "value": "373b006f223fe970c480b252dd464c3941cbd5563c4cc10702f0d193585fadf933d5aafcfcb2b91c1b61e1ad26409b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060350, "uuid": "1a97ba92-3071-432c-bf7c-e06677a672e3", "value": "38F4122476D0D132C0EA40774269C7B1CFBB7831F569A98B7BD41AB91F68BE1DA1130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060350, "uuid": "771f21a6-aaae-4008-9148-ea283fb3358e", "value": "77d323863674c0a1ad49116cbc6a8d09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060350, "uuid": "27a39329-a1c9-4762-8d31-5fb55915a8fe", "value": "12288:RQmSrW02kBhiCu72Vv5g7WwjAKUYDZwqOCtyqnWa9ErUNTltPRqxqhaM:RKrRZBhiDmv5bgXxwqOCkaYyf5QbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617060350, "uuid": "b37c2aba-caa4-4d3b-927e-9bfa9ff54559", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617060350, "uuid": "08348df2-abce-416b-97e2-9fb8ef42fe89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060350, "uuid": "6ad40bbe-093d-444d-87c5-8970aa350a0c", "value": "f3f35dcb69fca49ae55a22812770ecb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028767a4-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617002330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002330, "uuid": "d5262078-6c6b-48aa-a91e-879700903e6b", "comment": "Malware payload (Formbook)", "value": "4b7075ac72e26465423a8f25a5e5cc35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002330, "uuid": "2803ae60-dfd8-4cbc-a682-7016fef01bdb", "comment": "Malware payload (Formbook)", "value": "a3d951fa76fbb0f24540b97767e2d327b9bdb2e6e93721cb3da4ac5370118dbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002330, "uuid": "a3deefb3-5104-49ac-b166-742c82b69e4c", "comment": "Malware payload (Formbook)", "value": "5d3f9f407f52fad0c07daebf6f4f9aebbbb902ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002330, "uuid": "0a66ab7b-d4b5-46df-b53c-5448cd981358", "comment": "Malware payload (Formbook)", "value": "3582a55d7353c91d5b6e88ac28b4b4fa072295da173784ba9aa3e7bb3d00c1ea87e00c1b42e5960846bb3ca55bacfcfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002330, "uuid": "c0c0e4a5-e5ca-420e-b2e3-d16a54987020", "value": "E524122A36E16DD7E04636B17873D53FF7F6A7056B18354B2BE90B282E120DB42076C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002330, "uuid": "63f02956-bc2a-4b93-836e-2aedf7b63b2f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002330, "uuid": "21c474ef-b3c1-4bcd-9bd9-9309f60d4850", "value": "6144:nAPMOg7o7sTWvfR7ZPpb9XZeFFVpVnCVE6c:75EQqfRBXZeFF1CVE6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002330, "uuid": "a2261474-a336-4291-99b1-f908ad103653", "value": 217951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002330, "uuid": "5ad7521f-d6b9-4b09-9960-444c687c3640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002330, "uuid": "3efc2b76-b8cd-40a8-b199-ea2829d7d852", "value": "4b7075ac72e26465423a8f25a5e5cc35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e43ce17-9079-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617013543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013543, "uuid": "e78ab901-ddc7-4147-9625-800ac36ff698", "comment": "Malware payload (IcedID)", "value": "b6e382660d4d7cf78f4ce57944be7bb8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013543, "uuid": "e515e44f-fdd1-41b1-ad32-b7a137de9e60", "comment": "Malware payload (IcedID)", "value": "a483f7ad4d830a16b6dcfced6a8f2322dfbc59f2c5779316a82026fe7cb27ab3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013543, "uuid": "ea7798e4-014a-4303-9424-7c0a8345c8ca", "comment": "Malware payload (IcedID)", "value": "d0287966f59a3f95ff8c3ef8114c2ba74e9600ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013543, "uuid": "331258e8-ac8a-4346-9191-389fbf6b975f", "comment": "Malware payload (IcedID)", "value": "8f5d10d82d0aaf53abb6074737a03137b56f8e07ba67f17e083c32055bab5e6d3e911cc32536080866b33059e6bc5c1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013543, "uuid": "dd259c8d-2eba-4ca0-99a0-a7a1d0fd4911", "value": "CB73B5CF64E1036AC4B296B2CD511762C17B6A1497CD90FBF2C44FA2DB20BD8CB1567A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013543, "uuid": "5ece3f8b-efc6-48a0-9dcd-2c5d4693d0dc", "value": "90aa3843d5aa658ac020bdbd15d575c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013543, "uuid": "4d9b9090-ed71-4be4-acd7-6dd85ce81b65", "value": "1536:CAZLWqcMLbLVFsFM4uMgxh+G+LK1mKujA:CwPLzoM44+G+L+jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013543, "uuid": "ab42ab94-4c6b-42ae-8a81-111cf895f71d", "value": 76376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013543, "uuid": "af0c9c34-4095-4a93-8e30-f13e3ef4f2fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013543, "uuid": "1d2e9b95-51df-41ff-a52c-2811a32387f3", "value": "b6e382660d4d7cf78f4ce57944be7bb8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c9b01a-90a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617032452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032452, "uuid": "b0a0f9d3-e544-449c-bfd5-be2727ded518", "comment": "Malware payload (IcedID)", "value": "82d3f131a5cd6e821377c07843c0ad8a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032452, "uuid": "aa72c4ec-9e64-4821-a0c7-8e9ce3d4d639", "comment": "Malware payload (IcedID)", "value": "a4a50dbf0aaffa6670c6a96001d3f9b51c422a75e7f1462984dee7918ea7d38c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032452, "uuid": "451a2519-f34b-4b07-b1a3-adb8d0ce98bf", "comment": "Malware payload (IcedID)", "value": "3b32555abe2e884a6760dabbdccc6ff5d279c8ea", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032452, "uuid": "ef71c6b6-0148-40ae-859e-cf5b40b2ff2f", "comment": "Malware payload (IcedID)", "value": "92ce889be84c0cbaf14172e7208810c89ea5e86989e8ee80930d89a6ff8094f696d45f107600ad155dd873b8974e6143", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032452, "uuid": "a937424e-e8b6-4cc5-bb31-cf8ce266d540", "value": "3F04122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032452, "uuid": "2dcb9b9a-d385-419d-8414-bb9e79c71e9a", "value": "3072:g3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:gnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032452, "uuid": "e275391d-779b-44ad-b149-e68f45c6e72d", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032452, "uuid": "3726ea30-a06d-4e47-a36f-59bace96893c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032452, "uuid": "468f6ae5-84ba-44e0-b610-c5dbae911ff2", "value": "Claim65075098603292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398bf1ba-9070-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617009724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009724, "uuid": "2548f3f1-5a3d-4165-9309-7d7ae7accab5", "comment": "Malware payload (Dridex)", "value": "60df86bffebb5b9752f5ee9f9e0cd715", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009724, "uuid": "7c7e43a3-1c11-4397-9722-18132cedd82d", "comment": "Malware payload (Dridex)", "value": "a4b559295b883cd3e145bec64240585759956e1e7d4e91507d09db5ffc0ccdba", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009724, "uuid": "ddbe07b1-a4ee-4d4f-8efa-21d0f1543168", "comment": "Malware payload (Dridex)", "value": "e686a7ecba3724480d0d93440fac5382fb302032", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009724, "uuid": "363909bd-2b8b-4bb9-b898-682e191be180", "comment": "Malware payload (Dridex)", "value": "5fda39cd901306c30226b2c2e1c08b1328b8d62ddd52387b804edf03d325e32b6cfb7e4ac7a55a1a607b772694746964", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009724, "uuid": "5a9b6b93-91f9-4b60-94c6-3676590cedfe", "value": "E114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009724, "uuid": "f9dec6a2-f190-48af-acdd-428c5e08c926", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009724, "uuid": "86acf7e5-ab24-47d0-9fb0-f13373890514", "value": "3072:E1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:wi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617009724, "uuid": "f46fa8c2-67ce-4eb2-a16f-4c29c81a2115", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617009724, "uuid": "57d865f8-54fa-402b-83b8-ff9bbb593318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009724, "uuid": "b2f54195-b9f4-4eff-a5af-0ef276646386", "value": "a4b559295b883cd3e145bec64240585759956e1e7d4e91507d09db5ffc0ccdba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7957137b-9057-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999093, "uuid": "d3c6eaca-938f-4094-b130-7a33624eda94", "comment": "Malware payload", "value": "6dd6bcd4afd9f467c503b042898b82f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999093, "uuid": "180b736b-0d45-4d4d-a7b4-793274da4d77", "comment": "Malware payload", "value": "a5d967e078593a66da64945ca9e6f618df6dd92c7e029dbab2b97e4b5d34b578", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999093, "uuid": "1f6e9ab4-a20b-4763-b900-e9cf0a0f89e0", "comment": "Malware payload", "value": "039c3f6876828cb9b9fa6eb4436fcb51d7266188", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999093, "uuid": "fea8f32e-7cf2-4eb4-b2ba-1b9a8815ce4d", "comment": "Malware payload", "value": "c89ae403d9c3773aa1de924f14bf777929284e9a707f781a0e696eef8f80ed7e9b80f6501d7e8f9986309294f5e9ef06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999093, "uuid": "f055be27-18a1-4875-bc0b-d1818ce867d2", "value": "D915332A36D096D2973F48501118F16EC23EFF74E893376BA4CFC2E837159767A1A620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999093, "uuid": "69255c17-486c-4207-a0dd-8491eeb48b0e", "value": "24576:OAK/3yziWXoV1rhAzH4U71X7doOi81TUs42QSZ6rdE:OA+yzizBhEZxXRoOi8SslQS0rdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999093, "uuid": "093967b9-d6f1-4abd-9a03-420b1d2b0e97", "value": 876719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999093, "uuid": "a1174eb9-e99d-4e3b-aa89-677fa48c2801", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999093, "uuid": "77cc1617-7ac3-472a-82dd-ad295eab5a28", "value": "New PO.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff6eb16-9072-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617010540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010540, "uuid": "7bc4a38e-1540-4e13-9b00-26c8ec20a464", "comment": "Malware payload (AgentTesla)", "value": "5e222c522efca46f8f1d792631ae4a4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010540, "uuid": "6d5f4fcb-dd76-4e28-b866-a1d2e12c8a03", "comment": "Malware payload (AgentTesla)", "value": "a62fbd146f7c95d0182693354536a0da1ab478573e6494da19427132e58609a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010540, "uuid": "bfb2a451-c1e7-46d8-a2ce-7ce2dd639408", "comment": "Malware payload (AgentTesla)", "value": "5a8df5a3b66020cd83dbbe1603e549f89d01e7b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010540, "uuid": "a04d800a-6d92-400e-9a36-765da2228ab5", "comment": "Malware payload (AgentTesla)", "value": "1acda9d7576558e78eade06d5157cecee7492daa1489acbe33330d87634fe1c08b451544bfb5dd3655eca3f439fe84d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010540, "uuid": "ffef75d4-408c-4cc3-977f-fac53ed124c0", "value": "DE15335E5783B305F5623C00B007A25A8F7322959A42ECE9675737EE4F269ED743A8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010540, "uuid": "e1db14f5-2711-45c2-b9bf-2902dd54c32e", "value": "12288:v/c+eMD8gitWmgIxYExH45z0J6IARmHq8cOQrK75Up9IzTasT8AhdYeKSkTeyu:nc+H8+7IuExYETHq89QrKzzVT7hlgTpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617010540, "uuid": "427b752f-4e80-433f-8f24-75b93f5260ff", "value": 942739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617010540, "uuid": "3f433217-95b9-4968-9a1c-7fcd45933321", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010540, "uuid": "30a12d80-0a47-430c-86e8-5ad0237619ee", "value": "PO #0471309.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f6e4f3-90ca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617048406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617048406, "uuid": "cf67d68d-71f0-4d23-80b7-3edfeb077b0b", "comment": "Malware payload", "value": "ee3942b590be4220fcec1cfff0f3487f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617048406, "uuid": "1506c458-5e56-4c8c-a741-a7d92d909308", "comment": "Malware payload", "value": "a67282c6f37a82765eeadefaf4245a2dacba3f6def9c5bf8460e01e38cfff70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617048406, "uuid": "55c00175-787a-44e8-9b88-c0305d6b1d7e", "comment": "Malware payload", "value": "9c813cf77dcb9d9ae4cb3304309f33a8762399d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617048406, "uuid": "ba4f5e6d-7cd1-4980-847c-7197d1ec11bd", "comment": "Malware payload", "value": "632222e4e33bd1911dda4ce759b802725c62fc77bdf6dcecf228da9e39dbe486e7db4d1f53fbe921e947655dacb44846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617048406, "uuid": "d44751ad-805e-47f5-a4cb-1719b0eecf3d", "value": "AC74AE053BB0C5D9D2A521B44ECD8EA4E924FCAA1F20D21372D975DCBDF9F89262D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617048406, "uuid": "9e92de7c-5fef-4a8a-8745-55165c7d5b66", "value": "77af713b1f2916ea138f9bb7258cf849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617048406, "uuid": "583d67a2-ffb8-4a39-b86d-796bf422e03b", "value": "1536:bepG5ACCny8GenidAHcz92ZIx9FxIl+YkSVoZlP1usBVEwnoxJashnXcX:36lGeExx9FmSSkfBt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617048406, "uuid": "3c80d0e8-ba81-4419-82b0-cb4230ab3cf0", "value": 368615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617048406, "uuid": "c8dabc39-54d8-4bd5-914f-dfb1b6fd7b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617048406, "uuid": "4e8f713a-84e5-45b3-914c-d2281accb2c8", "value": "2803.gif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c62861-90af-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617037071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037071, "uuid": "20a09b1c-d3ca-48fb-9803-3f25ec1f8be3", "comment": "Malware payload (Loki)", "value": "5d55ba4b86da04db9ed6b013c249f722", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037071, "uuid": "f2846317-306b-49d4-a61a-73f9b5d082fd", "comment": "Malware payload (Loki)", "value": "a788fb8f09ff304d5f3fa14ff06b4dd4c114dd4b7bd1dccf44211c6303b0214c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037071, "uuid": "fdc4df73-d423-4452-b586-c0b900409a67", "comment": "Malware payload (Loki)", "value": "17690008a78589160428e6e80eb7131a98743513", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037071, "uuid": "68a6c32b-8db1-4ae5-aa97-ee96e132c51e", "comment": "Malware payload (Loki)", "value": "372d1b472418d08121938a9467275a3d01cccfcc83e5d9b9886c9f98e905f44c75aed35b3cb2072c89c522d4bc6466cb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037071, "uuid": "6fa9458e-c84a-4821-8a77-10f64a5d7358", "value": "F5F3027A33E18DF7D52B17711E6AEBAAD2FBB145481456CF13202EB629311C6C328793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037071, "uuid": "49dade53-5668-422d-a7db-2c1d1155c573", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037071, "uuid": "6f1b1222-a342-4c7f-a948-ae0afba1699e", "value": "3072:xPA6jXFN2McZD9gg04wptkKU6Cp8NbzGqATyB5LFGoKY2FyMgdZfV/X/ksh+:xhjmtOntkKnCeNlzLIYR3t1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617037071, "uuid": "f254a046-c1ff-4696-9d76-cedb51ce022f", "value": 158347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617037071, "uuid": "a4eadc13-72cd-4ad4-89a4-e04b1e0a95d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037071, "uuid": "3d02bb52-ae73-414d-8b8b-149a434b4004", "value": "Offord30622997pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54b42c7-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "c672d4c6-35df-454d-91e2-5527c06f3408", "comment": "Malware payload (Dridex)", "value": "9609c21c299545aa39850816cac81132", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "48a41e5a-005f-4158-b592-6c1b4d72356f", "comment": "Malware payload (Dridex)", "value": "a83f728a3db75ce6298a72f1b5c5b92e91846af9986e6d936a5737e490ef23f5", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "915e8d64-feea-4f26-a3ec-b53c694b7f0d", "comment": "Malware payload (Dridex)", "value": "584f6b4248088e78efafa2cd134e8635c2a99692", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040399, "uuid": "0b924244-5f1e-4dd5-a312-f29580074f4c", "comment": "Malware payload (Dridex)", "value": "ac7adee94081f5d41c7f7ff6cef09eeb65e4554a7a7ac9b7a37510247a75539f7a2208ef7a9473c0def95a30785a17a3", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "59ef1e69-ca69-45c8-a00c-22f5910d2882", "value": "AFC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "6bb1f02d-b5eb-4c84-b96b-083ba4c3bfc8", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "4b30c53a-3a28-4f2e-a01b-8e081e79098e", "value": "12288:It+D1yz/1SXpqDaoWmfsFRHk3eBWIc6d:IcA1aLoBUgeBjc6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040399, "uuid": "6d78e6cd-67fb-4354-ab6d-e2ffe925e7a5", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040399, "uuid": "692d5d1c-72d8-49d7-bee5-679439aab49d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040399, "uuid": "15c39f31-d3cc-4d0f-bddb-634c53ab7f75", "value": "a83f728a3db75ce6298a72f1b5c5b92e91846af9986e6d936a5737e490ef23f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4681979-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616998360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998360, "uuid": "eca2850a-8b45-4a76-9bb9-ba7edea21b3c", "comment": "Malware payload (AgentTesla)", "value": "5bb7de5cccd3b084104ebbfa1868f273", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998360, "uuid": "d0cadb2e-7658-4b19-a492-c9a0eca3abff", "comment": "Malware payload (AgentTesla)", "value": "a84ac0ba84ad0560b3e7bab9c996348701670509597e4eb370f4366a6d2400e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998360, "uuid": "584fbcaf-fb61-456f-b501-3647938a2326", "comment": "Malware payload (AgentTesla)", "value": "603abc3f6b6ebe6008b84371532fc9612f3305c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998360, "uuid": "c169f1ad-da1f-41fe-bba5-61ce56173548", "comment": "Malware payload (AgentTesla)", "value": "58918e66c09ca9f93c7d165df6693b5076016bf24a25e518435bd1be43b3d89906e8e79914b0a58af8b84e656368785f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998360, "uuid": "4c880907-3a33-4624-b80f-0f5a1c60362c", "value": "48E42311B0312325996C4E7745F29C071E5B2FFA8FDC03649EB8C2A1FA1BA0D2D66E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998360, "uuid": "550e1ade-8ae2-42ac-b158-e5380fc258b5", "value": "12288:UTa1CteGpwyGX72yeGIB3HKS/1228u3QgxVje998WcrcccBGSKV9lKKs:IHteFE5t78uzVkSzrcc4lKV9Al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998360, "uuid": "d7ba1284-740b-4d60-a9fd-18e60a88e26f", "value": 706845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998360, "uuid": "c0603d2a-afef-4478-9828-caee7e212d8b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998360, "uuid": "df8e45fe-ad5a-4b02-b53b-a6806432e7be", "value": "PJT002102002.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89bad82-9070-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617009990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009990, "uuid": "a1e4f2a9-9632-4d9f-aefb-daec63f1bdfe", "comment": "Malware payload (TrickBot)", "value": "8818eeabc3b87000b7cc9422ce44797a", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009990, "uuid": "c38e2044-eece-459c-a594-e901e601d762", "comment": "Malware payload (TrickBot)", "value": "a85830e2ae2702929bd6135e48517be59fb72396af8a19c16311f5fe0c27a509", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009990, "uuid": "20280483-d243-4eea-834c-43c2965f4261", "comment": "Malware payload (TrickBot)", "value": "6d0f56c5dd2a3ee7b2ca81f0f04974b8062a0aca", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617009990, "uuid": "f90702a6-f09a-460e-aee7-5a7598b4c4ac", "comment": "Malware payload (TrickBot)", "value": "0e77c65918804bf2d4ffd76dac76309b5aba016197fd60a0b9c0339fc6543af43b6ccfb05b637189edbecade7573db6e", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009990, "uuid": "3157cc93-5f83-4305-a185-7abcb33fb849", "value": "2815CE6B39A1C47BC2E241724E657B5AB2F9EE548F364AC363948B0D0D71CE14B3623D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009990, "uuid": "48a04ff9-8672-405d-a586-32743ebd30f3", "value": "3b0331f0e0fbe043f1a86682fe87264a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009990, "uuid": "7444b537-3927-4888-987e-7f40d781a154", "value": "12288:mN6Tp4rMYVFE9MyXB1leedmOCf4ysE7tEPD4Ummv+jnr18jSFmvuPTWun3XQcs:mUBeKB1wedmu4tmsxeuPFQcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617009990, "uuid": "c9eb685b-c6c9-44c8-95b3-37622f9dcc10", "value": 921684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617009990, "uuid": "f29969b8-14cf-4e93-95ae-ea894d13c6aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617009990, "uuid": "90528bc9-033e-4d10-a2b3-5747126f5d1b", "value": "a85830e2ae2702929bd6135e48517be59fb72396af8a19c16311f5fe0c27a509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2f78da-90c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617047259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047259, "uuid": "f3c467ea-798e-4f0e-9397-8046021c6500", "comment": "Malware payload (Dridex)", "value": "f44ec051d1bdcf53e65b642eea25a742", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047259, "uuid": "a68199a4-fbd9-46a3-9c79-2dbbad6a12ed", "comment": "Malware payload (Dridex)", "value": "a87bbe15a9f3dbae59dad26d973cae186feca6869f61e387444a2203d079280b", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047259, "uuid": "747b80bb-6274-4b58-a6e3-7d5c9cef0907", "comment": "Malware payload (Dridex)", "value": "b1a0e76038f6b15596fd7b976cee3ec76a036dec", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047259, "uuid": "9b4eed93-3e09-4c33-a7e9-98b04af2eb2a", "comment": "Malware payload (Dridex)", "value": "4d565559e5cd111690f9ed4f1a06dbc40b25da4ae0cd400c860e21af20b7833aaea96ab8949d40f95ddf2ac20e53272a", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047259, "uuid": "87c34648-f764-47b5-8be4-45ed94733009", "value": "4CC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047259, "uuid": "44129187-8980-4d22-8d73-aa6a139fedc4", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047259, "uuid": "6a453573-6e56-4b1b-ba67-0ada2563ddd2", "value": "12288:et+D1yz/1SXpqDaoWm5sFFHk3eBWIcgd:ecA1aLoBKUeBjcgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617047259, "uuid": "b6f0226f-dd77-41db-9ebf-9f2e532572b8", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617047259, "uuid": "4d561013-20ee-4098-a4a9-233d49792f73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047259, "uuid": "7fb8d511-7abd-42d6-8f30-330f7fa4ef1b", "value": "a87bbe15a9f3dbae59dad26d973cae186feca6869f61e387444a2203d079280b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a1905f-9061-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617003575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003575, "uuid": "d82cf2cf-5cdc-4ce3-a0f2-1652feb2babb", "comment": "Malware payload (AgentTesla)", "value": "7f66849a5c01012807b45f0711c9e5b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003575, "uuid": "7a5739ac-0188-474f-8a07-2b0b501cc98c", "comment": "Malware payload (AgentTesla)", "value": "a8dc022f8cf2b91d582d508053133223674090460002adf2518f45e9c9f03e61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003575, "uuid": "359f7887-8762-46b8-8e7f-a321428d8347", "comment": "Malware payload (AgentTesla)", "value": "96abdd3c9b822401e0ef82fb2b3902a54083da12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003575, "uuid": "6da93016-fa34-44a8-9560-59c78ea9814d", "comment": "Malware payload (AgentTesla)", "value": "911c70e63fbb8eb03c306f4bb678801427cca8c3c406508a268f8f9b1c9df0c8ff077c473b50b4bb2ac715d7aaabc094", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003575, "uuid": "9bdce6ec-55f8-4435-ae44-747c1ac2149b", "value": "9035BEA985051A32D87D87B089B6C832A3327D6E7470E50D18CA3EA73BB7393645F51F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003575, "uuid": "553658bc-ced8-48a7-be64-a47beae9894c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003575, "uuid": "45c24f5f-557a-411a-a369-0eda24ddea0f", "value": "24576:20GlZaWJNJTtVBLtvxp53KNyeLjpj8T1q:2RlZTtNf5aceLjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617003575, "uuid": "9cb4d02f-166a-4cf0-b19b-02de375f98f4", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617003575, "uuid": "2a256089-4564-4bad-9d32-b1c1956ebaa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003575, "uuid": "fe86b631-b98d-4767-b8a5-b7c546b4757e", "value": "Payment Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbd885c-905a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617000602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000602, "uuid": "d6569d53-edec-4433-97a1-d432a108201f", "comment": "Malware payload (AgentTesla)", "value": "c11057e5d438744e90f2eda304dd088e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000602, "uuid": "38786db7-0376-4959-ad22-e96babd271e4", "comment": "Malware payload (AgentTesla)", "value": "a8fd7acb08e189ddaa76f947297f6cc5258b8bfdd47ada90e50125a6bd1fdcd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000602, "uuid": "4477e305-a82c-404f-a3d1-ee2e0f5e7977", "comment": "Malware payload (AgentTesla)", "value": "7f11710d8f8a14986e2c01ff35abf468cd28345a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000602, "uuid": "8e5e2c3c-d18a-4596-9068-682b5dbc6156", "comment": "Malware payload (AgentTesla)", "value": "1f7af6fba1f71a5975f4a818d381f3b1aee779ab79f1a7b0d7f5148bca36c7f0ae1177ca53a77095234ef933d8eb7389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000602, "uuid": "8ea10700-101a-4ca3-97eb-8f0265c41ea6", "value": "CAB4235C6437CA3B068189DBEF02CBADCB2065C5A095D9B7015A133EFD1DB718A3E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000602, "uuid": "bbbab302-4ae6-4a00-878f-cd92fe52de63", "value": "12288:IqPkUSj+Cf8EnO9ZhO6n2j7fNYLewXJR53DPP3HUUlQfwdVWpT/HOC:jC+M2ZbW6LNXn1P3UUlUwo2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000602, "uuid": "b5eb9922-3f7e-4e6b-ac52-f1edbeb2f5fc", "value": 505346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000602, "uuid": "2a572c8e-cf44-419e-89bb-e5974fb15a72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000602, "uuid": "23926703-eeaf-475a-8fdf-f8989869ebd9", "value": "Payment Copy.pdf...zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e642828f-9061-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617003571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003571, "uuid": "1b7c2173-762c-4110-9a65-800ea7baa856", "comment": "Malware payload (AgentTesla)", "value": "e6feb29e1e04df0dca9587d3b77b9051", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003571, "uuid": "58486603-fef7-4bdb-bbb2-084e8530df41", "comment": "Malware payload (AgentTesla)", "value": "a9a1e44e8a3d970fd07c72d4e03a8a547c4b7a0a26f3bd1c84474cdbcc7f7fd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003571, "uuid": "73fa371b-666c-47b6-a08e-cb3e641fdd47", "comment": "Malware payload (AgentTesla)", "value": "02db0cf132e098795b75fd334badb5f12929ec04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003571, "uuid": "8280b932-9f6a-4329-a601-15565f877a48", "comment": "Malware payload (AgentTesla)", "value": "9f1a3c88753b0837d3dd6739f40fb74f28455c533ec5542c73ac30bc41a524f14460f0965aab9c6f72c0ef1af8eecea9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003571, "uuid": "f8bb1621-7eb2-425d-8030-b2b1834b6e1c", "value": "26053342C84AAB69E14F0F6E83FB0CDF9A305C7DDA14F0F7A7514578A1E06226871DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003571, "uuid": "1b0a2104-6645-47fb-a615-d4b6a303a09e", "value": "24576:4NTjHjkuJnlttVjftFVjH3wf0ULtp92G6:4NTjHRttd1HgcULt36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617003571, "uuid": "4f669a00-8b71-4cd6-b09d-c9bc0f1be8ba", "value": 843864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617003571, "uuid": "03cc61df-ff4c-446c-a1d2-914eccc32bc2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003571, "uuid": "72ec4649-8c02-4063-9621-7f8dd03c3b1b", "value": "Payment Copy.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a024841-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617025696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025696, "uuid": "95ca362f-8c73-41f7-8338-1f35eafc9729", "comment": "Malware payload (NanoCore)", "value": "5714d08fd3c1bafec2098f9c46dc85b3", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025696, "uuid": "c12a3ce2-324d-443e-89ce-9d6a1aa89be2", "comment": "Malware payload (NanoCore)", "value": "a9dd5583f75c18a915745ca35e8331a0bdd7b2fb4eb5f072430a97515d521632", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025696, "uuid": "63961fba-d7ba-49a0-8ccd-830608a7b25a", "comment": "Malware payload (NanoCore)", "value": "6ef21529da5867a8662d1f230d8c5aa9bdb79e80", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025696, "uuid": "6b9f0838-8d3f-4249-b1a3-8a2d0daac0b8", "comment": "Malware payload (NanoCore)", "value": "4c22044a59e0011d68587a048530d9bbab2921f4cd5136473d98c00f19ba769f81a37df06c2f07c75d3b8cd129667c80", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025696, "uuid": "a001e285-59be-4810-94ce-cd75f7118e24", "value": "BAD53302D8ED8F3AE51BAE3881D9C61FB9F29D25C58C9C53B726B6257172F3412B250C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025696, "uuid": "743dc8dc-6f13-4f1b-bff5-96ad2ce363d2", "value": "49152:wXTTD8VRkZ/5Rqrson9rxx0qniAGAZDtZHn8ARoSeLLjJ5s12gCU6tP2zbgFrXy0:6sVRQRvo9rsoiAXvnvRiLPJCB6d2zcdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025696, "uuid": "689afc91-4113-42b7-b094-68c0438d490c", "value": 2812416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025696, "uuid": "f55e718d-4051-4e1a-8a84-b0acccdea587", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025696, "uuid": "a98baea0-09b5-4669-9839-70d2fe5fb436", "value": "PO_SRL2020426.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43b4d9d-90a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617034008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034008, "uuid": "c8061add-083f-4984-8fb2-729195445094", "comment": "Malware payload (TrickBot)", "value": "35994b0f330dac6e145ebed16e77ddec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034008, "uuid": "52c33ba5-4ac7-40c4-8f24-dc7e03c0a2f1", "comment": "Malware payload (TrickBot)", "value": "aa40f9dd1212993f79cc23111de3a8dd5e529dd1a8ca5dceaa30fba53f6f96b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034008, "uuid": "1064e211-7208-41ad-9d2c-4ad76b1c4ee3", "comment": "Malware payload (TrickBot)", "value": "9c414e070678797a964ebf5aea3dc8093bd41999", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034008, "uuid": "551f188a-466c-4ac9-b183-c03a5cfae88c", "comment": "Malware payload (TrickBot)", "value": "190c5dfe631876f9fc34ab9321274a8d85369cd72b448ed7f11e773cdc95947d526421ca7c95084acbbc81a58bd53fe4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034008, "uuid": "4993b2fa-b928-486e-b18b-624068b3d76e", "value": "66840216B5B088BBD4AB043126570F3F6B2C6500DF919ACB9F50D9BC5DE12C29E37E86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034008, "uuid": "a2d35cbc-6318-4ad8-b844-299327cc0716", "value": "a5336ab7338757f3b5e9e47a2adbca56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034008, "uuid": "30fda2c7-611e-447c-b4e5-80015601d45e", "value": "6144:tDYZ57TsVxGVmpMbj8RCUoKaiYYFJLPwhC3Jp4BdXq7zDc9JTz:tkvTYxqCcj8RC9FLYFhPwiJpZUTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617034008, "uuid": "3f86c7b0-84a0-4510-9ab2-99796bb65ccb", "value": 405562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617034008, "uuid": "ef6de047-ac79-4bf3-9f2e-5561d4e28d3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034008, "uuid": "0d1de0f4-0f19-4e7c-a1a9-290bb5a9d82b", "value": "Z4Yor5B.photo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa794b5a-902c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1616980842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980842, "uuid": "6279419e-5817-44d3-92ef-1cda03a12cfb", "comment": "Malware payload (AsyncRAT)", "value": "9e33a8b6ed87c3f66aa2ab1fb5f82e53", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980842, "uuid": "caea596f-aab6-41d4-aaf0-636ff6b8ffc2", "comment": "Malware payload (AsyncRAT)", "value": "aa95fe913583ea0c39f73537e541bd08b873d67ec971a1736032ff3cf14959df", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980842, "uuid": "80d55319-4c25-4b27-9acd-dececcde1157", "comment": "Malware payload (AsyncRAT)", "value": "7257ce1e907a079c4abe66101f9433aef498c208", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616980842, "uuid": "171b3269-2756-4ffd-9e10-f714239d4af1", "comment": "Malware payload (AsyncRAT)", "value": "1bbb5f1643ae1a211cf1849509557e9cc05ea1d1eb232ea362e81a04698a88207cdab0dac2df980440ce153b6be1cc02", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980842, "uuid": "0b708cd0-fba6-4e39-8ddb-52c2f29873f3", "value": "12B3D05A27E1CC17C4557A714AB38AF9E3BA663012310513FF583F697E2C0839A1AD5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980842, "uuid": "cdbfeef8-dff0-40df-8fa6-7f6e844b0fe8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980842, "uuid": "53bdb27f-e479-4099-a7db-651a7e3da5af", "value": "3072:JTs3BxJNmJcrofQEiwJz0upg6IoUATK6c:JAPbr8QE7Jz0AKN6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616980842, "uuid": "338d3e51-b3c5-4ecd-9d2e-f2cdba4ce782", "value": 115188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616980842, "uuid": "0576ee67-4220-44f4-b68f-006174a6df46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616980842, "uuid": "d53c0547-c204-46a9-b9cd-32b505d4dfe2", "value": "PO-94765809570-Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e379fdad-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617000130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000130, "uuid": "59826716-6827-4d0f-b47b-a25619a84426", "comment": "Malware payload (AgentTesla)", "value": "de41f3fa5a7b0914b445c0f9ebe4e490", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000130, "uuid": "2bd9de22-5f3c-414d-aaad-6973e92adcde", "comment": "Malware payload (AgentTesla)", "value": "aa9775453409a7dffe76625eb84e307027795e5e229a41f9d5bf68064e087233", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000130, "uuid": "5c390024-e961-4a1d-9b51-66361ac881d0", "comment": "Malware payload (AgentTesla)", "value": "30bdcba7241af6debd92b34862a61516c3012185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000130, "uuid": "78e06fe2-1cfc-41c9-973e-7443a7ad390b", "comment": "Malware payload (AgentTesla)", "value": "54d8e06bfbf8862af06a9a0b96c7dbdd2006eb7c24c8ef156550ef753511fa5e66eae9478eb5391928b2064191b2c9cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000130, "uuid": "8af76c24-1ac6-452b-9046-81ebaef96062", "value": "C9E43394F066B8E68D4BD754F36BFEE2248C3BA509E685FD340E1F924C20B61A5CB315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000130, "uuid": "51f5ffb5-e515-40fb-ad46-6a110a23beae", "value": "12288:aLh9egY7Nh1QxTeSxKimXxSHt2XHDy7OZQ09hzQSKi0MrGKtbyjnz4DhepzITXNG:4h9e1n16eSYFXUH4+0PQGrGKdyD0teN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000130, "uuid": "b76ec452-950b-4f77-8a63-49ce2133ff09", "value": 695814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000130, "uuid": "eb33fcb4-5e0d-4789-892a-33aa12f84fbd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000130, "uuid": "4adb7e64-265c-4869-9500-ed341497404b", "value": "RFQ#28202103#2184903.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6c11b7-909d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029165, "uuid": "cef50980-6243-4052-aee9-0ce2df403c3f", "comment": "Malware payload (Dridex)", "value": "f2b6af138796806a5bc62f323d27682b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029165, "uuid": "2b494240-c554-4acd-a77b-e612993b740c", "comment": "Malware payload (Dridex)", "value": "aab6d3e32436f21299284820659ceddc446fda65f83e1f5b67d6f27c84c86528", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029165, "uuid": "1e5db776-bb0d-4bf0-9896-7a841187da6e", "comment": "Malware payload (Dridex)", "value": "e23c7750116dbd15a9a7a5239b9465f43c46034a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029165, "uuid": "4e6db15e-8895-4c80-88cc-26968894d93f", "comment": "Malware payload (Dridex)", "value": "582d080d1a93fdac5fb19bfe493b6134df7a74cc89a189a79ae051a052722651fb620253b78aa11c741b33d7f5ce03ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029165, "uuid": "3de7d2b4-bc1c-4cf5-a99e-f7a52e781766", "value": "8733A5A6B785E806C94907764CE6C7E63322FC555F57834B3289F71F2F76B808A02A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029165, "uuid": "82b51503-6b59-4a7e-bdff-973fec640f8f", "value": "1536:UFk3hbdlylKsgqopeJBWhZFGkE+cL2NdA/R936Sm4jYpromMiK:UFk3hbdlylKsgqopeJBWhZFGkE+cL2NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029165, "uuid": "3289f764-700a-4d79-aaa0-22e0fadb2588", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029165, "uuid": "4af04a9a-b75f-44a5-8eb0-fef99323c424", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029165, "uuid": "08a77f17-b080-49cb-a590-aa44da186492", "value": "Purchase_Order 1440.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59b49d1-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617027997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027997, "uuid": "9b62b21a-6ae8-4d90-b94f-8fd26d1a5d56", "comment": "Malware payload (Dridex)", "value": "2055515053bdd6a46209c2167fcfeb6d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027997, "uuid": "1ff47f7a-b850-402d-b68f-4882ed3d639b", "comment": "Malware payload (Dridex)", "value": "aac1dc7ac9ae4022a55cebd23e876c97419959e67d38438ebc5503520136982d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027997, "uuid": "2981d19a-66b8-496d-be8f-aca5bbb3d3a3", "comment": "Malware payload (Dridex)", "value": "6179ef5d54b7b88fd96c0a56eb0df401a6f98899", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027997, "uuid": "be6450fc-8631-47f0-ad21-24067a035553", "comment": "Malware payload (Dridex)", "value": "c9e48062dc60769bab1478964883b8b77748bb25dfbd069311b5fc58b98b35c3ea56eda452a29b224ede10199d7c4ad8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027997, "uuid": "e35841b8-ee67-4e10-94bd-2aa3228dc4fa", "value": "8414AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027997, "uuid": "950d1150-d0b8-423e-80b7-2c8d66fb2a6c", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027997, "uuid": "69c0178a-45e0-49d9-822d-d90f20439d03", "value": "3072:l1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027997, "uuid": "fc68de78-99d7-43fd-aadf-6fcc227d0717", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027997, "uuid": "165332a7-c623-45ca-b8ae-d86d3660a11a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027997, "uuid": "12bf1b53-e306-42db-8ac1-e5dd39582b17", "value": "aac1dc7ac9ae4022a55cebd23e876c97419959e67d38438ebc5503520136982d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fe6084-9064-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617004586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004586, "uuid": "e19d0d28-6b68-413e-ab4d-731be7371da6", "comment": "Malware payload (BitRAT)", "value": "dd32ca38fe227bb728c1ef2a5be30a50", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004586, "uuid": "2dfaa7bf-8196-41ee-8018-21699f849f5d", "comment": "Malware payload (BitRAT)", "value": "aafd753b84e1eef76d8925ca0e9e5ed551a4a3f955176af6c1b4051b9fb4a957", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004586, "uuid": "c51bee28-8b24-487e-8460-123703541668", "comment": "Malware payload (BitRAT)", "value": "3d72dea849268a249cec1a0821158d7b2f33ec1c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004586, "uuid": "a9319662-c161-499b-9405-e7f10560158b", "comment": "Malware payload (BitRAT)", "value": "0d43c3ec219dd1fa91fc67a6f215b7fc9663d9e4a065d5d726e286af611982bc2cc3c7ded0ca10ffca238e1c5139196c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004586, "uuid": "5698a1f9-0033-46e3-b4ff-3572b253e354", "value": "38E3E04172A2DDA7F2A066B65DD7EB853379BC8D9D22C25B70D0BB1DBC398F80842345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004586, "uuid": "73ab60e1-6df6-4837-a7c1-090eb4988eb6", "value": "1536:UEDicUuVfpT3gprKDr6BwJOGFYjX73Ob+9DdZiVaBhA8BKF5zESyYkWNIVu7WBPf:UMg7rKqOJOGFYj7e0DdZ0T/zEM+VjBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004586, "uuid": "0d1c9e18-d8ae-4a55-910c-f6e7a90f13b9", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004586, "uuid": "cff23f17-456f-4d10-b7ad-9b4ceac6cd20", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004586, "uuid": "11510903-fc28-4ed3-869f-9574fb189483", "value": "factura202103.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79827b49-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029588, "uuid": "7d0e4b6a-ea9e-40a1-9bf7-e689519281f8", "comment": "Malware payload (Dridex)", "value": "67e90474a508bd74b6c4c89b7c9c4bea", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029588, "uuid": "11809cac-08f7-4638-add5-d3497bd54a6f", "comment": "Malware payload (Dridex)", "value": "abce3c4bd1ffb97a83e060bdb4da1f3e983875d29863fbd4e398203978bb2321", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029588, "uuid": "48a4b015-9615-48a1-887a-f990ae8b56ed", "comment": "Malware payload (Dridex)", "value": "2368b495bfbe26b777136d4b9b1faf4c05ec0f81", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029588, "uuid": "06e813af-8abc-46e1-85e4-ef10f0c90169", "comment": "Malware payload (Dridex)", "value": "eec7afb1c9b04c2ecd8dc2c0e183e8e398db5eddcbb6445a7848890055eccc852b1bf82e925520b76537e87606eaa674", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029588, "uuid": "41eb3489-0d5f-4fe5-b190-444308a7ef7c", "value": "F484D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029588, "uuid": "61927493-a2a4-4dbe-982d-37c08adaa36d", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029588, "uuid": "d0888b89-8e3a-41c2-a1ee-16cfbc3cd76f", "value": "6144:rbazNBbycfmKsyUlVlMdUFIk1KyHNwoAypFp5xM3C1h:CzeTlVl/7HNdp5W3Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029588, "uuid": "257c328f-082a-4b88-9955-f78258a7d003", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029588, "uuid": "fe6ef4ea-d5df-4769-a458-4ecd611b8b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029588, "uuid": "b2dc1ae3-e55f-4fb1-b894-5739423f2cd4", "value": "abce3c4bd1ffb97a83e060bdb4da1f3e983875d29863fbd4e398203978bb2321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176e6c69-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002365, "uuid": "03dc72b3-a956-4dea-b9d1-6a579b716659", "comment": "Malware payload (AgentTesla)", "value": "2c1115d8cbffd007ae9927c60ad43950", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002365, "uuid": "e82e6f33-7615-4363-8d1f-8fee5cfd8524", "comment": "Malware payload (AgentTesla)", "value": "abf4aafe1fbe1922514fa61b1d1f3e36005786489752eec3ba62ae4b1077e559", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002365, "uuid": "3d8ca819-3716-43b7-b4be-3ea369ad340c", "comment": "Malware payload (AgentTesla)", "value": "42bb01382995550457cc352efc58da5d260f23cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002365, "uuid": "ceb0b143-cecd-4904-a6d2-0bf3a06d5031", "comment": "Malware payload (AgentTesla)", "value": "3379f6e98a1bd728d51b27d9da90ebffd100e29e7a8826ad55e9c8bccd4e897ddcdff175dddf41f76af7ae68d4796e50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002365, "uuid": "47caa7d2-cf0b-47a8-80db-f1af229f0b3e", "value": "F235394C1E99C2C6E1794BB891D9E49943F56EF38F22CCB9BDD547CBC230B41E606622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002365, "uuid": "2fa4e0cd-5952-4d3c-9b2d-00cc794d4216", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002365, "uuid": "c9cf66e1-c5b7-4663-a16a-dfe440dfe51f", "value": "12288:8Hf4wz7BBC9Q99HmeiViBfzuvR3zuNIpYRy7Rb6Zm8uVcAxALtgM5ppQ6OB8EnIa:8LtLiViNyfP7RBhALt55ppQ6v5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002365, "uuid": "b0c2c781-0ddb-405c-b770-668356725fe0", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002365, "uuid": "51072817-5f26-4233-a5ec-8f467368bbdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002365, "uuid": "731061cc-b5c5-4cd9-8d20-dfabf45f61d0", "value": "2c1115d8cbffd007ae9927c60ad43950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3eb923-9046-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616991906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991906, "uuid": "01f7056e-c21d-4223-b5ff-2c75050f324b", "comment": "Malware payload (AgentTesla)", "value": "4c39cd0e88d79fcf93d346e04aa36ad2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991906, "uuid": "583f93d5-3cd2-4eef-b392-47cb22c74af0", "comment": "Malware payload (AgentTesla)", "value": "ae1244a9c96ef3f60189c2d3e33a421c23191ace72a2b4924d63d2e46a09f395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991906, "uuid": "8cf9eeb2-a56e-4430-b682-32c5d3d1caa3", "comment": "Malware payload (AgentTesla)", "value": "8c768215e6312ec74a605a5831062153d0396df7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991906, "uuid": "40624303-3783-493f-954f-45bcc7bde0c4", "comment": "Malware payload (AgentTesla)", "value": "68f9dd71a3ed1378cf26a72490d6a120c196d35a288c4d461e087647c26d46af1fdabc3c3ead7609a51cb2211fb4dcb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991906, "uuid": "59546587-7e07-4c0e-a88e-f37b19dca9d5", "value": "2B359DD8B540B5DDCC1A8B728979CC309612BDFA5237C50E50DB3DAB7A7E69B8D100A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991906, "uuid": "bd560642-ba18-499e-ac39-561345999e6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991906, "uuid": "81f7ae73-20ff-45cb-b868-ca5d16e07af2", "value": "24576:h0gUISafnX6z/Z9zHXE+ahtqx1Co+tAsw1q:2gUXrT7E+ar7o+X5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616991906, "uuid": "f738d7be-ac9b-472d-826a-9085b0d9b4c1", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616991906, "uuid": "86d586bc-b385-412f-826e-1477e053f9cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991906, "uuid": "f0190b15-a2bc-4304-b5d0-effed115ed1e", "value": "TT Swift Copy.pdf...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3310e387-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033335, "uuid": "b3d426ea-9c43-4d25-b628-f08ff7d4ff1e", "comment": "Malware payload (Dridex)", "value": "f16549beb46741a7ab052173af4c620d", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033335, "uuid": "bf6634a1-5664-4825-8f59-f9409050332d", "comment": "Malware payload (Dridex)", "value": "ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033335, "uuid": "5eaab7d2-e505-45e5-8d65-d5873551b343", "comment": "Malware payload (Dridex)", "value": "b117adde9c307494d83f6e76dacefedee1f73380", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033335, "uuid": "05b0a281-24ec-4c36-bd00-8ac2805840c9", "comment": "Malware payload (Dridex)", "value": "dfd1e97b07cf75c8e9f83e977f12049364db1d293cbdbc52655841d26b9ede39ff63a710f767652de95cfd41c521dd6c", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033335, "uuid": "dadba88f-714c-40a7-a9e6-2408da4ad227", "value": "DB84D01367D15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033335, "uuid": "cbee589d-16e7-46bf-b7e3-c6b88dd3c09b", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033335, "uuid": "ba643794-7bd0-4250-b7ec-eb49a4c812c5", "value": "6144:ebazNBbycfmKsyUlVHMdUFIk1KyHNwoAxpFp5xMBC1h:FzeTlVH/7HNep5WBUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033335, "uuid": "a4891003-f438-4ee4-95bd-600c10b3b3f8", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033335, "uuid": "aed85dc5-6ffd-4904-81e8-42d2bb39eb77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033335, "uuid": "35ab4ddb-e021-4f25-a0cf-0e35cf7d2580", "value": "ae348b3372c25ec4df962239f1dedc15f750d8021e12fcc8f918623b0af6fd75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719e4747-90c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617045036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045036, "uuid": "128eaefb-6e45-4a9f-822b-f2f3501947b7", "comment": "Malware payload (Dridex)", "value": "44dcdfd1873198f50c5dd4dbb1fe8f44", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045036, "uuid": "0c3fbc3b-b13d-4e2e-ad5b-4486790b4099", "comment": "Malware payload (Dridex)", "value": "ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045036, "uuid": "32083b14-6660-49ac-aa07-e4d906eb26a0", "comment": "Malware payload (Dridex)", "value": "28fb8eed7c243dc5715b71564dd11c953f969aca", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045036, "uuid": "b21f2821-ccd9-45d2-a49a-e4f93a3897a2", "comment": "Malware payload (Dridex)", "value": "ef53944d86b2f7ddb10f903c699e3d8a81f6379e623de583f57eef19458bb31b8c6deebebbc563a111630e8c4e665480", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045036, "uuid": "aa5f661d-6aca-4630-9e59-5aa6268a0c89", "value": "AE84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045036, "uuid": "0a2f41b3-aece-4fb8-b402-2174b112261d", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045036, "uuid": "fe82676e-ce31-4a91-b4ab-18316a0e1a06", "value": "6144:WbazNBbycfmKsyUlVkMdUFIk1KyHNwoATpFp5xM8C1h:NzeTlVk/7HNQp5W8Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045036, "uuid": "100e2426-e565-4cf9-a455-23c0b81a31a6", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045036, "uuid": "2b4d3b44-06a9-4016-a8ce-0f0599e373d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045036, "uuid": "958a9ff5-f4ef-4fbc-9072-bb4f1ac4713f", "value": "ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3f8150-9076-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617012362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012362, "uuid": "4d9e2c6a-5c72-4072-87fc-98f9d90b651e", "comment": "Malware payload (Loki)", "value": "0c45fd6c48c691bd23db954b83d7c36f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012362, "uuid": "25fb661b-341a-4a60-80b8-09d0676805ed", "comment": "Malware payload (Loki)", "value": "ae7bb919687a04851856a3517c0496dbae28f8761f5bf4d75459722b5682ff80", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012362, "uuid": "38707e68-5184-4cd2-85a0-1edca7ab7a96", "comment": "Malware payload (Loki)", "value": "5e1d9dcd01a92ba2d1e4046ce53839e51420386f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012362, "uuid": "b4cbd1dd-d244-4778-8ca1-57c0f8ff6b16", "comment": "Malware payload (Loki)", "value": "51e96ec42fca76e77d763878d8f14bbf30659da8e1dc6a1dcdcd22c65600942ff8711d913da0a8b2ce0ca413bd56ca45", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012362, "uuid": "54c17a2f-a61f-47fb-8766-ebf3b2c3fb18", "value": "5FE3132EC011F167B2256BFD1ABB16CCB9029473970513AE847E41392BA1E69C71E3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012362, "uuid": "c98b8820-47b6-47f7-ba53-f20f9aad0b1f", "value": "3072:BpXFFJv+lOehR1YK7DoIbMBQY51R96d4jocGYgGd9uk3XZ3JomaPc:BRR+zhRGK7xbFdyCm53JXaPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012362, "uuid": "c7b34acb-3b87-452a-b4e6-ec2461306a23", "value": 147009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012362, "uuid": "1add7f28-b7a5-4fc6-b6d3-bc596400e069", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012362, "uuid": "a59e6ad6-989b-4d65-a073-99d300844167", "value": "PO NO5532.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676cc52f-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617032134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032134, "uuid": "b2608891-2a13-474c-bb98-4a8507696615", "comment": "Malware payload (IcedID)", "value": "1e30b923e51a2302dcda34a9d9183a1f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032134, "uuid": "613f681c-fcd3-41e7-b0aa-4970d73ff4ec", "comment": "Malware payload (IcedID)", "value": "aec687feb7022c1159e2f296ed8ee3ecbbab55ea200efc2f6de7847aae4ea188", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032134, "uuid": "654a7a7b-984d-4c34-b144-75544d12b24e", "comment": "Malware payload (IcedID)", "value": "69364cfad5a3397dcfe39ccdcfe4810fe0229693", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032134, "uuid": "783fbe4a-9317-4b0e-ad0a-9aef0dd5c78d", "comment": "Malware payload (IcedID)", "value": "fcb2f737b12e1750ed8e385cc01b696390352d2b7229a30e3d5dff046cf9934500794e159b6bd64c2040508fda8f8502", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032134, "uuid": "67ae6cf0-0b8a-4a93-8e49-acac05161c95", "value": "3E04122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032134, "uuid": "22186e22-8f30-4248-9fb1-2fa654fac1c2", "value": "3072:O3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:OnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032134, "uuid": "70f11e32-d4a9-4974-80e8-1057fc2160c9", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032134, "uuid": "3ea4ce1f-93fc-4953-83bf-5a1323cb23ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032134, "uuid": "28b0ae00-1b39-4b9d-bcae-d0b97757c0e6", "value": "Claim25342033903292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee2aae0-9080-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617016846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016846, "uuid": "3f377773-d21c-413f-9451-9b1458e21ca6", "comment": "Malware payload", "value": "bb3953963ef8e0387f729cd5b2922110", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016846, "uuid": "cd6d7155-37e0-4345-874f-d912024ee0bc", "comment": "Malware payload", "value": "aed5cb66a654c92bfc010a2101a34b982e1fd832cbdea47900cf8282bd569f2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016846, "uuid": "3e89e4fc-2397-4f78-acc1-8eacf02edb33", "comment": "Malware payload", "value": "181f00dff3b3326bd3a9a494a52e88c81939dc9e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016846, "uuid": "a1f37393-4acb-4c5a-8ec9-661904dfd073", "comment": "Malware payload", "value": "928818b1c2b022605ae692cef2f74ae8af8957e5b3d58411cddf45359526d533db807b7636d7b5aa78bf7ea9ac04cecc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016846, "uuid": "737d7d26-2b9d-4eca-88d2-6e97a0415f07", "value": "596423F908F67B99003B0057314EB6E4A89BD37481B96C59BE53DE5A2264ECDCC9CC9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016846, "uuid": "598d6660-c170-44a2-b5e3-fd2336293587", "value": "6144:fqqRBXZKP9AVTLFGS5nWQ+WkMJNbsLyojTXWJIIYapFxAEadiRce/:iwBUP9A1w4txJNbsLyASJvxAldiz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016846, "uuid": "c7b02c7d-2ff7-498a-b5ff-30ba57a22d88", "value": 333138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016846, "uuid": "5585bf1f-0511-431e-af7f-fa386d8dfd98", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016846, "uuid": "f4cba721-cdb5-40c7-9e18-2ad15a1d5848", "value": "Swift Copy.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ef187b-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005847, "uuid": "ef0347cd-8294-419f-a9c2-e94253298afb", "comment": "Malware payload", "value": "a9d0e080a92e568dbca4c2d0c679883a", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005847, "uuid": "962e125d-80b9-4f8d-a27b-b6b8a8207db1", "comment": "Malware payload", "value": "af7e5864c9e4b6c0161231a1be5822505ba84eb55e0185693ef5835954c98a21", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005847, "uuid": "fd4562bb-59e6-418c-8729-1c70438aae43", "comment": "Malware payload", "value": "7731e6045e269c78b4b97328153ad3dfa5e92912", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005847, "uuid": "e936c8fe-7f6b-45d1-a90e-3cd70152477c", "comment": "Malware payload", "value": "e2a948fca1e194c80cfff7ffc400c3baa0ac39f140d2ea11bc2c487a79baf11355ef1c217287365635b2020029577af7", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005847, "uuid": "ba6e7d08-a87d-4a82-8bb7-89b15fe8dfd6", "value": "20A60201EEC18573E8B1013512BBA77A5A3AA9242725C5D3A7D438787D307D16E3B3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005847, "uuid": "10a0e6fa-c303-4820-a77c-4072d862020c", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005847, "uuid": "7909549a-af6a-445f-8d68-22d259564d05", "value": "98304:69Yyb5er5PTIHykLIbh9jMsUPSNN8oPupyG/bkFdqq0PgksyUuwAjlAO6zLnwe6Y:69berPbnL38obcGcZsL0jz6oe/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005847, "uuid": "bcd690d5-390f-4882-82f4-395268c29b2f", "value": 9865920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005847, "uuid": "b0f7af22-8f7c-4b0c-8a8f-479d2695d8a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005847, "uuid": "7c069cf1-91a0-49bf-87cf-a2f1ad655fd6", "value": "af7e5864c9e4b6c0161231a1be5822505ba84eb55e0185693ef5835954c98a21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddd6812-9057-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999020, "uuid": "32f3b9a7-8574-453f-8b34-33964968c82b", "comment": "Malware payload", "value": "daba1c460ead6f2fa0c390b73ec18871", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999020, "uuid": "d7dc94dd-480d-4e34-902d-90cc94a4cb72", "comment": "Malware payload", "value": "afed70cceb78432bfd8ca6c31dfe9e9695472a0c203c046478a0a76a63a16451", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999020, "uuid": "5b485c94-45d5-45ed-b4ec-9e85a1e8bb58", "comment": "Malware payload", "value": "c898ad1f9fa47cfc85b255e65de648b842011c10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999020, "uuid": "fe0d4849-f26e-4ff8-8fff-57a5ec6ad306", "comment": "Malware payload", "value": "6cb49208f03ad0c5ffcd00bb2c56ddb39fc4aad4e66674e7ecae08c7132ba98dea88ec3bb2da9e6300c802f9bcbf7d98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999020, "uuid": "33b0fb08-1605-493c-ac16-38741db5d5a6", "value": "630533598228DE579B14FF382872768A57506B5FF2E58BC232F2324C58FA4B24C277D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999020, "uuid": "ab9abbcd-86de-49e9-a597-a8c3702b6891", "value": "24576:Q+D07RK7gsIkDdVOTrSOi1WR9+0pbZAt06Z:Q+o7RK78kDdcTrIKZkOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999020, "uuid": "4ee3c75a-9cc6-4030-a753-251b24ddba3c", "value": 867394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999020, "uuid": "24416c67-51fb-406f-a400-95e12f045cf2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999020, "uuid": "8d5df4d1-3f69-4d87-9be1-f32360049ce8", "value": "Bank Details.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf30915-9096-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617026265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026265, "uuid": "48a7655d-87db-469e-8d41-75c9d8668cee", "comment": "Malware payload (AgentTesla)", "value": "188eaebaf81291b9d0121a35dac448f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026265, "uuid": "ecbdb474-b5df-4f0e-aa5a-921da70e05ff", "comment": "Malware payload (AgentTesla)", "value": "b01865229db9bdc2cbdefbdcd8559f2f2488a4f267bfc7fe17c3cf61401929cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026265, "uuid": "3f24cce0-ca84-4265-bb25-c1cbfa411593", "comment": "Malware payload (AgentTesla)", "value": "c7c1c04759eacfe9ee8b49e85a1ee660d66b3abc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026265, "uuid": "eddde2bd-4bed-4eb4-8656-def9d1d7163d", "comment": "Malware payload (AgentTesla)", "value": "0c05bc2692feccf52308544cb7d7bfaa155f66d890b3d6db9ef7dba5df34c12e272a63186d26413afaa0db1932f73a3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026265, "uuid": "4b0b9ea0-ab67-4c17-bb0f-710a867e8477", "value": "D705015831646F8FC12EBE761453182C9F70A5BBE62BE30BACC719ED464DB864B1074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026265, "uuid": "56fdccef-1273-4324-9d60-ed4e15068a6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026265, "uuid": "df8e1fbf-9c15-46c0-90e8-2eb7c30839f4", "value": "12288:d2mgQo+xxgkbmYE+rOcMaPrI9/b41BheGCOOhQvVK0hCOMYQaSanNHVCCX5Qe:gmJfbxnC81xVi10hCzYTnHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617026265, "uuid": "ec3989d8-6647-41a2-bb27-09f77a38974f", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617026265, "uuid": "ce454d0d-ec7b-45b6-b256-ad5e6574bdbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026265, "uuid": "c46b7b53-f58f-4fc6-9231-16358100b95b", "value": "TMyIyrfrorzReCk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353e9cfd-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033339, "uuid": "c4905353-7935-4596-87e7-8cf601c29afb", "comment": "Malware payload (Dridex)", "value": "573b7e63e7937bebe586ababf46c5edd", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033339, "uuid": "0db136b5-f923-497b-bf4d-02f2da74d43e", "comment": "Malware payload (Dridex)", "value": "b025cc45374d15c0a372cdb43e7c91fc22152ca916124d581060f5203bfabd04", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033339, "uuid": "2b7e6c6f-0875-45d2-92e3-188657ea843b", "comment": "Malware payload (Dridex)", "value": "b18e2dbaba1e214b2f3f20bdefe4a3fd76c2bcf5", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033339, "uuid": "567f353a-67d4-4811-a74b-9b9f864d563b", "comment": "Malware payload (Dridex)", "value": "d298641a9910ee544a5a71c97193512a7257c6081a4da1b63d2ffb6873c0b3bd015a1a62ced65b9922145b64f3d19376", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033339, "uuid": "e4bb6eae-4f4d-4378-8571-da958162a20f", "value": "9E84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033339, "uuid": "4138cd4c-18f1-4f03-bbcc-434e1b1d62cd", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033339, "uuid": "434be12d-ebf2-49eb-be79-a02f7b31b6ef", "value": "6144:WbazNBbycfmKsyUlVXMdUFIk1KyHNwoA/pFp5xMNC1h:NzeTlVX/7HNYp5WNUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033339, "uuid": "d1d84d89-8efa-46ff-9d48-ee782faf75f6", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033339, "uuid": "435d3d7d-c75d-4f73-8a94-dcd97fc9421c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033339, "uuid": "946f6b6a-e61e-4c25-9630-acadc73d50dc", "value": "b025cc45374d15c0a372cdb43e7c91fc22152ca916124d581060f5203bfabd04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382d1947-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005856, "uuid": "ee5ed444-24a2-492e-8bca-f894e3888bc0", "comment": "Malware payload", "value": "90070741e9c025f841f47f0c3adee3d2", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005856, "uuid": "c6da5e6d-1889-4eb3-bb18-3c7176014fe5", "comment": "Malware payload", "value": "b06ce74a41d1cfd7bc73dc8b67417f1c17c85d9570f88fb842e124c9eb0c29ea", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005856, "uuid": "a3bd310c-2560-495f-8b8b-6379a5b5e485", "comment": "Malware payload", "value": "187125949c88663397f510f6a179e330059be749", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005856, "uuid": "15bfe378-7d03-4416-a320-e7d2031548b1", "comment": "Malware payload", "value": "cf78780021f20b20629c02d049f396b169e6e0b1499e0231b0408913a8cd07b9d2b4a474af2c3d06b7ee2a51f77ec51e", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005856, "uuid": "a76be96b-fb8c-4532-af17-b19dbd445fa0", "value": "D9C60101EAC19577D8B201B412BB97BA5D3AA5202729C5D3A7C438787D307D16A3F3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005856, "uuid": "9510a27a-67ff-4835-8b50-5730ec79f4a4", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005856, "uuid": "5b279543-a363-4db7-b809-50ff0123044b", "value": "98304:09Yyb5er5PTIHykLIbh94WsUPSifcDeFPPA//FIqNN0qNIMEJLhk/vql9lVYPjOH:09berPbnK+yei/icN0NMEE3WqlE9VWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005856, "uuid": "aaee7416-2184-4f34-b461-6b21f137cdbe", "value": 12451008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005856, "uuid": "1643567f-0bda-4944-b41a-7312ce30b6ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005856, "uuid": "63d13793-fa61-41ac-b213-da2623680d4f", "value": "b06ce74a41d1cfd7bc73dc8b67417f1c17c85d9570f88fb842e124c9eb0c29ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39527b4b-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "6d267818-7031-4777-8569-9aeeca924bfe", "comment": "Malware payload (Dridex)", "value": "648eee43c6256c9709e4253a92ae75ee", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "0823cd77-88de-4a74-bf67-05cdab165dbd", "comment": "Malware payload (Dridex)", "value": "b124a029c8ce38f7d824b695271c27f86806c74da260e61175533266ca3c8102", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "c057a94b-d2a7-4b16-bdc9-1457ca63b3ac", "comment": "Malware payload (Dridex)", "value": "1d6c163071e39e79c6816a66ae005e33901580e8", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033346, "uuid": "0f53dd24-a2e1-40ab-88ca-d695b6192504", "comment": "Malware payload (Dridex)", "value": "8c5a712fc826aded38c9428322beb2f2cf19549ef511cdf1c0e8d2552ec485cb59c4ac3cc57b287b975a7908860e1a0e", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "aae64460-319b-4611-8422-00d4b20be8c6", "value": "1384D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "af09ce17-e706-413a-9275-e7a73c10f625", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "d84e3b94-c378-4cbe-895c-064048e642fe", "value": "6144:ybazNBbycfmKsyUlVfMdUFIk1KyHNwoAEpFp5xMJC1h:RzeTlVf/7HN/p5WJUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033346, "uuid": "1faec629-823e-47ba-ad5b-d3c81f5c0280", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033346, "uuid": "d77e4276-fbe0-499c-8b58-864f7666e56b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033346, "uuid": "4dfffdfc-9fda-407f-941c-abb36e203a47", "value": "b124a029c8ce38f7d824b695271c27f86806c74da260e61175533266ca3c8102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a076247-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616997672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997672, "uuid": "165d7a6c-c008-4fa6-8297-5df0a769ed8b", "comment": "Malware payload (AgentTesla)", "value": "8653f4c4b9664bb828f4bafd9da98819", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997672, "uuid": "e2cfaf2d-d368-41db-87ba-4bc53e87f165", "comment": "Malware payload (AgentTesla)", "value": "b131e6082949fc450f925f183715c6da239cd656d1b71ed9263ef49d2d886507", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997672, "uuid": "f4cae2d2-c456-4143-9ec6-65f1135583dd", "comment": "Malware payload (AgentTesla)", "value": "3b4b4f1e47eea83df65ef7a4baf9f7b42be21f24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997672, "uuid": "7e06a4a4-7ef1-419e-97f9-e8421813b854", "comment": "Malware payload (AgentTesla)", "value": "295c10f228fe60de73fac399d8720f07408b6ac2df88961222005fc42005745fb10ffcf31446a7f9418ed170e08ce5b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997672, "uuid": "ad4c9aa9-d229-438e-a0fb-002c53179a8f", "value": "95D53398A5DFCBB2C44FCDFAF0ED8ABE012B5DD89D00851AB22536122475234B7D3B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997672, "uuid": "87e1a302-5897-48ac-be6e-ad58f4318553", "value": "49152:4FqJpa2aei8/oz56/ntNOjewHSzERrihtjcY6isr6y:WNei8gz56SSzMOZcYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997672, "uuid": "a64648fa-e5fd-4999-ab06-5c6efb661af8", "value": 2835968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997672, "uuid": "f38eae36-5847-49de-898a-81735e4ad50d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997672, "uuid": "c84a3b75-7e7d-4a4d-bf9f-d2bb2e060fa9", "value": "Receipt_Mar29.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7bbaf4-909f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1617029972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029972, "uuid": "a1e09897-a59f-4d4a-9eb8-c82261113fc2", "comment": "Malware payload (Hancitor)", "value": "b76a1d2b926e053e47caf8d132c286d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029972, "uuid": "0192970d-83eb-48d7-ad7a-abdb9c1a6078", "comment": "Malware payload (Hancitor)", "value": "b1df5e4a7d6191c7646fb76ba1e0ff95678472182d31ad4b6d916e731622135a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029972, "uuid": "b18a0e83-2c72-4c0c-81e5-bb932646f306", "comment": "Malware payload (Hancitor)", "value": "ff77e7ffe46bebd812e231e80b9226d7accc5370", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029972, "uuid": "8915bf65-8424-4377-beb1-5e967d5f3271", "comment": "Malware payload (Hancitor)", "value": "3696bd574336a61cc0ff677ec30e3535d49647feccc641489497e15e941f608d19409989ce159ca319b99f886fe4eeed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029972, "uuid": "ed566553-a264-44bb-86dc-9084674affbf", "value": "8D149E1332E18071E273473505BF9A010BEFBD618A70899B738D365E5F3B6D05A3AB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029972, "uuid": "a0db9f1a-963f-4684-805a-916c09f73fbf", "value": "52a60db6284893e8e02326e17160fb85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029972, "uuid": "e2b0c2e7-613f-456b-9f7e-e73b538f89c8", "value": "3072:TReOhFBeZvbnkm0BwyLEgXuBHJaLpjL4+NcrF40BmhAd:t5FwZvrwKcECuML4LJrOAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029972, "uuid": "0aa3c90e-b7e8-4ef9-ab90-05060822d230", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029972, "uuid": "894e7d08-03b1-4a6a-87af-c0ee8dd4772f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029972, "uuid": "0d02d9fa-2b6f-48f2-8443-b4263af341aa", "value": "msals.pumpl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f568d84-9087-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617019719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019719, "uuid": "ddd8d516-a24f-4cbc-96ad-a9bbb5aff5ec", "comment": "Malware payload (Formbook)", "value": "8328b32f6e9e809785960752f6b5e6c1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019719, "uuid": "984171d1-2020-440c-a352-30f8916f9041", "comment": "Malware payload (Formbook)", "value": "b3602a947de95c7a84896a7dba6521402156264ec82d7373ac37508ea967f875", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019719, "uuid": "8d1e0248-2c43-4c23-b031-1e813bb75dc6", "comment": "Malware payload (Formbook)", "value": "da9177ce7212cda02745813d2048512668dddad5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617019719, "uuid": "c5fea5ce-1249-4f84-a9b9-2aee9e378508", "comment": "Malware payload (Formbook)", "value": "7869d81e1fa0402bc3d4cc08ad4614d2198473bbe6187d89825fa9bdc23ab40bcfdec5d4fe56f2cab94179527cdf93da", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617019719, "uuid": "c90db3a3-6df5-448f-bc0a-c129154ce593", "value": "91B423998B2C674E43D6BC4A7C3D37FE4A612C3FAAA41126614772BE3A0521CDDC8D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617019719, "uuid": "9da76fb1-c129-4b24-813f-34180f6f8ec3", "value": "12288:f5v+SwRR0Gl+hmK5InLv88SWNJw6wj/Jibuts0T:x+wQVnLv85WNJwD90utss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617019719, "uuid": "926b97ee-fe4d-411a-b933-5ebaa235b23f", "value": 534041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617019719, "uuid": "c7c9ede0-b447-4eef-b358-cde8f67ed7d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617019719, "uuid": "7b9cf121-3ef7-4fd9-9002-036007e9938a", "value": "PO6543.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f97084-9034-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616984114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616984114, "uuid": "28d33fcb-8fd5-43c1-ae94-bc6006cb9d7e", "comment": "Malware payload (Dridex)", "value": "48cc8678c0f2072b54f29ff58fd5b7ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616984114, "uuid": "48b5a8ea-79f0-4117-a878-47932ed464a9", "comment": "Malware payload (Dridex)", "value": "b36a61f10197f6e0bded2e3a9416c2e1ed03c04ffa5fd961e01600b35efceaa3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616984114, "uuid": "d4afffcd-e994-44d1-a445-d029711e502b", "comment": "Malware payload (Dridex)", "value": "d1790bff526c164084c2396bd0a7a49351611e0a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616984114, "uuid": "75e5fc64-c9ef-436f-a66e-e5bbf7015f9d", "comment": "Malware payload (Dridex)", "value": "9bc9695cf29ea502bd7d13603860e45d0c67dd50a89053c670ea4f7c38e7053dfca9363f0795f1b78f62aedc6f6e6d00", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616984114, "uuid": "aa7669da-ef36-4c94-80f8-8ff4494d2d30", "value": "8C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616984114, "uuid": "44968311-5a85-4284-a927-10b43245333b", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616984114, "uuid": "96f406e4-8efa-4f66-b5dc-e34a7bd81432", "value": "3072:P1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616984114, "uuid": "102bf8ab-d60a-4da4-8db2-7a0a4270b5c9", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616984114, "uuid": "f9d7de3d-f3e6-4c90-a980-8ea353d08441", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616984114, "uuid": "fc905d4a-9b7c-4724-b25a-7498d56d3047", "value": "b36a61f10197f6e0bded2e3a9416c2e1ed03c04ffa5fd961e01600b35efceaa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3d6f3f-905a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617000224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000224, "uuid": "e291b111-a529-47b3-a1ca-003f9c1f9522", "comment": "Malware payload", "value": "4bec767450c850ed01186467f29f3634", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000224, "uuid": "a199b10d-d48e-4db0-931f-6c0504e46655", "comment": "Malware payload", "value": "b39f52f5700b0d58d9478c642889f15ebf6cef5a9b249a6ce46636c70e590065", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000224, "uuid": "9e423a34-dd41-41e3-bd64-ef5a32c33b14", "comment": "Malware payload", "value": "4636de74a35358cb045f3cb224a5440ffd6db87f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000224, "uuid": "d0c8b307-ee84-4b75-a3b4-4dd25a31e175", "comment": "Malware payload", "value": "b157ff598dedbe7ff1c8e9719d1b075649a0905ece70e67de1c0063721f2d776253c5947f09c59369f31563465ece247", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000224, "uuid": "8dfda027-3dc8-4220-b53d-ab6c83262047", "value": "B0942301BE14E9258FFA404A5BBBD973DB9097D558B3C590461CE6C84C9F8007FA6B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000224, "uuid": "52dfba69-29b1-4d77-9b92-e4968879a374", "value": "12288:UpzYtnLLU2jFFAsj/SusFLbW/rE18zhoK5p7Zr527U7a:sktE6PjF8pShFVZr5274a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000224, "uuid": "dc12998d-f835-4be4-bfc4-9b43759e6496", "value": 440663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000224, "uuid": "d2ccd84a-6beb-43a4-bdaa-149c3da9e7e6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000224, "uuid": "a3eb4b7d-53de-4f7a-80b2-939b4e03bf9b", "value": "Consignment Details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d74a81d-90c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617045029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045029, "uuid": "538c71db-6646-465f-a659-b968a9feadc3", "comment": "Malware payload (Dridex)", "value": "e30e1fe058b3b08d3a40360beee0c252", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045029, "uuid": "9ab105bd-b578-43b3-9d1d-db22d99a2825", "comment": "Malware payload (Dridex)", "value": "b3a7004a8c20680b140a68137ae14ddcb6046857cba5a2ec66cbeee0a6f69f02", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045029, "uuid": "3313dbb2-b126-4648-930a-0d0e49ddcc05", "comment": "Malware payload (Dridex)", "value": "220215ed24c76fcb6a88dc766a9b5ca7e11024bf", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045029, "uuid": "12c1345a-5306-4f70-82da-8fddfc7f4a56", "comment": "Malware payload (Dridex)", "value": "591d3f26efa98fd66da5a999de042f9a44dbecd0d0ca1cf3eeb8af9b3bd4e08244194e3a708d1d4b9883685dc03501a5", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045029, "uuid": "4f64d9b0-9246-4a77-aa7e-23a78dfe8a0b", "value": "F884D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045029, "uuid": "8d7ea88c-5417-47ea-941f-585d9abfe1da", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045029, "uuid": "c89841a6-504d-45e7-b7dc-d7727a031590", "value": "6144:BbazNBbycfmKsyUlVQMdUFIk1KyHNwoAmpFp5xMMC1h:MzeTlVQ/7HNtp5WMUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045029, "uuid": "552f12ec-39ae-4692-aeba-299e13a08687", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045029, "uuid": "a912af71-5fe4-45de-9b48-0389325b2968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045029, "uuid": "803d4f7b-7301-456c-89c3-49dbef7134d9", "value": "b3a7004a8c20680b140a68137ae14ddcb6046857cba5a2ec66cbeee0a6f69f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec67b3ff-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617054262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054262, "uuid": "54cb70be-5efd-42b2-af06-2b3d55f77869", "comment": "Malware payload", "value": "cedc6e147ef2460e0d66ab3141a83028", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054262, "uuid": "f4ea90a7-8c02-403c-953c-4adf7eca2d2f", "comment": "Malware payload", "value": "b55d871dcc6505fa2a2bebbb5ec1ce6dd4ce18e02a8061a706e1f43f34f1d08c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054262, "uuid": "8f532d78-d55c-4c50-82cf-cf51cb5bc199", "comment": "Malware payload", "value": "d4d5b692577fdebde44c8c534ccefb5e44831ac6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054262, "uuid": "25a9054f-a232-48f9-94eb-d6fef773406f", "comment": "Malware payload", "value": "f9d8dddf213249de87d1a24e62b34140023b1dea11568b2ba9cd778b6fbfe1ce1d34b1fd72d030ccf1068506680fe3cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054262, "uuid": "bfe45b3e-723e-4706-9c13-821f8f4e15be", "value": "12358F4C5B99C18AD5760A64C1D983F942A95EF2FB22CC6BA5C43FCFF5317C0A606623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054262, "uuid": "91588a0d-4b63-4b28-8212-252cce39c797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054262, "uuid": "006c0aa1-a403-4e09-a697-c0880413d533", "value": "12288:eFgMSEZQGZvMvX3p1C6nsh2hm/ukvvvp8HzjZV7pj/eKtW3P:eFRZv8TCf2m2kajZ/SB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054262, "uuid": "970cc008-8307-48ef-9562-3fdb32c2b8ff", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054262, "uuid": "cd1a9696-5242-4026-9516-a90b3ab4f9a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054262, "uuid": "685ba225-46be-4650-9ab7-493cb7838ee6", "value": "SecuriteInfo.com.ArtemisCEDC6E147EF2.27473.17604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4367217e-90be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617043241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617043241, "uuid": "b49121d3-8749-4b79-aba6-8725d57a118e", "comment": "Malware payload (Dridex)", "value": "15affe19db1034041218aae0e9d73cdc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617043241, "uuid": "815d33bb-dba3-40f4-8ad0-7982215d6a49", "comment": "Malware payload (Dridex)", "value": "b58e453f46027ef9ea1fb29dcb74d2419a4dd09e5813993eb718dc4902ea473c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617043241, "uuid": "e911a26e-21c9-4035-a048-3d35d8ecb261", "comment": "Malware payload (Dridex)", "value": "72933f01351a29392181150b9fa0074956f94a07", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617043241, "uuid": "ed4a5827-edea-4f9b-9bdb-6049ffa12bbc", "comment": "Malware payload (Dridex)", "value": "0b9cfafbfd110991e59633fe7a5686c420adb7523b679c00c2e74f7d718d52ab74f50e5de199b87ea5a5e40bddd602ff", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617043241, "uuid": "c1ec6b48-3c30-425e-8834-3b0b30f45fbb", "value": "5A14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617043241, "uuid": "58ce93fe-3b1b-43ca-9263-74d907975594", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617043241, "uuid": "ba79a5e3-c930-44c8-87db-e980459fbf0c", "value": "3072:V1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:3i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617043241, "uuid": "44fee2ea-2baa-40a6-9fae-7633e391015e", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617043241, "uuid": "f5eee2dd-1e9e-4187-b67f-959e8fff05f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617043241, "uuid": "a839851d-0da7-47fb-8657-982bff96625f", "value": "b58e453f46027ef9ea1fb29dcb74d2419a4dd09e5813993eb718dc4902ea473c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f360b0d-905c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001277, "uuid": "a3164f6f-b1a4-4761-b993-178072f74f05", "comment": "Malware payload", "value": "dbd6359a8731692638e5054d17a0fe61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001277, "uuid": "e8dd03fa-2a4a-4a8d-9be5-1e3e2df52d9a", "comment": "Malware payload", "value": "b61c10b71d1365dd52e76da0f244481a1f589340fcf4b6643dc5c7db0b73c18b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001277, "uuid": "e647c9e7-f2f3-407d-9eca-46f9d5522e63", "comment": "Malware payload", "value": "13fb64892a87b6cee7e2344109dfa072ca42984b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001277, "uuid": "c5745b29-97c1-4ca6-8a24-d6af766fc852", "comment": "Malware payload", "value": "43fed892b474b4a3532d387d38214d9549b864bae345de1dcb2dc8a07e2decf96699bc0059b915559503d34fb221beee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001277, "uuid": "3ad81560-9560-49c8-ad61-4f12d41584b0", "value": "D3F433D805513CD5A91D297AA85F5F5CF990B7B9938CCADF0AA02D0742171E38BE233B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001277, "uuid": "84e4e502-0fd2-4edd-be74-4c8fe923b1c7", "value": "12288:acchnd+Yi+E+xVDabMlUBwUgRdheaBVpYCZr4rGxpt7IvxxrGFNCR3/KVzqVaSq3:acwnd9i+ZxVGbMlU+USMaBAKcroUxyT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001277, "uuid": "1f51d854-389d-45e7-b0bf-a9a2420babc9", "value": 758561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001277, "uuid": "1ee8b6a9-8f3c-4138-bff8-be5b218824de", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001277, "uuid": "c23223cf-8666-4441-9fa8-ccb786241b4e", "value": "swift_txt.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62ccd55-9036-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616985022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985022, "uuid": "a75711fc-1063-4cf5-aa12-a55fe2db58a4", "comment": "Malware payload (Loki)", "value": "121fc4b2b115e6b25030bd445121b688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985022, "uuid": "33671a47-291c-40c7-8ccf-3de64da1ac10", "comment": "Malware payload (Loki)", "value": "b6240ac6b40fb0a7444e40aa0dfc69b8bfb80253bc487ea237001f76c003defe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985022, "uuid": "d2ceb091-e4c6-4c15-9cf8-19df84774a7b", "comment": "Malware payload (Loki)", "value": "b51ec868e189f812c64302fc90c8baa4c734c50a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616985022, "uuid": "14268929-86e0-477d-95ea-8dbcd99668ce", "comment": "Malware payload (Loki)", "value": "13fdf1a156307d1236c5e03f0e57545b94ce6e703366630b59b99e0cc69998f3a1049f2baf8c8bbe420221d4b23b8fa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985022, "uuid": "8fb7c1bb-aefd-4a20-bcc8-3b888826759a", "value": "A43557A0E801F5B1F06472B514337372365EBFE518239A5E7A0BBAB91075AC858F7D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985022, "uuid": "229de325-d52d-4cee-a44b-a3370834bb65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985022, "uuid": "de1f57cc-9b79-47d7-afa5-1a05b51b7117", "value": "12288:cwZxtLLbKLI5ObNHSC2B66N/2q/GuEUvGst25PN:D3bKcwHSC2BbN/Xhvn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616985022, "uuid": "3395f007-44cc-4652-a4d0-034eb4b8de35", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616985022, "uuid": "b439f73f-5344-4857-9da7-4fb4ec5ad341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616985022, "uuid": "b2cde5d7-c830-4291-9dde-e7b2ad10bff5", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d011dac-90e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617061645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061645, "uuid": "b66aad30-8391-4018-9283-49a3f8b4126e", "comment": "Malware payload", "value": "0c7f1a2a2e26a8246e5d4267934fa118", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061645, "uuid": "f66546c9-af85-4596-8e18-9fdd17800187", "comment": "Malware payload", "value": "b6684b29d675a1ed40be5838eec35956908df48fae3cdfc76ac13c56723e6a02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061645, "uuid": "915b244c-24a1-4036-a32d-5620664b54c0", "comment": "Malware payload", "value": "3fb7e0b79f7f92c02a2602ad0822b88f02bf99db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061645, "uuid": "4c4c8a52-c710-421b-9cf2-5d79f03fd8bf", "comment": "Malware payload", "value": "2cd0b97a6ba92828ca17ba3941337dd9dbc05a191267a0b3f24be096dcb9e07dc7ea608f51ba300b828b07bbb47428d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061645, "uuid": "6d0a1d34-fc00-4997-906e-41dcb4a059de", "value": "D8834A457B56C886D6194B364EE2979A6333FC119EFB830B3108F32E6E77DE08A02557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061645, "uuid": "c889cc4a-7fb5-44a7-a67a-13ad41c9a1ca", "value": "1536:IuwnSGiysRchNXHfA1MiWhZFGkEld+Abr7SmSb4wIE7zp0RhBv1hQz7rTPS1LcmP:INnSGiysRchNXHfA1MiWhZFGkEld+Abm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617061645, "uuid": "ba87a983-c103-4e3a-a578-8872aeaa5bd7", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617061645, "uuid": "7f9af7f7-b7fe-4b6b-b0e3-8c41b0162c2b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061645, "uuid": "f3686285-2a31-4341-b2a2-5568c75162ee", "value": "SecuriteInfo.com.Exploit.Siggen3.3974.31629.7110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da14637-9085-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617018804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018804, "uuid": "3d14c5c7-efe6-4e0e-9642-e588c99e545d", "comment": "Malware payload (SnakeKeylogger)", "value": "4e91db73475bc555ce94ba7d892d2814", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018804, "uuid": "ab5a9971-69af-42e8-9688-98136a0d867b", "comment": "Malware payload (SnakeKeylogger)", "value": "b6b1c5d9048199717124f62f1b6ba8184e084e46cfb9178cf5af9a6e247716bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018804, "uuid": "7fd18276-a3df-4e23-9bc4-8293ce8f8ead", "comment": "Malware payload (SnakeKeylogger)", "value": "675b9add12c948616147b0a7957d1a69074d917b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018804, "uuid": "458f94fc-83db-400f-803d-19916f1bb8a7", "comment": "Malware payload (SnakeKeylogger)", "value": "52c1b6120e9337a4334818bb6461ac09745560a927bacc2f5c657fc5fd9b012c620aca126b52d8891a83696dc51abeec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018804, "uuid": "c1743884-0de3-40e9-b89f-4b0324a1a4d0", "value": "FBE43390DF406374A77299ECAF8AC0B459E821144CAC35BDA377EAA7C3D6437636C4D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018804, "uuid": "c7392f69-c8d2-44fd-aa1a-9b6b075125f5", "value": "12288:6OOiM6dAVbX0eyu3YKdTQeMLbJ6JAuGeJiU4t+GtWYU343aYp77gCCBEcC:6OOgSVXd3YmNMLNgAuGeJp4t+fI33VkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617018804, "uuid": "5d30c9fd-c079-40f8-9a47-e27d3b6402d7", "value": 713943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617018804, "uuid": "4c99507b-770f-40b0-8e84-492fd4da634d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018804, "uuid": "a2a79c9f-904e-4a98-92b9-28cb46b37139", "value": "ASB swift copy (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15a8df9-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1616998355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998355, "uuid": "7de4992f-5daa-4e5f-a944-ac9bbda64205", "comment": "Malware payload (Smoke Loader)", "value": "5958275a4b4972824858be1429c575bb", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998355, "uuid": "c596980c-4e7a-4969-b4bb-ad7bb0c89743", "comment": "Malware payload (Smoke Loader)", "value": "b6e4ffe7aa6d987b3710729ce594007e5709a020de8ef4e4d48eaafbe7250903", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998355, "uuid": "a8693e0b-033f-4b03-b6e7-5fa1bf094342", "comment": "Malware payload (Smoke Loader)", "value": "24654e082d4b883efd2cdea6322bc5d8fd6b2d59", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998355, "uuid": "7c5b3eec-150d-4426-a697-5246770afeaa", "comment": "Malware payload (Smoke Loader)", "value": "30e0102190af43c19701ffd55f39708b816bd8b4cf218318a459a4bc33b4cabbd8c1affd9e3053136eb54752f07b9b91", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998355, "uuid": "3800e76c-bd94-478c-b390-2dbf0e323f1d", "value": "0BC44B53018C96A5D23036308092AE3255A7DEB46E3FE847EBB47DDFA13DF856C24A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998355, "uuid": "e2d1e049-bf9d-455d-af0b-102800ac1c9e", "value": "fb2ae5a99be77c84c6fec75f9e8242e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998355, "uuid": "d6ac3edf-9ed1-4c73-9aa7-3d4fd5602bee", "value": "12288:I7uffVFmmmdGK+vAMsrGhh2cB8S1q7KkRDDu+aff7:guHVFmtGKCUGX2y8S1qdR/DIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998355, "uuid": "63b1f3ff-c124-4e52-a727-704134456a7e", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998355, "uuid": "d7c5e8c3-0f21-4953-ac2a-1f1a00067cfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998355, "uuid": "0c01b88e-714f-4bcc-9e0e-b6bd81eb9164", "value": "Tender RFQ List.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d99052-90ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617035304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035304, "uuid": "3f26ffb1-0f89-4996-ad16-9ee28dd67076", "comment": "Malware payload (Dridex)", "value": "04a1d4bc8e5df409a0b9665f9cee970d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035304, "uuid": "fb5c362a-a8af-4583-b5ba-81b903a700ea", "comment": "Malware payload (Dridex)", "value": "b70a867e87b0c4415c7b806e23a5055423146eef8dfeea5680aa8068ad0540ea", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035304, "uuid": "bef8bead-90c7-42e8-903e-40a6b6e9a0b7", "comment": "Malware payload (Dridex)", "value": "4d71d07cb6d07114b3225d8e25ca9f2fc5d8dd9b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035304, "uuid": "0332bdb2-81a8-44cf-952c-21671e8ca934", "comment": "Malware payload (Dridex)", "value": "3ac911f0d499807f6b1842f9a48c432d30e9f55c4459c629eab98595bf3266004274580ec858cbd7558225e928dcf20f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035304, "uuid": "012bb0a3-6a8a-42bb-add5-fd56592e29ec", "value": "3714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035304, "uuid": "b745b994-8668-4a14-b266-cfd2d2072b65", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035304, "uuid": "0c917667-de8d-4e2a-af0e-6058aeec4d48", "value": "3072:K1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617035304, "uuid": "fad839a0-8e2f-441a-bf0b-5fd982a467a0", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617035304, "uuid": "a602c4ef-af67-40ae-9385-d70397d52773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035304, "uuid": "c5803376-124f-4196-8734-9fa8f580f8f4", "value": "b70a867e87b0c4415c7b806e23a5055423146eef8dfeea5680aa8068ad0540ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64a0914-90d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617054252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054252, "uuid": "32797a1b-d858-4f3f-a935-a05a0b11d748", "comment": "Malware payload (AgentTesla)", "value": "e83c0e3fa817502cff45f5a39bb18f5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054252, "uuid": "757672b2-9fe3-4387-b4aa-49a751cdd328", "comment": "Malware payload (AgentTesla)", "value": "b76243a9ae60bf3ddebc1d9c037b81b2a677aae1928c026282bc543837c45ef9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054252, "uuid": "2d713a40-a8a9-4513-bd13-43ac952f2deb", "comment": "Malware payload (AgentTesla)", "value": "aedf7861f55c5dac9f78df3c3c119b29e2f7ce09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617054252, "uuid": "f0ae7bea-3c78-4d26-b5a4-8e0d5cac8080", "comment": "Malware payload (AgentTesla)", "value": "e6ddb5b5826ad09d4a6a13bc80876d5917c8f4e3e414e4d7c51cfcc0b6a9f4ece45a57a85190ddc961193a6f9579f56c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054252, "uuid": "0d9cca20-a86e-457d-ac1a-bfa27aa9d63c", "value": "91E4928C5D9EC1EAE5354BB842C9C4EB46EB5EF30F22C879B9C687C7E020746E506536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054252, "uuid": "a93f271e-dabe-460d-808d-d9a17a8bb1eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054252, "uuid": "31f11b1a-5323-40e7-be3b-1d7f2b55efd3", "value": "12288:/tIhUOBjKZcEsTjkCURzynjX0FMyHTFM11g:/tIhUOBjZXTFgMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617054252, "uuid": "f07a7622-5a7e-47d5-9774-66b277a66255", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617054252, "uuid": "81ad4392-6650-4201-bb63-1ccbd96f3978", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617054252, "uuid": "cec6e91b-fd6e-43f0-88c4-a72f5091d158", "value": "SecuriteInfo.com.Trojan.PackedNET.612.24091.27832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b024db41-9078-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617013359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013359, "uuid": "0e5fdc44-7751-4eca-9262-8fa7259a0280", "comment": "Malware payload (SnakeKeylogger)", "value": "1f473b4280fe7ba277ee90eabcd0ba68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013359, "uuid": "8d9b128a-220d-4819-b411-03adefb226a1", "comment": "Malware payload (SnakeKeylogger)", "value": "b763a0d835bda98a3d39f73e5b489b7178c4b753416c2c160cbcb2aa8649a8ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013359, "uuid": "779a101b-23ca-410c-913a-34583abc7f1a", "comment": "Malware payload (SnakeKeylogger)", "value": "e27fc2c9ddea0066566255c94187e4447a4fa3de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013359, "uuid": "a1803619-6182-44c3-ac2f-739dc0e04964", "comment": "Malware payload (SnakeKeylogger)", "value": "ff9ec38c4406a59b0cd176160e5779285e16da9df336ea43b5239e5f6613e798ec297988bd46e5e48479af0e37758658", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013359, "uuid": "71337d05-6181-4485-b9f0-85d367cd0bf7", "value": "2BE42385464026CFEC2FFDD9478B24C5198762C390ABD912681AFED3724F8A9DED8F01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013359, "uuid": "f1a37a31-d9de-491e-8c84-46f78e03be26", "value": "12288:2ZS8Pt/ZelFquhGrW2DfwKP4p0cs8en8zoniOCxO9Q8reRhuwSk:/etZelgrW2Dfkpre8zontjvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013359, "uuid": "f896eaa6-f4db-41f7-a818-983dd621230b", "value": 711808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013359, "uuid": "657298a5-8d7e-4db9-a20f-b51ec8747f90", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013359, "uuid": "4f758b5a-9eb2-47da-a800-9e49ef123dac", "value": "ASB swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc71079b-904e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616995448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995448, "uuid": "47af998d-0df6-4d68-952b-ebaef3bf8e9f", "comment": "Malware payload (Formbook)", "value": "e08dbdb9f115b945dc4cdcf28e2c971c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995448, "uuid": "68b8e5fe-d3a0-43bf-a199-a8fef4c60c7c", "comment": "Malware payload (Formbook)", "value": "b8ac08fbc3f523ed59bcd899685f97cd2784775702986402fc84a62f379fc552", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995448, "uuid": "d8d59f32-4148-4b97-aea8-c15f30dc9301", "comment": "Malware payload (Formbook)", "value": "ace166b03baa247009be2d45cf6d36efdd2de7d7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616995448, "uuid": "e19b4088-f984-4a7f-8613-cb296300e2a8", "comment": "Malware payload (Formbook)", "value": "7dfaf9745f3da49a98927a5ae9dc8ed1d7b148b1f855fbb9234c21ee42265b6b2fba38db782196f67e63714199f78ef9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995448, "uuid": "f54f8407-6610-4b27-afcc-01a2d8210237", "value": "314301CC6A124C477193E1A96B0B8F60A22F1F9FD94A09D0AD362F83935D6C74352ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995448, "uuid": "1dfc65bc-f987-4b32-938b-a17ea71fbdbe", "value": "1536:iCGuAJPYVeCPg9tDXUvp1q96ILvLEjhwg:z9VernDkRMcILvLEjeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616995448, "uuid": "545ff7e4-7646-4385-91cd-6a0bcbced003", "value": 57504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616995448, "uuid": "ce84ccee-3991-422e-a084-97864109707f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616995448, "uuid": "b3004201-6e7f-460e-b2d7-180c16b63dc0", "value": "BIOTECHPO960488580.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbef22e6-9096-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617026263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026263, "uuid": "5cfbfb6d-11e4-4566-9910-bb3f54e69cb2", "comment": "Malware payload (AgentTesla)", "value": "26a6cf59f185e43910e24f08abe7b599", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026263, "uuid": "b8b3e565-5717-43c6-b7b3-7c7f14560b1c", "comment": "Malware payload (AgentTesla)", "value": "b99a65694f8ede1378c3205c946e6fd46bacae2a86a822b0e5269a82607536e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026263, "uuid": "95851a0f-a237-4afd-b410-388ced50f579", "comment": "Malware payload (AgentTesla)", "value": "14c238457d10d9dc08c01580607f82ab7c2c2e46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026263, "uuid": "a98ba0f1-742e-4619-bf57-07c35d2ede58", "comment": "Malware payload (AgentTesla)", "value": "7f56c32481ab70814efe4316eb61558b7801efd517f8816db948d68cdd73b01779514e13cbb8317fbb9f66242d392345", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026263, "uuid": "8c191a85-2f2e-46a3-9c3d-dd9561466a9d", "value": "F8F4233E349C5B356008BE2BB0AF9D2046A3D1BB66B7508FFE956CF7175A3451A3084B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026263, "uuid": "3d8c73ae-b839-4d86-acf4-3360c25cb798", "value": "12288:IIaKXmuOwtscMYzxIxJJMrBhOGCaOpcjZK0lCQMI40Esr3HVuGX5IEwCm:va2jtMirxBWN0lCRInr3Oam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617026263, "uuid": "ddc6babf-6f24-4160-9ccc-b35307e75bdf", "value": 749269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617026263, "uuid": "156a683d-4532-45ed-a079-d977a121e4fb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026263, "uuid": "9cdd7c9c-cbc0-40b1-b0b0-045e82d4c5e9", "value": "Quotation Forms_FSL21-ST-D007.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f01ad7d-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "c751d137-3a5c-46ec-a11a-eafcb3dd9ee1", "comment": "Malware payload (Dridex)", "value": "7cf8eeff3f1bd2cf4a41d677e8c38e50", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "a727d20e-3dd3-4ed1-86be-0ce785e42183", "comment": "Malware payload (Dridex)", "value": "b9ae8a9dfe872b95d95e8c57155a84186b18e4a8deb0503690d5561b2a745dfb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "f6edc789-4738-4b0a-8ac2-667797ed5af9", "comment": "Malware payload (Dridex)", "value": "e6fcf5d553569225530f98c3c056320b803e854f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "fd7c29fa-1cdd-41b7-9865-f160b58629d2", "comment": "Malware payload (Dridex)", "value": "b5f9aeedd4bedbb8a76d7eadb3c778e6716891b28457b6d96b5a853f8820cda00f3d3dfacbf493f7f0b5705944081f6e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "b351c287-1c6a-421e-9022-b37e77c95a86", "value": "1F14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "8bd69c05-ff40-42d6-91b1-000171359cda", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "477cfb3a-70b9-49c1-b9d6-f9abcca49154", "value": "3072:lpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:lBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028174, "uuid": "e0a2dba9-0755-4dbb-ba9d-0523b4ed0ba9", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028174, "uuid": "3edfb152-d7ff-479d-8720-9b05510a0004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "b6d76bda-c7f5-4cc2-be8a-2c86f6aea15b", "value": "b9ae8a9dfe872b95d95e8c57155a84186b18e4a8deb0503690d5561b2a745dfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aba3741-90a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617034261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034261, "uuid": "c97269fb-11cb-41a7-82e0-780a4fffd14a", "comment": "Malware payload", "value": "018f9ebffced13783d862d6b49852d7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034261, "uuid": "d9b70ad5-32c2-4354-9993-2c9c0c4c632f", "comment": "Malware payload", "value": "bbd1eb7643e5de01499e91440b44cf4e834b877a067aec8006e2b79bfb255d28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034261, "uuid": "2ed4686c-5170-482b-b79e-0e1104b7e70b", "comment": "Malware payload", "value": "93285bf195875fd06f91f46d376472781b4ce202", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034261, "uuid": "1a20fd16-96de-4a98-8441-0d367759e403", "comment": "Malware payload", "value": "04fc5bc219fcf1cdcf5da1851a19443a1d28d7404e6db09623c6092cd84ac12e3981e53fbfea966ab19f097f5698cbc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034261, "uuid": "936b9fac-55b4-4cba-af83-9dfd790f967f", "value": "00E4334C4F79E0E6C555178679384E3E2E90D8D2820BD746740F2B692B8F3BAF576B04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034261, "uuid": "45e269ec-e2c0-4e79-97f5-1139ae225185", "value": "12288:iaToOtZUT9M0SA8eRIcxnXdghfpVn7aMpHAOgq/ZZTFn39yGdVEIuhCb:iuoIUTe0SA8eGoNcffZALqLF/VEIuhCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617034261, "uuid": "2c232e07-6adb-47b2-92bc-e42181674bc1", "value": 665126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617034261, "uuid": "b92fb151-b3c3-4f50-88e2-189b9f4df266", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034261, "uuid": "0f0c3f8d-0737-4e6f-8533-06e4ffe115da", "value": "RFQ 23ZVGC025 Zhejiang Xinxing Tools Co.,Ltd.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93999b98-9064-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617004721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004721, "uuid": "f48591e5-a890-4132-965d-496be45c81e1", "comment": "Malware payload (RedLineStealer)", "value": "fa21969e11539bb863a3dcb3dd987dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004721, "uuid": "2ecedfc2-0094-4e5c-a5f3-97ebd7fec1bf", "comment": "Malware payload (RedLineStealer)", "value": "bbf12a366bfa192a4b899db478824f887280a4b5410abbe1bdea5ce82130f9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004721, "uuid": "d23002e8-1137-4e86-bc70-d8f3fe7544bd", "comment": "Malware payload (RedLineStealer)", "value": "046a67f71372119d1b6cf85e0ae1539d10f64ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004721, "uuid": "28c56aa7-a2b7-43d6-be8b-83f3bc006c81", "comment": "Malware payload (RedLineStealer)", "value": "29d382e33b5c1a93625f4e8ba9e04e6b542fcddf7da7c4af1e37e476364704239a69a593ebe9e101b386acc819f0aea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004721, "uuid": "4961e95a-f259-4e30-b6c7-38fd7a4aba5e", "value": "1CA40100B6F2C033E5568DB54438D3654A76FCA25B346ACB7BE47B2AAE313D14B76342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004721, "uuid": "a26b7d7d-0599-4127-9308-3d44935ee616", "value": "913f22d493f938d4ad754ef3464de5b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004721, "uuid": "5ad95c90-d03f-41c8-b90c-374c778b7408", "value": "12288:9iSfx5LFcse1noXDL4XGySMseMidOt5QH:9VG1l8Ms5pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004721, "uuid": "82a44d38-2ce4-4e58-84ee-9adc3aa1c2aa", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004721, "uuid": "bf98284d-6ec9-4b83-bb07-1fd2a2b4d505", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004721, "uuid": "e3a7fd81-0985-440a-acfb-33ba14ab6404", "value": "fa21969e11539bb863a3dcb3dd987dbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34716227-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616999837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999837, "uuid": "1ef33a97-3ba1-42a5-b0af-a2db65e3d717", "comment": "Malware payload", "value": "db67eb7666414210dc38c0ad0bd05646", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999837, "uuid": "3453c655-8ec1-4f10-ba94-59bdab82a0a3", "comment": "Malware payload", "value": "bc5c651f4398af0046ce1b73c03cd9190823383fe7e4b00bad976f42575e3ac3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999837, "uuid": "2f6d706b-7f34-499f-8b97-979c18d16e1b", "comment": "Malware payload", "value": "d4fb9808a4d3972ea3cb1beb518ebbf5ce4b77a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999837, "uuid": "c3e18ae8-08e1-4bf0-b621-f177db57dc86", "comment": "Malware payload", "value": "b849c8a2c76bf17b974bf6420868221ef94ab8642500e7e453f8d63f2503fbacd90025fd59aed07f32e36819131b0386", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999837, "uuid": "93555e6f-8358-4531-889b-01a84abecf94", "value": "51A4231A61E47D194A57128C1D4BC29E36F4244CFE3CF718E4A61AB07E86EE8D0369FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999837, "uuid": "29886921-3ac4-47d4-b96f-26571e3526a0", "value": "12288:c54nZc4S+ob9QecY5XHvimXFAAti/OtJxniiL9pj:G4ZcNrrcgXv/GAc/OtJxJ9pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999837, "uuid": "e5429883-11ca-4c77-b67b-18d5e74a0a68", "value": 465438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999837, "uuid": "7419f6a7-fae9-4584-948a-a4b8183e2f6c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999837, "uuid": "ed73ac2a-55f1-488e-abb7-6e74d5b8fa41", "value": "Bank Details...rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feed8780-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028523, "uuid": "bef56a4c-b482-460b-af8d-a45ad0d214ae", "comment": "Malware payload (Dridex)", "value": "fb48e1709c51d6558af6cf44d52570cb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028523, "uuid": "3159e5b3-c082-4871-afe3-0c6e4d3a63e8", "comment": "Malware payload (Dridex)", "value": "bc78e698a5a38a457fc44017c250744e74dfea94510d7b00548272d02454d18e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028523, "uuid": "bf945fc2-dd14-47a4-b5d3-5e5c1e7dec7f", "comment": "Malware payload (Dridex)", "value": "c6c517e9c3d2cbac559804d85c4055aa966b3653", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028523, "uuid": "4a48d4d7-dc85-4480-aace-0ecef7fbb549", "comment": "Malware payload (Dridex)", "value": "b7b23faab362cf466cf5d4274f2bdfb6bec5d967aeba05bc11e622816abc0eabdffac0cf11de0625f228d643f3f3bcb6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028523, "uuid": "e1099e8e-0afa-4eae-a030-45272ac91d86", "value": "FC14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028523, "uuid": "f2eaf303-7ed8-4e5d-9931-69b497dec9b0", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028523, "uuid": "3fe946c3-6fff-4964-b094-f5bb3811bbab", "value": "3072:fpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:fBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028523, "uuid": "5191b509-4133-4240-bc37-2bb89122a02a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028523, "uuid": "b16dfdbb-b0b4-464f-b7ab-f32a89d03e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028523, "uuid": "fd35af53-b1b6-495f-b872-c3c49fbe3227", "value": "bc78e698a5a38a457fc44017c250744e74dfea94510d7b00548272d02454d18e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47b17ab-905b-11eb-abe1-42010a9c0039", "comment": "Malware payload (ModiRAT)", "timestamp": 1617000910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000910, "uuid": "2bcba583-e668-4705-8d83-f12258bec622", "comment": "Malware payload (ModiRAT)", "value": "8c53a75ccf25e9c6513f8c3a78882ab3", "object_relation": "md5", "Tag": [ { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000910, "uuid": "c90782cf-1b73-4e24-bee1-4385cbe0e73e", "comment": "Malware payload (ModiRAT)", "value": "bce2fd585cce258c683850488ed36e99fabd2e11b10c3828a36fe6517842758e", "object_relation": "sha256", "Tag": [ { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000910, "uuid": "1a44589a-d856-40ee-adf6-112ba9e09cd6", "comment": "Malware payload (ModiRAT)", "value": "5e089923b58e962890829df43ccdc6c7cf5fe4c5", "object_relation": "sha1", "Tag": [ { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617000910, "uuid": "933dd631-f612-47a3-afbf-5e9b510d8893", "comment": "Malware payload (ModiRAT)", "value": "9df1498127e42294922bd8aafa87063e227e42b425d8b0d1942562de11b4b3282d1c4f6a49b81f5759438a50d2919331", "object_relation": "sha3-384", "Tag": [ { "name": "modi", "colour": "#431C1E", "exportable": true, "hide_tag": false }, { "name": "ModiRAT", "colour": "#89F0A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000910, "uuid": "fb41b8b7-3baf-4b37-b27f-5e1fd59d4f93", "value": "8293125FF1E9EA9597E71E85C39045B8F3B20A622C427821B4B75D800DEC23E737B498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000910, "uuid": "f2e554ce-2e35-43da-90a4-6887ed8f0f13", "value": "1536:mc7IizGb1X3O3owZ8jHaSrLbCUBG8fwuib5FuRLFDGynfnuDHwJK2ApknU57L:mGpC3vTj6AakG8ohb5aoH8YknUxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617000910, "uuid": "95c88bc7-7289-4dda-87f9-1ec664791090", "value": 93922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617000910, "uuid": "f3586f02-0679-4b2b-882d-0c640a28bab3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617000910, "uuid": "68663d16-c376-4258-a949-cebb79840650", "value": "478478741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b328ea1b-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040422, "uuid": "f3499a6a-ba33-4e8b-9c60-5e17722cc785", "comment": "Malware payload (Dridex)", "value": "8eaab64710181e71210c7cc5257317dc", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040422, "uuid": "f9865008-b9aa-4243-a6c1-bff1d4767db6", "comment": "Malware payload (Dridex)", "value": "bdc85b3576de3abd5a198815d0ca2a1908ab50032d4d56b41e3c91b961aa181e", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040422, "uuid": "9a9a9867-2a7b-4f6b-a9b3-d3f4b4ab6fa9", "comment": "Malware payload (Dridex)", "value": "5fc9c9ead1b6413660926b7bd0ac0f8dd458f049", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040422, "uuid": "16b16945-e51f-486c-b576-60974ca446da", "comment": "Malware payload (Dridex)", "value": "934173908d0401801a0b3906d896384e9ef5e68190df52551b3ba96f94ab3311454286b378332aa2b072849725d78d57", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040422, "uuid": "715aaa3f-4167-468d-8866-f0421ae90df2", "value": "26C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040422, "uuid": "015366e1-2967-4420-87ea-4b2528b95aaa", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040422, "uuid": "96d9a34e-a826-4732-b06c-6ba9a78fb07c", "value": "12288:gt+D1yz/1SXpqDaoWmVsFhHk3eBWIc2d:gcA1aLoB2AeBjc2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040422, "uuid": "f3342bfa-b514-4eaa-94d2-95d34204f0b1", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040422, "uuid": "eac2487b-efce-4242-a5e8-cfe2424e90e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040422, "uuid": "0508298a-f67b-4904-8cc6-404969c66a9a", "value": "bdc85b3576de3abd5a198815d0ca2a1908ab50032d4d56b41e3c91b961aa181e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170dfcdc-908d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617022121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022121, "uuid": "47f2d221-6457-4750-9531-9d82c2d14b01", "comment": "Malware payload (AgentTesla)", "value": "2558f411eaf52d4249b118d7fec31907", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022121, "uuid": "2a10b730-6acd-49ea-b462-c68973742eb3", "comment": "Malware payload (AgentTesla)", "value": "be225326c91ff9cbd57556b8a14107a403cccdb34ef82c3cd5d8857c184b6e53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022121, "uuid": "c9974a14-ed38-4109-aaeb-f0944dc37737", "comment": "Malware payload (AgentTesla)", "value": "aa7abd70307ebe0a173017aecb216ce786337803", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617022121, "uuid": "1ae9742f-c62a-45ed-8d39-4074e59822f0", "comment": "Malware payload (AgentTesla)", "value": "27aab1728d2ea7e92e16720c76347e8f0fa647817442f04858997dc402429c30e1bb8ca17d44ea0f003193ac6028311d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022121, "uuid": "77333be7-4c04-42e7-b4e6-bbd97c31a148", "value": "39C423BA354353FA07370AA73170EA7303AFA0DAB99933D19806D1EDE8F681F9015795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022121, "uuid": "7d1e4b00-67eb-447e-970b-310254a6de97", "value": "12288:qwnLovUoL+0xgvd2/Ks0NHP6CIcMm7YdLp8QElYW1UsvQu:qCNoKdvBHCCI8MdLp8QkYYUsvQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617022121, "uuid": "93f3fe13-243c-49f0-8820-1bf072e9ffde", "value": 588908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617022121, "uuid": "183e8109-7a07-4233-a0f0-3e2b361a7cc9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617022121, "uuid": "d40b5436-6055-418e-aa28-8b767b184f1a", "value": "Requested details for your consideration.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b13e6c8-9074-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1617011525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011525, "uuid": "10ec3a14-58b2-4fa0-b7f5-a8a3f18008d8", "comment": "Malware payload (Pony)", "value": "380fa933b566935842edfe9d7884d29f", "object_relation": "md5", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011525, "uuid": "49135454-73f9-47a3-b92c-c90c839c4234", "comment": "Malware payload (Pony)", "value": "be7608642ceb319cd38ceb6d897c692af884f7b417d465231839bbccd68bf5ce", "object_relation": "sha256", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011525, "uuid": "0084e8ff-29b4-4131-b8b3-fe19fd1d6d49", "comment": "Malware payload (Pony)", "value": "6a6229990ba175160002f56bee3ccfa8824694f5", "object_relation": "sha1", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011525, "uuid": "459a7dff-880f-4502-bfc5-2fad8e0e118a", "comment": "Malware payload (Pony)", "value": "49a8d01cf5bee1064e0262284c3600572300ccafa43db1a9a5e5c0824c512a41e71140377063a3e82e1d85ee81cd491d", "object_relation": "sha3-384", "Tag": [ { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011525, "uuid": "c4fb8adb-0677-475e-bd55-afd5fa430166", "value": "A9D423E729EB11CA381205E55E1DF4217EB18AF7C52DE69612D079E3E2C636F24707C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011525, "uuid": "895392c1-a23c-4e90-a367-4ad371fffffa", "value": "12288:cqRRvDoWKfW/bGK9uk9oeG1vdm74dmE15Ouy1kbhI:FvDrKfW/bH9uoP0vdmkdp2uekK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011525, "uuid": "9fa7d53d-183e-4c0d-bc00-15efc0e718a3", "value": 604095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011525, "uuid": "56216b57-4495-412f-96fd-0bfd0fdaedb2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011525, "uuid": "00260ca8-dd80-43fd-a257-6c1de428b3a1", "value": "Original-24-03-2021.pif.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04614346-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031539, "uuid": "559924e6-ae4c-4410-8899-852e88215358", "comment": "Malware payload (IcedID)", "value": "50de9e35338a5c3bd33d462bfef8ae3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031539, "uuid": "e6fc859e-ab38-4447-aba5-2503986ba3ae", "comment": "Malware payload (IcedID)", "value": "bef7d4ef86cd6e13c9af1c199000378152520079ea6a66cef0a4d0a2a9bb9ac1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031539, "uuid": "aeaf7f2a-fcd2-474e-9157-050a37a3e171", "comment": "Malware payload (IcedID)", "value": "69270dd859e6aa729ae15d670429c1af5af857d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031539, "uuid": "e6068d21-b049-4489-a365-d417aa3c35ed", "comment": "Malware payload (IcedID)", "value": "87bc70d972ecd021b0ebbd4b042c6c0c49f07bb3ddb7aab3a8ac9fed1a68660d58659a4cee89165f5baf1472ac2cd07b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031539, "uuid": "b9df49e6-1176-4834-b7a1-1494caa1c04e", "value": "B9133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031539, "uuid": "cf069ffa-f006-4230-9529-a6fec1a0fad7", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtBJxEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBysc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031539, "uuid": "6dc3e4bb-2bbc-4032-a008-0da23970469e", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031539, "uuid": "1b6654b3-f64b-4079-b031-d1c27a49da4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031539, "uuid": "55cf4aa4-234b-40c3-a4bd-4e5ea0a784a5", "value": "bef7d4ef86cd6e13c9af1c199000378152520079ea6a6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a685d015-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028375, "uuid": "05a0ba6f-44be-4d12-8831-26264141f065", "comment": "Malware payload (Dridex)", "value": "c7205bf62ca41c0723ff736d0936e890", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028375, "uuid": "d74ed746-1c60-45d3-ae04-701440f5cadf", "comment": "Malware payload (Dridex)", "value": "bfd897a4fd01a839c1e9d6e0cd2ca49c3c5a5b9f8f24e7897205fc51c80a76a2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028375, "uuid": "47f92afb-a12c-42d7-9b4e-bbf0a42ddce1", "comment": "Malware payload (Dridex)", "value": "370e6017de5726807ca70906ad3ff572decc434a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028375, "uuid": "11b2da78-cc5a-445e-b2a8-722dac4f826f", "comment": "Malware payload (Dridex)", "value": "395debe00f782a9f885ecafb61bef817954e8020508014a7373075fff24d9f90cbf6c4cf5cbe0b71c88504534a36fed6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028375, "uuid": "c5f66e91-91fc-4beb-b55a-d9842f1f6e4e", "value": "A414AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028375, "uuid": "283ebaca-6329-42d8-95e1-baefaf3c36d1", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028375, "uuid": "47eff8ca-d608-4042-bcd2-3b1b33c7339a", "value": "3072:mpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:mBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028375, "uuid": "70a44203-c8d1-4580-9bfc-e43e7542c78c", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028375, "uuid": "1a6ef503-7579-41bc-a8ea-50f28f19d470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028375, "uuid": "709f2523-83ec-46ef-9d85-cfe352e9f6c8", "value": "bfd897a4fd01a839c1e9d6e0cd2ca49c3c5a5b9f8f24e7897205fc51c80a76a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e163ea8-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617028253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028253, "uuid": "f9502230-cfaa-4db3-a5f2-cc166ac01df4", "comment": "Malware payload (IcedID)", "value": "0d701c4ce2778b4e5bb133d6390892ed", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028253, "uuid": "28e3da59-d7fb-4867-8116-9dc2d5f11d4e", "comment": "Malware payload (IcedID)", "value": "c0ba26cc7f6fe07bc9fda60e9819c118e073b02d0a9f1710f08729cc47029028", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028253, "uuid": "763cb9d3-b805-4bc1-86c7-327d72073d29", "comment": "Malware payload (IcedID)", "value": "93c062b8c80fce086241e121acb4878660fd3eba", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028253, "uuid": "55eb91d0-7058-4399-a760-5755834c14e3", "comment": "Malware payload (IcedID)", "value": "226f20e5f2e81b5646f525be80b5283effa27d9c324da84f896752479c52cc6ea16aa4cf7a7e92c7fa728bd406ec4707", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028253, "uuid": "7a4788f3-f9a6-4b64-a3c0-d26eeab2dae8", "value": "EDB3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028253, "uuid": "ef3a2728-a4c7-4c5d-9109-dc40fb6ba9ec", "value": "3072:e26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:eLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028253, "uuid": "07a86292-2459-4a36-8a61-4103e5644ef5", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028253, "uuid": "f1cb57a9-0b42-47b1-9775-8af41088c7d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028253, "uuid": "1cc2ef5a-c177-4d03-8a6c-39194d125dba", "value": "document-1223674862.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9fa9ee-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617002535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002535, "uuid": "576d6874-a96a-4339-ab04-990db18939e4", "comment": "Malware payload (RaccoonStealer)", "value": "a5dd5e6cf582a26390aa2ecc3a1eab04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002535, "uuid": "6aebcd5d-a21d-4c49-a708-eab70d357e72", "comment": "Malware payload (RaccoonStealer)", "value": "c0edfdbe050d2a12219c743a92d027535003cf164723b70b64962a39e9104c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002535, "uuid": "6f54986f-a429-4034-b2e1-0beceb514f43", "comment": "Malware payload (RaccoonStealer)", "value": "d44190fd21f102eb82b5b96e3f3efc7f39b9112b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002535, "uuid": "887019ce-6edb-49e8-aeea-4175b903673f", "comment": "Malware payload (RaccoonStealer)", "value": "2d7e4e8f496a9945d79a8f44e248393187d74819b605896bfb3af8967e23583a055dee085b424713aaf1d42d9b78a9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002535, "uuid": "94338438-c233-4e00-999b-61c1442b648a", "value": "87A4F101B5F1D033D1A79AB54476C6A14A32FCA1AB255AC7B7807F3D6E352E28B32743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002535, "uuid": "f6894450-edc4-4413-a334-b113b8e4b6dc", "value": "913f22d493f938d4ad754ef3464de5b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002535, "uuid": "fc3368d1-2e9f-4bc9-b746-0f42798d8c91", "value": "6144:nDSed47vLFSui/oF5BDz/Wj7Okd/1NHZQBGObwqRVh+m657Wa4WHkKL:me2T0zmzDz/u6kd/fObwqTYZ70WH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002535, "uuid": "d5b0e24d-aafa-4f8e-a499-d84d15510883", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002535, "uuid": "756c994c-d3fb-4332-8efb-b9ac436bf9bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002535, "uuid": "6d78bab3-49de-4540-909d-01b81ce37156", "value": "a5dd5e6cf582a26390aa2ecc3a1eab04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffc9b3d-909e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617029599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029599, "uuid": "35768330-7989-4500-9ca3-0ddd906228ba", "comment": "Malware payload (Dridex)", "value": "60780a4131a6b27bee7222b6df0f28f2", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029599, "uuid": "c54270d6-ebc3-4c97-90c5-0177d6306183", "comment": "Malware payload (Dridex)", "value": "c1268a31d493396c49010ef7c406f47399b68d2a1eb8c6f587d2aed277d27afd", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029599, "uuid": "a39eb831-ea2d-4bc5-a96e-b15e5dd9f015", "comment": "Malware payload (Dridex)", "value": "fe5abfdec31203c784496233231084e7aa680a92", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029599, "uuid": "bfe013d3-309c-4f03-b517-f114183a920b", "comment": "Malware payload (Dridex)", "value": "562264a5adca93ada49d8702d72e5bc68cd060d2623be0f08950e9ba3c9f36fd8475a0e42dd42f7c9c206346a3fb220a", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029599, "uuid": "fb5c9d5b-fb92-4b95-a90f-a8e9e2043188", "value": "3D84D01367E15031E6321F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029599, "uuid": "fa0a3a38-d8da-49f8-a60f-4b8fa3152093", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029599, "uuid": "cc09ea4a-becc-44be-822e-b8e2af974bfb", "value": "6144:dbazNBbycfmKsyUlVSMdUFIk1KyHNwoAMpFp5xMSC1h:QzeTlVS/7HNXp5WSUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029599, "uuid": "d5a75542-688f-44dd-8ffa-4c03218fcefd", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029599, "uuid": "cf3eb92e-bad0-4bc5-acc7-8ed8da929125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029599, "uuid": "a6844b4c-c011-4909-9202-41b97921cc83", "value": "c1268a31d493396c49010ef7c406f47399b68d2a1eb8c6f587d2aed277d27afd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e465e3-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617027971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027971, "uuid": "c2fe13bb-e69d-476b-badd-b9164b99b9e0", "comment": "Malware payload (AgentTesla)", "value": "7a61be4dc7b2bbafda056a0806aeda03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027971, "uuid": "c9f509a2-28b2-4583-8245-3a8ed2ba91d0", "comment": "Malware payload (AgentTesla)", "value": "c1722e6b2d5e5c692d4326676e50e0eeb90d1e7d4f02db8082541003f9c6b0cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027971, "uuid": "57dda80e-2d3d-4977-8778-5cf2ad82a338", "comment": "Malware payload (AgentTesla)", "value": "506146eb64fe5b222a379886ad7fa29d7773b3dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027971, "uuid": "23cea1ba-cfec-473f-a559-6769b117f9fe", "comment": "Malware payload (AgentTesla)", "value": "0c68000c2eec3bdfc2b3b621914fb85c88269a71e632da3e4581f0079d134428abc47c2f5a350d5ef23c8612811f648e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027971, "uuid": "098984a5-7708-461e-acde-7268c1eea7c6", "value": "99E433F6E8A83CA3F464331E54145C71DF5A26B8C53B645BC18A7BE21C391AE205EDCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027971, "uuid": "7b126067-2cae-43d6-8fa8-ea7132ccb537", "value": "12288:E4vx9CitBcVWnvDejyui0NAcXMq05j8K/D8z7uMA6Z4iy1wZgFEBpFi:foVWJuiwA1q05IK/DK7uMciyCdvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027971, "uuid": "d4fbc1a5-4bb9-4971-9d23-e1338e00c943", "value": 686356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027971, "uuid": "8ad8bc7b-fef4-4579-bbc8-c89506b32efe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027971, "uuid": "4c3222cf-e645-4cdc-a0cc-69ab03f71def", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2dcbc6-9061-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617003210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003210, "uuid": "cfef267d-0083-46e9-ba7d-a0dbfe244356", "comment": "Malware payload", "value": "a981497f464211b042be5f5bcc3e9035", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003210, "uuid": "de6b56b5-af9f-4b4d-a460-d238dcad58b8", "comment": "Malware payload", "value": "c1a765a5127a597279b922293a2e829783c30b6de2915326ebf75f7e39b1b700", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003210, "uuid": "bc52f984-3115-41dc-9a3b-bc6edf066b22", "comment": "Malware payload", "value": "8728bb22f20966c8b8b425395f831d7acc13b011", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617003210, "uuid": "1b45f089-ecc2-4d1d-baa9-13e2f42a794f", "comment": "Malware payload", "value": "549c9d30f0b0ecd19bf52fc8e8cac8a02f373906c21a59f5fb345fa2bbd9f97b97b31c476434c8873d4a149e587c26f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003210, "uuid": "1816d88a-bfb8-4140-8a10-dfd033668bdd", "value": "D6F2017F88427575DDA407221E81EAE6B0066DCBCA0613C32DA44170B0EBF875DFAB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003210, "uuid": "e0218641-a7b3-4f75-abd9-0196cf4a2ac7", "value": "768:LC4W9oYAt9J9Bz8Y/5vKis+qqWOtlUjWc+5+Pxlu3Mk5:LioZXRz8UpKFWcFPxlucg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617003210, "uuid": "07242656-eef5-4079-9b5a-7ee44d0e3b08", "value": 35521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617003210, "uuid": "95c56b08-f81e-48a8-b753-f15286ae3251", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617003210, "uuid": "f5dcb4f2-b675-4b1c-90a7-128449c86a3a", "value": "VN#75775 Purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74f8fac-908a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617021128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021128, "uuid": "bd4defc8-1926-4264-9e49-4dd9177e1e83", "comment": "Malware payload (AgentTesla)", "value": "575bb25a2e5b199211c630de55b62d96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021128, "uuid": "16c88a83-8684-4e73-a005-324a8d28e527", "comment": "Malware payload (AgentTesla)", "value": "c1b6fd64ba4d764b095c0e08a5695ed43c350551b0a94116b39f4a050ab15fbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021128, "uuid": "9ef6bd19-afae-4e6b-a001-8e5b25aa8139", "comment": "Malware payload (AgentTesla)", "value": "40fab7d492f373fc1aae464e5eda321cd26eb457", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617021128, "uuid": "6c30a872-555c-4e07-b238-10314957efab", "comment": "Malware payload (AgentTesla)", "value": "f3c154d95079f91bbc2d463e65ea77a25d3d020fbdcf3c3861ed1cbbb5d4e99ac6df2b1a0d43fdb2ebf8e3d458dabb78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021128, "uuid": "4c7aacc0-ff26-41f9-b9c0-ec2f51c9bdf9", "value": "8905014176A7BAA8E0398B36F466C1930FE17D0EC287D937F995B18E08761709A7D132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021128, "uuid": "133aace0-b042-4ded-82a6-d8fd1309e97f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021128, "uuid": "f0b63817-f6f3-49e1-8219-642a618feba7", "value": "24576:7cyGYl0QEjF0QJ4AAStXZIRDLDH3Bu/dfGjY58g0voBf/Tk:7ctYOQ4/tJIH3MMC8gyoBf/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617021128, "uuid": "da9b88e7-de26-4bde-81c0-2c2d3f3b51bb", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617021128, "uuid": "b6bcd2f7-dbbb-4bef-96de-1db697a4a832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617021128, "uuid": "0b5815d8-da01-4eb8-978b-66494e810817", "value": "payment TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc0b25e-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028172, "uuid": "8a8a5b40-5b88-45fa-8c7d-747958755c5d", "comment": "Malware payload (Dridex)", "value": "f246989212e884eef311f2ea55529d6c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028172, "uuid": "eaadeb02-311c-4fb8-b9d6-6f01d406c719", "comment": "Malware payload (Dridex)", "value": "c1dcc9f0fce20d54729bed45e3ff6e8cae544fe6d30b04b6256fcd86fbaeeb2d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028172, "uuid": "86e44ac3-4a56-4b28-a260-1e9a5bd85ac7", "comment": "Malware payload (Dridex)", "value": "dd847e3d73038eb09f13f0f38d2cb1aaa8c4ba9f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028172, "uuid": "7fc668bb-ea6c-4cc2-8e04-d748ba9f140f", "comment": "Malware payload (Dridex)", "value": "cab7bee21dfe8e80ed12bb4b685cc4ffac47090c591f90d81e2208dac366c8ca2819380d8f909c7ea817fe74c474340b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028172, "uuid": "d21f363c-8ed9-4958-8aea-b348a1c1fe42", "value": "4A14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028172, "uuid": "9c311cc3-87d0-48d9-a962-54e79647dcdd", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028172, "uuid": "58d8e1ac-ed9f-411c-ad32-79246a15cf86", "value": "3072:gpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:gBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028172, "uuid": "f076861e-5e99-47a5-999a-d61627108dea", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028172, "uuid": "8a608a1d-7f3f-4cca-85a1-0039432ec3bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028172, "uuid": "fe41d71d-4b5f-4d00-8a67-ad159fc1de06", "value": "c1dcc9f0fce20d54729bed45e3ff6e8cae544fe6d30b04b6256fcd86fbaeeb2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2605f13b-90a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617032454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032454, "uuid": "6539a90c-c4c0-4a7c-9818-e0d986ebc0c6", "comment": "Malware payload (IcedID)", "value": "42d4337a1f270007cd2ade4ab5195ab9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032454, "uuid": "a56f89c4-8023-4304-8c92-80bc867247bf", "comment": "Malware payload (IcedID)", "value": "c34abd5384784f29b34e8fc5050fa25a12e869af96ad3535fce355e7a49634e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032454, "uuid": "41253f66-3629-4fe8-baff-d9d18c78a525", "comment": "Malware payload (IcedID)", "value": "b641478da130a68b471900cd43f8b4b2aeaac3cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032454, "uuid": "e1738bed-8e66-4edc-a84f-85df7e793473", "comment": "Malware payload (IcedID)", "value": "aab04f897dacd1f9c3bdfc4ce7a32f1b181e649e43170221adc3aaa87cfb21157b6ae720fdc836d5c2100403245da465", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032454, "uuid": "5b556b82-56c2-410b-b7ea-e5f9ca88dc2c", "value": "76133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032454, "uuid": "38c4d3d9-48c9-404c-9231-dca575efef19", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtBixEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBpsc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032454, "uuid": "74956e59-5ede-4387-be29-f09025c1722d", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032454, "uuid": "dfc85b8a-b40c-4cb4-a8fc-dc2b70a9b6cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032454, "uuid": "2b62473a-b626-44c3-9664-6e76725bada6", "value": "c34abd5384784f29b34e8fc5050fa25a12e869af96ad3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48e3a9b-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001770, "uuid": "c3b7e140-d4e6-49df-8d5a-0ce64d6fcf84", "comment": "Malware payload", "value": "d138efdda74566b44188fb7187ca54fc", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001770, "uuid": "f6f95569-afa9-4b9d-9a25-1b388e669471", "comment": "Malware payload", "value": "c366a12ebce6fac89542bd70335a3ad9b0c44692946c6d173234a7840f846812", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001770, "uuid": "f949dcbb-9728-4e02-9cef-79c314c00338", "comment": "Malware payload", "value": "7d41613f8d740725969f4e22af8fd87eeea89f6c", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001770, "uuid": "7910dd06-a3ed-453d-b333-90eba2adae60", "comment": "Malware payload", "value": "3bd16654cabe37c6e7b88f45a6577c004538ae6776234eae9d4d6f2e40b62bc0aa0b3770d0afb38b93a1710298e2dda3", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001770, "uuid": "2f76b865-0b02-497d-94e4-435da5d64920", "value": "69758D2AB1B24CB6F36A5E3658164160673EFD843E28ACD635D6FA3E0BF514335361C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001770, "uuid": "576fc6a7-6bec-4788-aa6a-668a89e6efee", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001770, "uuid": "3999592d-c3f8-4bbb-86df-bda901a7be04", "value": "24576:PIZg+uitrPO37fzH4A6haDzcUZEIdT9TagtzCNjyxIQBrNDV3iWVv5OmvB0KB6Mc:PgFrPO37fzH4A6hanqNmZBVVySOmvAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001770, "uuid": "09ed97c6-fe06-4ec3-b5cf-d2881f1c77f7", "value": 1646816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001770, "uuid": "2ae9acd3-19d6-46fd-aa90-0cb4d70c4270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001770, "uuid": "6bdec391-9755-4aac-bc36-f7ddf0600472", "value": "c366a12ebce6fac89542bd70335a3ad9b0c44692946c6d173234a7840f846812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83653a61-90a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617033040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033040, "uuid": "4f8ad27f-9103-48bf-b81a-d6edfcaa946c", "comment": "Malware payload (IcedID)", "value": "3d6031fab82ef5b46ecba35a9c31c3b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033040, "uuid": "c2d24d30-e364-4a9a-9fe2-b655dce34399", "comment": "Malware payload (IcedID)", "value": "c412e120228133d324e07ddb1e2d9d49f320d18adbf25205541808850fc44466", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033040, "uuid": "ccb77bc1-3aac-4206-88bf-84cbb03c2c0b", "comment": "Malware payload (IcedID)", "value": "9c0f4a441cfc0de87ba67171fb3b861cdf37d1e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033040, "uuid": "eac97cbd-b13d-418f-a049-3d80ae13796b", "comment": "Malware payload (IcedID)", "value": "fa4f06c9e86044c485592e71f2d854b0189cab8788349875cd63c1c00c1509e1f83627d713b55cfa77ea6f47cdaec55a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033040, "uuid": "cca8f730-5ae5-4ecb-b3f6-adadf3fb2989", "value": "29133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033040, "uuid": "6addacb6-fe10-4f1e-a659-a0b7d548f69f", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtByxEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtB5sc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033040, "uuid": "79526f4e-e1c1-47f6-bfea-b6c5a11d1af7", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033040, "uuid": "67d01faf-111f-4df9-85aa-02afff82a528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033040, "uuid": "b6c9a95e-e0f0-46f1-9cfc-7e7625a82aae", "value": "c412e120228133d324e07ddb1e2d9d49f320d18adbf25.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cf3bd3-9045-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616991489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991489, "uuid": "8847637e-bf6e-4b1c-82fe-46a86fa9c9b9", "comment": "Malware payload (Dridex)", "value": "247a929f82a68c993650dfb67da37f12", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991489, "uuid": "ea332aca-d12b-4f39-8d8f-a37868ebcdd3", "comment": "Malware payload (Dridex)", "value": "c5a5abea6b425407c62ca7605ecfbf9ded190f85e518273fb5c055ba035fbf9d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991489, "uuid": "b897c4fc-127c-46d1-a942-4595c6ccb238", "comment": "Malware payload (Dridex)", "value": "0dab06678cb7f73469e5248fa8cebb745a12010c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616991489, "uuid": "f9970bc4-ccf4-441f-b5b5-c10d7bfe198c", "comment": "Malware payload (Dridex)", "value": "f5c19e91cb0ef3eacb1ecf5535acef6854a71d4616e171733f36ad0b600300f2c64ea37cd755fd5eb431f73023b5a1e0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991489, "uuid": "0c998297-d622-45f3-a853-272b51fca361", "value": "1A14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991489, "uuid": "b73a2e90-664d-46c7-ac35-615b92ab6f57", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991489, "uuid": "e6c1e72e-d330-4e34-9eb6-6dba6f5cc9ac", "value": "3072:r1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:pi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616991489, "uuid": "2b376ac5-2a91-48dc-8282-f78f791275ac", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616991489, "uuid": "2d34a9b6-e0e7-4cd1-a9ec-91aa3f1dfec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616991489, "uuid": "5749c50a-58da-42fd-93eb-d541edc4e5aa", "value": "c5a5abea6b425407c62ca7605ecfbf9ded190f85e518273fb5c055ba035fbf9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5875800-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616998362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998362, "uuid": "980c8308-4cc9-4611-9299-0648a482763e", "comment": "Malware payload (AgentTesla)", "value": "26244a209c0f9372dd1b9cb99c5c42c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998362, "uuid": "e9e25a45-5516-4e23-a457-3984e0e90e40", "comment": "Malware payload (AgentTesla)", "value": "c604aca88130354a1cf9209f45898fc867ea3f178d36de173a36db383eb5e42e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998362, "uuid": "b7a92fdf-6580-4ed1-8439-5e7397b51f7c", "comment": "Malware payload (AgentTesla)", "value": "ebe41241a7d73c2cfaf13f38312a536de811a947", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998362, "uuid": "ec63080b-e391-49a7-9c7a-1ffe700f165c", "comment": "Malware payload (AgentTesla)", "value": "a58c45fff017a355116a4693df58b679b77724a5c4de92729b82d1c93f6e16556a44e48e8c3006688b8b026857170ace", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998362, "uuid": "2cae924f-d5ac-4dfc-9903-9c92bdc922dd", "value": "3135BDA0E8C495F1F5143AB51D3173710A6DEEEA14138E4D3E09B699247AACD0CF7E4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998362, "uuid": "eb097ef0-1faa-468e-8358-a2ed3a176702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998362, "uuid": "d975e247-a55c-46ca-9008-dd48bbed908f", "value": "24576:HGndJ2Waxr+F2Wt8h7UyrOgqvO8BdT+x4t:gdJNTtc4yr3UdT+x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998362, "uuid": "2154b33a-605f-41d6-a49b-2603299d6087", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998362, "uuid": "33f39210-5dcd-4e88-9735-7144a46e4f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998362, "uuid": "ece2d22b-ce7a-4bd2-8f0b-0848d771b994", "value": "PJT002102002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c1c722-90ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617035668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035668, "uuid": "9e148cbc-6e29-4edf-a69c-6b87715c6eaf", "comment": "Malware payload (TrickBot)", "value": "72fc8df018fdbe5b04841e8533c40aec", "object_relation": "md5", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035668, "uuid": "45296321-5598-403a-b3d6-bd08c20bdbf2", "comment": "Malware payload (TrickBot)", "value": "c68b9d14350eeba75860fdf9fc375e4fe4126eefc9bb79d717c32d026ac7b6bb", "object_relation": "sha256", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035668, "uuid": "3e593e26-1fbb-4694-87f8-27415613540b", "comment": "Malware payload (TrickBot)", "value": "ea352b00e793559fe1f87dd4731140d8f70b8a4b", "object_relation": "sha1", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617035668, "uuid": "4e9f2ea9-86a7-4a8f-837a-63afa1f63367", "comment": "Malware payload (TrickBot)", "value": "801b128f0b82edda192ce8cba435321e58b715d9490bdb9082f80553e1c485769fc214ac31f16915bb4cfe8587a0f8e7", "object_relation": "sha3-384", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035668, "uuid": "167bca7b-ce68-4011-9072-463c64b133af", "value": "DAA412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035668, "uuid": "6b868b49-234b-43e2-bdbf-04e29f68c37c", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7R:dEKXJ0MDs8QTjVJVf4k4ZiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617035668, "uuid": "a2f8fa36-d39a-4732-9cf2-6f2214afc55c", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617035668, "uuid": "c6ed1487-2dbc-4278-9ea5-b031ffa242a3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617035668, "uuid": "87242c0f-6ca0-41fe-bb7a-e6fe6966f1ae", "value": "inv_12669540_968748534.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329f9540-909f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617029898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029898, "uuid": "179bf02b-385f-4dfe-8712-6f51257c4b56", "comment": "Malware payload (AgentTesla)", "value": "be5e35cd2e50566e39d0397bf4eeda97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029898, "uuid": "927d2a0d-2ae7-4d31-8d9d-fac31d7b5dbf", "comment": "Malware payload (AgentTesla)", "value": "c703b75f206d7dffe2129c5e2f00cc2c688c7ebd38632340c322ecf55b6bb398", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029898, "uuid": "b4f41a96-4ade-4e8b-afb2-40afb946a8fe", "comment": "Malware payload (AgentTesla)", "value": "adef205150f14b5396a3a58c26a49fc2527b221e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617029898, "uuid": "ecb0a500-72d4-403b-af65-ded0be88d463", "comment": "Malware payload (AgentTesla)", "value": "c3920aa9ad80911b1c88c9dbf96d4c0d04b8d651ff904df5b3460c1dda89940cef3e3614255c39ec84138e188ed6de6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029898, "uuid": "749e8218-34ba-4c8b-840f-1ece1d08ef2c", "value": "0FF4BE11A3E6AA4CF33B53B88579110187F6B959D736D7BDA88050CE0EA3B454A7B333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029898, "uuid": "54fe4f85-2d57-421f-800d-dfe14daa5a22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029898, "uuid": "2469db3d-7789-41e7-8d54-3a5ea79ba657", "value": "12288:EalQitvqixg8Ww8A1SX1dnx12eUk4c8Q8GOFlwuMmX0v5:EMQiBqNVA1C19457Q8GolwuMw0v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617029898, "uuid": "eb2170a8-7996-46bd-b171-7f586b80f8bc", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617029898, "uuid": "bf045482-a918-49f8-86f0-2b4678577c72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617029898, "uuid": "c7bd24f5-746e-45a8-a39a-f1ad34efeb4b", "value": "Encrypted Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d826e804-90a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617032753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032753, "uuid": "ecc80d72-32b5-4377-966d-8c71de81f2b9", "comment": "Malware payload (IcedID)", "value": "6a9e394e39313947a48ad65e4f4f957e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032753, "uuid": "d66a9f90-4d89-449d-9b22-263cd159f661", "comment": "Malware payload (IcedID)", "value": "c729627eb14cabc48a505e46136db35d75ab1f4804bfc419587dd1a4536216b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032753, "uuid": "9d2e44ec-7e67-4635-a113-babe2d186f5c", "comment": "Malware payload (IcedID)", "value": "336ebd65de468730faf95dd82a46628037c2fd81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032753, "uuid": "03b5056b-9053-4afc-ad59-1b470a8ccb5e", "comment": "Malware payload (IcedID)", "value": "26ac7b7224a5d021712601befea8145183ab533d8ec4510f7d4d3b89ac618d68b25d802adda002e0c9e8833b7fa34166", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032753, "uuid": "6d0ab4ae-8981-4719-ae2f-294180bc9336", "value": "A2133CCA55700F23CA311AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032753, "uuid": "79b50cc4-802e-4f0b-b0b0-9d95c7b96cb8", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtB+xEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBdsc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032753, "uuid": "79db3e95-4dfd-4aa6-9e35-c2dc0473d3e3", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032753, "uuid": "7cd36305-f8f8-45bc-9a29-004283ee9be1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032753, "uuid": "646f9427-ac4b-419a-98b3-f0718d79a3d3", "value": "c729627eb14cabc48a505e46136db35d75ab1f4804bfc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a937bf4-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616999901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999901, "uuid": "d6f0742b-7154-4e08-a64f-1d65cc24b3dd", "comment": "Malware payload (RemcosRAT)", "value": "250b3b54f46fb6d993fae87660e4249b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999901, "uuid": "ff5df967-ce4f-48e0-8a54-7af9d49ca8af", "comment": "Malware payload (RemcosRAT)", "value": "c771c0417fcf76bac5cb23d5213338c6c8f8b381f6744a7619feb36edec1dacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999901, "uuid": "5d11fa1e-3eae-4eaa-a060-942ad9118b42", "comment": "Malware payload (RemcosRAT)", "value": "e6c10e1dfc2fec4685bdea8d8662a388e934b747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999901, "uuid": "f26ce914-da61-4b60-82ec-0b12ee74f27c", "comment": "Malware payload (RemcosRAT)", "value": "60809075e9dfcf1abf13e1b8fcdb15bc4f5d8e4385b509fba5e14406f8c26c516851ac98b2d923328f67ac14228c0ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999901, "uuid": "25e91765-9935-40c0-8eb0-b8ad6f1a74a6", "value": "7DB49F27B650843BC51619B9AD0F46ACA925BE617E1869837FD93F882F74381783F10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999901, "uuid": "6a58cc1b-58af-45b1-8e42-cbe68c21811e", "value": "e76f171d3c328f191b446a00e84abe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999901, "uuid": "02e168d5-798c-4771-ae15-516acc16d528", "value": "12288:phkV7VQvUerVR3cFno2If26B0vcD36Q6hRfIT:fqGseRR3cpo2ez76Q6zIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999901, "uuid": "b77e946c-0157-43bb-a0fd-316049fef0fa", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999901, "uuid": "aacfb52d-afee-43bd-abf3-1f7b2b755677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999901, "uuid": "9ad62386-0ed4-407f-9bc6-e7a312507370", "value": "neue Bestellung pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fe252e-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617033337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "dbf22920-3ccc-4daa-bba9-2495da2e1264", "comment": "Malware payload (Dridex)", "value": "22ae03ee15cbd216b614af831efc2727", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "a11d9c10-ab41-4cef-9649-474c0fc23f5a", "comment": "Malware payload (Dridex)", "value": "c8e7d61a95193e121433b77c045d78b4b4ff94fd92af379ab9549e672148f5a9", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "d4a566f4-3e94-422d-93a4-8d030cb506f3", "comment": "Malware payload (Dridex)", "value": "77bde7a5f24c0d7dbee94e5dfcea5a5980e5795b", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033337, "uuid": "d1020886-550a-4dfd-a82b-a916ed0f6f23", "comment": "Malware payload (Dridex)", "value": "f53807327f7d06bbc3c7e695a840b017d7e96bde7116f36b7452b1079562b45c6096ea8e811d717f7ba3dee73531540b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "9eff7e44-106d-4915-96d4-ad0245ff27cd", "value": "8984D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "08ec9ebc-6c9c-493b-a9c0-178d56acea57", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "ad6bdafb-1d56-4954-a4c3-b15afea3bee4", "value": "6144:PbazNBbycfmKsyUlVqMdUFIk1KyHNwoA3pFp5xMiC1h:OzeTlVq/7HNgp5WiUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033337, "uuid": "20721974-c852-46b5-ba84-ed75ff6e48f4", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033337, "uuid": "f8296e78-08ea-4657-a8bb-69fc640a1263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033337, "uuid": "d2c522b3-ab67-4528-9562-77af32d1cbf5", "value": "c8e7d61a95193e121433b77c045d78b4b4ff94fd92af379ab9549e672148f5a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e739dc49-90b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617038362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038362, "uuid": "ad01fe81-3b10-409f-a348-18a5b93b905a", "comment": "Malware payload (SnakeKeylogger)", "value": "839fc02d716c2f0bbbbf5d1964323cba", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038362, "uuid": "e61a726f-db22-4915-b6ea-0997c7eb3e73", "comment": "Malware payload (SnakeKeylogger)", "value": "c94b5271da136547006f30f1a8d5b3390e21a2444d8055e5bef97396475f4593", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038362, "uuid": "aa159700-35a6-4bab-b4df-8f994b333445", "comment": "Malware payload (SnakeKeylogger)", "value": "b10865db9c6c7a9eabfd120c36a3749cbf955245", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038362, "uuid": "8fbd67b8-577f-43cf-9490-fc4c66d0fde9", "comment": "Malware payload (SnakeKeylogger)", "value": "62fa3d1391776c91edc9a9da5d909275516bf0d8da97d0e1c93ca98476ec4a5cfaa658ea2fd85badbb1f102c7b0ac2cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038362, "uuid": "b9632553-023e-4bb8-b246-e53352176694", "value": "AEA502C86B8099D3E66B7D065E01B0583B53F5BB22C4199BF02FFFF5274A9909B20C56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038362, "uuid": "9eddce9a-6c44-4079-9bfe-7a661f35d431", "value": "49152:7j5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5zj5v:7dzdzdzdzdzdzdzdzdzdzdzdzdzdzdzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617038362, "uuid": "35fec201-0e2c-41f4-b71b-c08fa2eccdb3", "value": 2233616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617038362, "uuid": "84db463d-98cf-4c85-ac15-f074fcd3928e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038362, "uuid": "ec1b9be3-31f7-4429-bcb6-6c40b6880936", "value": "approved new order_April TT181.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f939217-90e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617061649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061649, "uuid": "1acf92c7-be7d-4db4-a81a-fac6894c8e60", "comment": "Malware payload (Dridex)", "value": "5514caab7a62199bc0112c95544d263a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061649, "uuid": "dc13461a-c47a-4c71-af63-b3eb619e6cca", "comment": "Malware payload (Dridex)", "value": "ca8ff9983cdb3e4aa0dac24bc0dd045a2761529ef7153e70a4b345d89a12a379", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061649, "uuid": "260d0c78-ae24-43de-874e-de8311344adc", "comment": "Malware payload (Dridex)", "value": "ced150016d0281fa641c72918b8689ae02cfd3b3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617061649, "uuid": "abc8e2b7-c3f8-433e-87fd-212bd8253007", "comment": "Malware payload (Dridex)", "value": "02e1e28971123497ac2510d8c08c81e60dc218b33d3de9afae78bacf804e9f77d55bbff233e4251b7bf8d65c721bb904", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061649, "uuid": "c9f725d3-1e8b-4771-b160-fdc3581c2ad9", "value": "EE14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061649, "uuid": "6a65bce4-6053-4010-9e7b-2d15276cee29", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061649, "uuid": "083b5a49-6ea7-430d-8d4f-d561c022f17f", "value": "3072:G1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Oi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617061649, "uuid": "5b6cb5b5-5eaf-45a0-ad23-98b55c66fbdd", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617061649, "uuid": "1de2805a-44ce-4884-9af9-56ca909fc8e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617061649, "uuid": "ea6b08d0-3bfa-47c1-a91c-34c5aceb26a1", "value": "ca8ff9983cdb3e4aa0dac24bc0dd045a2761529ef7153e70a4b345d89a12a379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418b6b1d-90b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617037225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037225, "uuid": "a222d4ac-b26c-4c29-a789-b5d2bc1bc062", "comment": "Malware payload (RemcosRAT)", "value": "1c9da32044c7248ccac5673aa735fdd2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037225, "uuid": "e128cb59-8c96-4d06-82a0-2fe1a6682886", "comment": "Malware payload (RemcosRAT)", "value": "cae93571e459d41e1686a9a6abe7dc00839b5f194b98c363fb6de39ba6fc8810", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037225, "uuid": "1f5c5764-940c-4e4c-ad30-7cb86ab61596", "comment": "Malware payload (RemcosRAT)", "value": "ef6b05c3bcfd2869e35be760ca07857dffe9ede6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617037225, "uuid": "1e97b90b-fd95-47f4-a9e5-a8d0069e099a", "comment": "Malware payload (RemcosRAT)", "value": "e23b43bbda582410706522459602172042ce96dda3d67e611032493e1bae1e6f7b0a926786d1c05458c7076459dcd1e2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037225, "uuid": "3922edbf-c03a-4dc3-ae5e-2b6b2907bf21", "value": "9934D04BB64C579EE38E8AB23579033187A8EF8316116D16BBD9FE2D053128E7D132D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037225, "uuid": "6416326d-7ace-4a9c-b7ec-1ca14856c0bd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037225, "uuid": "98331d8b-db14-4fbe-80cf-7ff07f95efbf", "value": "3072:NTs3BxJNmJB6oz5b/5W0VOjtp3+nXtlagJfCQPK5zIiaym/ejG/HY6190vTX:NAPOn1b/vkfylGuiTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617037225, "uuid": "6ec96631-600c-4c34-ba2a-7d0035938e5d", "value": 234422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617037225, "uuid": "6aebb2e8-e9b8-45f3-a84e-b4be2747ab38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617037225, "uuid": "14f39b79-86fe-4753-81c3-d733ed458699", "value": "REQUEST FOR QUOTATION - PR30016810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e825cf42-9077-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617013023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013023, "uuid": "e8cab33b-9cfa-43d2-a8b0-2d69c218cc96", "comment": "Malware payload (AgentTesla)", "value": "49cfd71fa8dd8101627c16766e9f39e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013023, "uuid": "d06a2abf-a49d-4ace-826d-1a914bef6f3d", "comment": "Malware payload (AgentTesla)", "value": "cb2304fe36c2a12f37d5ba5c6f9f02da9e56aa7bd5cd1814dc88ba3654712b35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013023, "uuid": "f9a66b6c-f530-42d9-a680-88f40eaa652f", "comment": "Malware payload (AgentTesla)", "value": "beb5e33ed6f475ffca6290ca3c43d8c6ccfca61e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013023, "uuid": "eae80b9e-19e0-42a5-afc2-37786f25fc1e", "comment": "Malware payload (AgentTesla)", "value": "ea0ae84b11917317a9ca5ab7fca3313c0cf5d6eb435c28e1910a3f3fca51decf1fa4b00158dcfd4e205817c4a5a53e97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013023, "uuid": "868d1e7b-bf4e-4530-bb32-ad33ca2b9bf0", "value": "58A423F4C9695E0B4214DCB3883B1E803C7FA9F7080E6B34487AA179EDA67517A4E71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013023, "uuid": "0e0fb9b9-4c5d-466e-ac43-ca5dbbfb7e2f", "value": "12288:TY24JJGEp834rTC8wcns5VgA6Ob9IEWfbTov7apynaYFtjoOZT:oJcarT00pW6EWvoTs6a8lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013023, "uuid": "915b591f-7eee-43ea-bd0e-2d825ea422b6", "value": 478297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013023, "uuid": "22a3ccbd-0de4-425c-aa6e-dcfe7823784f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013023, "uuid": "d4b013e3-9abe-4758-b529-eb6ad8cb9f56", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a584e000-90a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617033957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033957, "uuid": "7b419246-aa3e-4743-bf1d-6993cb6c2d16", "comment": "Malware payload (IcedID)", "value": "ef3b1e74e014c1d09dfc622b7b5791a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033957, "uuid": "bb1e6abe-f7a6-40a1-8595-f358127995d7", "comment": "Malware payload (IcedID)", "value": "cb33c9d2f6ff396e89ad5b17354561fda10fef5605b6926ad9cd6cfea2778c13", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033957, "uuid": "e9a9a518-c0e1-4793-b9ae-3af851e861e3", "comment": "Malware payload (IcedID)", "value": "b2c3f3958f2647d43385acc7c9eb4d5e63f77bf2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033957, "uuid": "6d850edd-0d44-4430-a145-0b55a5c43a72", "comment": "Malware payload (IcedID)", "value": "9fef9efeef044cbfacc80bd4478997c407fa57f24a38afce54cdd9ef179d6103818f86ef6618e414bbd50b29c73d9439", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033957, "uuid": "abacaad8-a212-4f0a-ad18-236e260fd6a8", "value": "E9133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033957, "uuid": "709ba89a-1ff6-46db-a0b1-5da8d33912ec", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtBcxEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBnsc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033957, "uuid": "57d60b35-276a-48d0-8209-515fcc4751de", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033957, "uuid": "55448cb1-6a54-4877-9d98-ef48f9d42b92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033957, "uuid": "57002c07-06d5-4698-a475-1bc60290325e", "value": "ef3b1e74e014c1d09dfc622b7b5791a6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4946c1a6-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002449, "uuid": "3d7f1615-8beb-443e-88d0-2a4d52fa6d1e", "comment": "Malware payload (AgentTesla)", "value": "534f2411e0c05c39c001317504ca4fb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002449, "uuid": "6f8e02e4-9fd1-4326-a9cc-a4640d72d317", "comment": "Malware payload (AgentTesla)", "value": "cb8857581a816c22f1dc1ac99bb0673848ea60fbee87c3c478e7d1a74b348030", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002449, "uuid": "36bba7f3-fff7-43a5-9ec8-f44fc1ec012c", "comment": "Malware payload (AgentTesla)", "value": "24e69844462963a310889ec8f068e2b2fe03c89b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002449, "uuid": "659c740f-e119-492b-9e39-1d69e284f68a", "comment": "Malware payload (AgentTesla)", "value": "265b04eab0852eb9050ff50e74f67c124eca12868c5c4fc119c1e1f71d0c21381a12e46e22a7a233db24974464fde81f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002449, "uuid": "c7f94f18-c3e9-4ff4-80c2-e37177723c55", "value": "96354A4C1E99C2CAE2394BB891DDA49943F56EF38F12CC79BDD547CBC230B41E646622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002449, "uuid": "fca28f0d-ed68-4c98-a8e9-953fd231496f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002449, "uuid": "3751f49f-8568-4ac6-a09e-9bd34f744676", "value": "12288:kZfe2YKMAd84R90GpLQ4aP34UMq/MFNzOPypAKSe+jbkeelQ4WionnkJXE/GzH9:k6cOGyPMSqOPE+Xk/QsDLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002449, "uuid": "dc5fc947-0223-4d50-b4f9-9e6cf6f03222", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002449, "uuid": "80611ae6-af47-4eb2-8ffa-df5c98b6b7c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002449, "uuid": "cea700ba-f196-4b6d-9081-f1dfe7c78aaf", "value": "534f2411e0c05c39c001317504ca4fb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2957fe6-90cc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617049548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617049548, "uuid": "8fd1b9e0-f7dc-4c11-9d5f-4a569b4ad19e", "comment": "Malware payload", "value": "9abf8579ed3b6e5d3d43b408509a53db", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617049548, "uuid": "3fad2a88-0568-42a9-8765-d16dbaa0741b", "comment": "Malware payload", "value": "cc74f7e82eb33a14ffdea343a8975d8a81be151ffcb753cb3f3be10242c8a252", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617049548, "uuid": "c03b2dad-6aee-41ed-b85b-efee8c982b99", "comment": "Malware payload", "value": "63ee039a478e23a505bc889cc74e7693ebe51891", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617049548, "uuid": "ff477136-fb84-4b80-8d89-f2d36ec8f5e1", "comment": "Malware payload", "value": "703c01f74f7f5bbc6f861536f5f863448f1424aa210c183d7814f713bfe9cbbbabc0732c1079c680d48764bea428021a", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617049548, "uuid": "251899b2-ddfc-49bb-aaac-8d266e50f1a8", "value": "2C547C59B2A510B8E677813CC8575A06E7F2B8160371D6FF03A0466A6F773E06A3FB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617049548, "uuid": "e6f4fdcc-8d31-461b-85f2-9aaf66771a76", "value": "ddb095d2ce52d8eb057df35ac1fd603b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617049548, "uuid": "91fb9af6-d68f-4c10-b8f3-a6d44c8f7221", "value": "6144:lV9H07z+CLXF0AYlHsGSD5E4Ck2oh66/px:lzHqtLyAtG0Ck2ozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617049548, "uuid": "efe82d04-a822-46ed-acb6-885fb5eb432e", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617049548, "uuid": "c1a787bd-ce39-49dc-b72e-4de02667ec2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617049548, "uuid": "dcd9329c-9dd1-4b2b-8ffe-d3ba9c849ca0", "value": "9857.tmp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f430ad-907c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617015120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015120, "uuid": "fe6d0ac6-4327-42f3-977a-06e258e0c4fa", "comment": "Malware payload (AgentTesla)", "value": "cb0328f2e1ab3b363bdef24109d40528", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015120, "uuid": "8b789d37-a9e8-410b-93f6-3a7b9de18bcb", "comment": "Malware payload (AgentTesla)", "value": "cc7b8a96b39e82a3a0042388a3757e061e7d9281eddc6cefd6118877a5dad767", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015120, "uuid": "4bd07145-b10f-4161-ad24-34efbad55fce", "comment": "Malware payload (AgentTesla)", "value": "8807fe8e4b5ee2079ff29bfe59471e6d62c12e49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015120, "uuid": "077f3860-022e-437c-8387-41f45d96f3b4", "comment": "Malware payload (AgentTesla)", "value": "00d3399f21f27157b3dec943e250dcd4a1a76a5ad5748b0d07737e9d603cb099c0bf59c35a47e4af1a7ea78f62615d99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015120, "uuid": "a0f23dc1-7230-44aa-bfdb-91aed6810175", "value": "4C25AE1193E0AA48E1BA33F546A481064BF7AC9942A6D77D586470CD0E73A47CE7B33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015120, "uuid": "854018d1-1f71-47ca-9150-c82852a55745", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015120, "uuid": "81f04fac-60a9-46fc-9484-0919b12d253b", "value": "24576:w3uDhfnmx+UCdbKZpMMDAnYRiDILc/w3NTTHG97sP5HRt:WO/mUUQbKZ/DWY4Cc/0TrUsPJRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015120, "uuid": "4ec49f70-d221-4880-b610-3bbc141796b6", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015120, "uuid": "1f6df854-42d2-4873-8c96-24a18d21edb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015120, "uuid": "ca3e299e-a4d9-4d75-96f0-17eab5f61452", "value": "Due Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f54bc7c-9081-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617016981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016981, "uuid": "d5f11285-b4a2-47e8-bca3-b6f3b37e6317", "comment": "Malware payload (RemcosRAT)", "value": "a11a00d13754b235e9640ef7a3543c91", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016981, "uuid": "c8f13389-bafb-42b0-a437-ca2588fca04c", "comment": "Malware payload (RemcosRAT)", "value": "cd224f9c2d85e53f10ec60d398b10b5fc756c53bd70392a98e766a8a8a64bd27", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016981, "uuid": "d5b8d707-e9f6-4944-b708-cd9c3674d7ec", "comment": "Malware payload (RemcosRAT)", "value": "9f92cac2b4a38a2f844de0f6d12297cf0cac80e8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016981, "uuid": "6c3e0360-1163-402a-a13b-941d37aee868", "comment": "Malware payload (RemcosRAT)", "value": "afa5369febcb1c9fed960ff656b82f7232861f1018e1505fd0997b1df3890c9e00db1d63d8e1e35f56975335bbbcc2b2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016981, "uuid": "d77882d7-8f5b-4ce5-af25-2d24b89c604e", "value": "D493F12A31F089FBDA2706B25DBBB67DD3F7E3110138A4870BB05F5926312C7941B696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016981, "uuid": "9ac50684-5608-410e-8f80-d128bf2b05fc", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016981, "uuid": "7fe394a6-7a2a-4586-9b24-39c2203d0834", "value": "1536:HRPYqa5pic6jXFdL2KiMcoNG9k7Fzb/HrDflpy4mDDSQhvkm05phk2DTJPxM1Ens:xPA6jXFN2McoNG671rPlpzOeQSm0zhZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016981, "uuid": "e0c4e5a1-d250-451a-97d9-e828db110d2d", "value": 94735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016981, "uuid": "db7c2885-1535-4a50-8343-a48e48c32d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016981, "uuid": "78363b65-80f7-45c0-92a0-b279f610559d", "value": "FACTURA609080000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865f1e99-90e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617057956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057956, "uuid": "7b6fe7a5-eada-4c1f-b599-f3f437e73b59", "comment": "Malware payload (NanoCore)", "value": "f3576624bd19f24bab44d87911b02269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057956, "uuid": "8db573d2-7ed0-4a17-a272-9c740f3c2302", "comment": "Malware payload (NanoCore)", "value": "cdfcb9455fc457ac23be82004bdcf4120e3c8d6fd2918228166015f9102d40a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057956, "uuid": "cec62b4a-655d-4ee7-9867-9b42f650fcde", "comment": "Malware payload (NanoCore)", "value": "3da1e61e6b1d77af06737e3b5000cbc8fa0be86b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057956, "uuid": "777705cd-3624-4c35-b9cb-9f2bf90055e7", "comment": "Malware payload (NanoCore)", "value": "3d3906229a583f2a0df712807b4fbaf36143041201d2c39aa11e912e2f87371f251fb7a83bcba19671e671420444708f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057956, "uuid": "d658e223-a370-422e-b02a-5276d8491c7c", "value": "A714C0692BAD862FC6EE8AB92003164A9375C1E35DC3E7DE69D454F60F363E506031E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057956, "uuid": "18a02cfe-5ad5-4071-a6b3-e513354f3739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057956, "uuid": "35118bad-5719-4864-9e00-1506737f7579", "value": "6144:rbpUyVszXOTsDyR4NZu/iHotHp9p0yWPS1tqYiEugP+:rtsDO4UAQ/iaHp9mPSHqYiJgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617057956, "uuid": "97456322-45b2-422b-8b99-7d131cc4654f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617057956, "uuid": "98f289f3-2e0d-44f7-b515-2c781fdbfde2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057956, "uuid": "b3f5e2b4-86db-41e3-afee-11303e5ea628", "value": "CDFCB9455FC457AC23BE82004BDCF4120E3C8D6FD2918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b66729-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028182, "uuid": "ece650a8-f1b2-4a7a-9425-9657e156faae", "comment": "Malware payload (Dridex)", "value": "525ef5558d494c19de2a0c8dbc7eef59", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028182, "uuid": "5be884fa-5be8-4841-92cf-85a27b5ce279", "comment": "Malware payload (Dridex)", "value": "ce7a598733c98fbfbae3e7600d37988799aaede7d2e51e0bae0b97f83c572b25", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028182, "uuid": "5465433f-b0a5-43b2-8dfa-bf0f4c2a960c", "comment": "Malware payload (Dridex)", "value": "4139e42c0830ee685bfd2fe7976903387bdc29c0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028182, "uuid": "709a227e-b563-400a-8b51-a787f4955db9", "comment": "Malware payload (Dridex)", "value": "46aab37523a9f60a1bfa57f10bc0acd264f9f8cd0c2f3ceb47b0fcfcbca5c2fee06883af48f69777b6d057e906fde0d3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028182, "uuid": "234cb189-538b-4345-ac8a-f3ff6ba67193", "value": "6714AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028182, "uuid": "69693999-4fce-4ae2-bfd8-b97c2c8ce640", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028182, "uuid": "ac4b03a5-b52c-43d5-b6cd-744e209cfdbe", "value": "3072:7pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:7BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028182, "uuid": "e342e359-fbd0-440b-bd00-eb8fad4129cd", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028182, "uuid": "798645f3-1614-4faa-afdf-23d7277f7ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028182, "uuid": "ba95d2a2-901c-4859-93f5-36c7c45e0a48", "value": "ce7a598733c98fbfbae3e7600d37988799aaede7d2e51e0bae0b97f83c572b25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0588000d-907c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617014790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014790, "uuid": "618d6df4-dff7-4630-846c-423e6bb902a4", "comment": "Malware payload (SnakeKeylogger)", "value": "8f42261801dc0c6132d2409fd3fa0e87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014790, "uuid": "3e6ff001-6deb-4d7f-afe9-4922903778cf", "comment": "Malware payload (SnakeKeylogger)", "value": "cf1cc11505c564cce2036cc0a1f98b46a8fc1bc43008e0f6b8f1faa5f23d5829", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014790, "uuid": "0d8c0c7c-a55b-461e-8d29-967022ea9380", "comment": "Malware payload (SnakeKeylogger)", "value": "ccbc0e75e0c895931a5ead579c2b8d4e8503fb4f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014790, "uuid": "bc578f62-ab41-4a69-b88e-61d10f19378f", "comment": "Malware payload (SnakeKeylogger)", "value": "7c3bd3221ad38c589fb277d7e46d85a360c586ac82397d0f3f2762a7461665de186084f6a235fde974b80fb3c918b9b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014790, "uuid": "4e437e82-4bee-45a1-b238-f4d930ccf021", "value": "2E0533A450A3DECF35F254CB601B06FDB252E5609F5F7D3B02901AC6CA6B0E79A017E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014790, "uuid": "b368c342-486d-4316-a747-519ec7bc7e65", "value": "12288:TD6KS8gMr+O+F462Jdg9Yu7kVQtOke8bg3jU9rDvqN7JlRKZdTkVQgULPauLSten:TlC5wJdg9Y6kVQUb8EU9r+hYZdIVc+gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014790, "uuid": "c63c712a-8b3c-4b89-8bb9-be8cde101421", "value": 800354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014790, "uuid": "f864ea9b-e4da-47d0-9b82-67a8aa15f165", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014790, "uuid": "93049f66-c254-4231-9e32-90bbcd9a2eba", "value": "SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d067ce7-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005864, "uuid": "e3794108-7e19-453f-bbf7-c8eeb42bdde2", "comment": "Malware payload", "value": "d555bff6d10941f4c2243245427d4ef9", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005864, "uuid": "7e1cfc6c-68b9-49c6-87d7-b32b7e1fef98", "comment": "Malware payload", "value": "cf76d84527415e188f5954b3c7289ad60f3b36ad0aedb913c53cf398243609a9", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005864, "uuid": "e2ea681b-39a1-4043-85ee-c264c1c8808a", "comment": "Malware payload", "value": "ceb8dbc458f157caed0742e4e9b8c0c978fe8fcc", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005864, "uuid": "03f9bfa7-2159-4170-8841-a8aa2d979cdd", "comment": "Malware payload", "value": "b87dbf6fc48080b24206ab96e4039da3004bd184a827f68fb9f512a752cc8154970b44b8c404d4bcb4f23ca8f8bf4928", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005864, "uuid": "ad1f47f9-3523-4b4c-aa29-110be82478a8", "value": "ADA60101EAC18573D8B1013552BBA7BA593AA9202729D5D3E7C438787D307D16E3B3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005864, "uuid": "593989e2-f467-4a48-af26-d98a829660f1", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005864, "uuid": "6c8a9767-540a-483f-9579-0d11f9ebecd7", "value": "98304:a9Yyb5er5PTIHykLIbh9jMsUPShLK7fAkjor76l9AEUcVqHurFpRIiR/wU:a9berPbnLo7bl9AEBiATIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005864, "uuid": "73791318-34e6-476b-8880-b4f0f84cd8bc", "value": 9861832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005864, "uuid": "9893167b-23a2-49c1-b34c-d780e8028236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005864, "uuid": "fa587308-4be3-4607-95e6-c28b51d8e49f", "value": "cf76d84527415e188f5954b3c7289ad60f3b36ad0aedb913c53cf398243609a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eb0a9c-907c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617015118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015118, "uuid": "c560fcd8-434a-417b-aefb-d3be165ac627", "comment": "Malware payload (AgentTesla)", "value": "3bb6eab72a0131df203e5e2b953a6d54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015118, "uuid": "51101a54-2803-4326-8dcb-036c1a197e82", "comment": "Malware payload (AgentTesla)", "value": "cff599e956d0c98bbc49ed90ce24e2362f7ab9b09abec361099522b8a797401e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015118, "uuid": "b255a265-ab94-4a41-85bf-b6f2690d2d3e", "comment": "Malware payload (AgentTesla)", "value": "78d23bb35cc44a13b1b63801516229e447e4eafc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015118, "uuid": "bd3f7e10-e013-47b4-a0f8-a9cb02cff514", "comment": "Malware payload (AgentTesla)", "value": "d6f5aebb97132408fbe4a86fd9b8879f335b671753c615d824472b99395f86c93010a997a6a6e5d8f0d49eec77150fbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015118, "uuid": "1728dfd6-4e2b-4cb1-83b6-79e2ccf73073", "value": "5CF433C91AA2E082FBFF48909374DFDC0946AB2A1AE4C42D72853753CC94D57E1A734A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015118, "uuid": "41b7ad4f-729f-4921-8a22-2f16cda56f02", "value": "12288:2z5prqBhTZtnmx+oCdprDsQKGUP7MMiE/1hAZYh/z1cJpsLGpfw3TvTT2Ei9L994:8puBhfnmx+oCdxYZpgMxAZYBi3sLGNwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015118, "uuid": "94604bbe-e286-4af1-bd69-471842ad8497", "value": 752920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015118, "uuid": "3faa0654-ef54-4238-94be-49c646da0278", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015118, "uuid": "e948d7a7-b6ee-4227-ab7f-ed8388d465d3", "value": "Due Invoices.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2c9ad4-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040437, "uuid": "5465d97a-cc78-4154-a98f-9a1c66ddfefb", "comment": "Malware payload (Dridex)", "value": "dc29790d0cd39ee928a9162505cd9a04", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040437, "uuid": "c788a6bd-93a2-4d7f-bbb6-09e4890da412", "comment": "Malware payload (Dridex)", "value": "d09dd09348f6c4294e1e47805bde626d0afd1a062b163d773b443261fc1abd49", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040437, "uuid": "b6b0cf26-2efd-43fd-b6b2-a4fa146dd0c5", "comment": "Malware payload (Dridex)", "value": "a4f61d842cd6f59d2de65d49da8604ac3e430107", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040437, "uuid": "90225982-00f0-48b2-acfb-6888ac1eff6d", "comment": "Malware payload (Dridex)", "value": "1a414bd8b53fc744d6781dd8a74e6c7fab180be5bf2c6035c5c8c4b1a86765967e12b0512867fa1e221ed01d63f91b06", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040437, "uuid": "a226fc9a-5f05-4970-91b3-ee830372f026", "value": "A1C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040437, "uuid": "bdb65d50-2d22-467d-b2ff-1aff843371b2", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040437, "uuid": "7a8068bf-f9d7-4ef3-a7d6-05a2d286c8e1", "value": "12288:Qt+D1yz/1SXpqDaoWmasFhHk3eBWIcrd:QcA1aLoBtIeBjcrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040437, "uuid": "a5f142bd-833b-4477-991d-708489d23759", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040437, "uuid": "fb57d6e4-de33-423c-b9f6-daf53866fbd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040437, "uuid": "8796bd67-40b1-47dc-abfe-624e43f6c6ed", "value": "d09dd09348f6c4294e1e47805bde626d0afd1a062b163d773b443261fc1abd49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb1dc8c-9074-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617011423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011423, "uuid": "980ad3d4-db5b-4191-8cbd-7c608de17006", "comment": "Malware payload (Formbook)", "value": "60c6f303a7dcb059f8e19a16916e0e86", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011423, "uuid": "3ff6758c-a28e-4327-91b0-2c731febb523", "comment": "Malware payload (Formbook)", "value": "d0dba649ebc68a9dbfbd7589270e2943aaad4961bbf281a2cf6fc36e9c0c8608", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011423, "uuid": "19007f4c-1ab3-4348-bd27-17c95427f27e", "comment": "Malware payload (Formbook)", "value": "4792caa0544c55f2dd0ebec43a5e67a9d3a8b5f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617011423, "uuid": "9f99ee90-b94d-4d2f-9efb-ae7df840bf75", "comment": "Malware payload (Formbook)", "value": "e0dee459d7009fdd85571185e821c78b7e954f244ba25972aa22f5dad4475752de751c96d307966790f2e2e9aedba516", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011423, "uuid": "6b91049d-12ab-4839-a8a6-6317b988b82e", "value": "75A423C11297A940C92466F9E959F2A5F2360BF8630C907D710EFE415E35B5EFBA0B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011423, "uuid": "12594825-b1a6-4678-9f6b-f662eda64ad3", "value": "12288:53fP8FnrOGdquZbuEn1nkZEEOVUBqx6/U4DjcUqy4OQi9z:lEFjZVhkZWrx6/U6IyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617011423, "uuid": "dfcd0268-1351-460c-aefd-3914ee362527", "value": 488888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617011423, "uuid": "53551b98-6beb-4138-b7dc-10dc9593aa34", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617011423, "uuid": "f697b335-b4a6-44ce-a35d-612ff474f210", "value": "DK Purchase Order 2021 - 00049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f486c8a2-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617025929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025929, "uuid": "85de64fc-4bad-444c-bdf0-9a28d8522efb", "comment": "Malware payload (RemcosRAT)", "value": "643901a4c4b7c80a77985fd1785ae0dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025929, "uuid": "e0df56f0-d2e1-49ed-aa55-e46a4717bf33", "comment": "Malware payload (RemcosRAT)", "value": "d182b4270953b723d918a4da2df99c92808dd468e8903df40420ff73615572fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025929, "uuid": "9b156329-f865-4bfd-b513-6aeee36535b1", "comment": "Malware payload (RemcosRAT)", "value": "ebf6b758b391f61c4690c5dc106176dcb0ce5834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025929, "uuid": "6403d45a-3b3e-49e4-9f82-56038968406a", "comment": "Malware payload (RemcosRAT)", "value": "3ae5b110f7222cf55ca4cdc22c25b2dd6974398d1a5343292de372710f90d7fdd43889dc657b410eadae1749f92b589a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025929, "uuid": "066dfed2-5532-4598-8e5d-69e8784ec411", "value": "5774AF355A815F05E33B1E7B884750608FF8857BAA13F9E76EF42CE81098FE9457224E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025929, "uuid": "1586741b-973c-498e-8cc2-39d31d82aa85", "value": "6144:kQ6RK18CaAjzcfP3Ls2AoXrQHZLnzkqztTF7sMo+b8U1DrPXG4Ft1JNkzr+5l+cC:J6R+8CaAjzcfP3Ls2AKrQHZLnzkqztT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025929, "uuid": "00e003b3-e14c-4d37-9eb8-cefc41b0aaae", "value": 348968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025929, "uuid": "a4d43752-7f46-47e8-b34b-6b57768ce2d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025929, "uuid": "20628aea-4c88-4b3a-9205-afb44456a44d", "value": "643901a4c4b7c80a77985fd1785ae0dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f6d906-9060-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617002797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002797, "uuid": "e17dc5f7-5285-4368-ba5f-6371e293b9ed", "comment": "Malware payload", "value": "862716a7a7e519222f24d48324faef42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002797, "uuid": "dd3ef559-7b76-4a43-89c9-f60575e00ba7", "comment": "Malware payload", "value": "d270866604c9053f5169f9b6eb7792638ebb6415ef7b3af14ad5673add13eec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002797, "uuid": "f4d9543f-aafa-43ba-853d-e0ae04a6341b", "comment": "Malware payload", "value": "20890192bbb8d28c3abc44c1f4621ef66a563f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002797, "uuid": "33f47cd6-306e-4ca6-aef9-757d3ccccbee", "comment": "Malware payload", "value": "2e77bad4b6bba86cd8d4d8dabb99ceffe61d0eab19f2cb49418dc13e22e9e37249b30f9c139eb3279441f720eb10371f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002797, "uuid": "cba7b8c5-9bf2-4bcf-b0b4-d9f8aefc39a8", "value": "68E3397708679465D54C2230F265DF0BF9AFC62438C17784A48EB2AD9C2A64DC9F727C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002797, "uuid": "1dea4b0a-4eff-4240-9633-169e1679979b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002797, "uuid": "afe1048c-ea80-40bd-9bc5-474ed2d0930a", "value": "3072:9A0zb3gj3o+vkiIiStgxPAO11dccIUOQtE2owzd:m23m3+1IqotE2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002797, "uuid": "de3a04e2-8011-4ee7-90f2-ea519d084190", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002797, "uuid": "039a03aa-8d2e-40a0-ae61-0b54e5dd7da2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002797, "uuid": "c6c2ff5e-2c62-4468-a319-ebd6c5660bfa", "value": "862716a7a7e519222f24d48324faef42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0990f5-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "07b00b09-6b0e-4bce-b02b-7dc89783cbe3", "comment": "Malware payload (Dridex)", "value": "3482b0424d2053a00a96c335bf4a43f4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "bb31bed2-c11d-48c7-83fb-79717cd8c3e4", "comment": "Malware payload (Dridex)", "value": "d370dd9403d5fa8c8e4bc2c8e3b98644a321303222e2016cbeb1c8652e0538a0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "c843b786-d50f-4cdc-8544-fd1c842c33cf", "comment": "Malware payload (Dridex)", "value": "5141882eb15aa4a549e58e1b9eb3a055972d7e7d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028174, "uuid": "34dbbe6e-0835-4db7-8145-309e62e033ab", "comment": "Malware payload (Dridex)", "value": "98dc64360effbc7abb4da7b88c24f80b9ec18a89f2fca3c3040324de81e4f8c1423f254e81224baea2b7543d6fcb2685", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "16568eb7-8b6a-448a-ac48-986ce49d9d69", "value": "B714AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "d54edecd-fba1-4131-9de9-e6db4512fc89", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "3426d1c2-a50b-4274-ae44-2bdd94bc7929", "value": "3072:CpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:CBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028174, "uuid": "586b8e4c-312a-4ab5-826a-e94347244b69", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028174, "uuid": "a45ae921-a3bc-49bd-bc2e-84cca51a66bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028174, "uuid": "2e16136b-11c4-4f1c-8d4f-025c280105ef", "value": "d370dd9403d5fa8c8e4bc2c8e3b98644a321303222e2016cbeb1c8652e0538a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e063f8-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616998067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998067, "uuid": "e2b85755-52a9-41c7-98db-d11963d8f2d3", "comment": "Malware payload", "value": "806a1dd7c7f59ee4e89e5281af0bd2ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998067, "uuid": "c8f3c3f2-1b7f-4459-9600-d64f7b5b5138", "comment": "Malware payload", "value": "d389805f9a872b39d39914f6e9a4a0e397115250b1f80d76e03170340b0adca9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998067, "uuid": "2a3d3114-163e-4759-98be-0ffdef005ffc", "comment": "Malware payload", "value": "363aa8df19eca386c89c1d34898b2547e7a3cb18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998067, "uuid": "648d9e36-1160-4bbb-9e80-c847a759a08e", "comment": "Malware payload", "value": "30392a710000fd81e7215bb2461c9df57ab4e73c851d6be4e0824d7272edf848e6c9de888ac5f307c7adf2f0493183cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998067, "uuid": "7cbea208-31f3-4c64-aeef-b1036ac122e2", "value": "D7F6022B665841ECC076E039CA525B07F372780913316ADF43909E6A2FBB7E18F79761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998067, "uuid": "400f9284-48ec-47e2-b27c-44f57ceaf6e9", "value": "308116d2daee33356cfced2c827320a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998067, "uuid": "149158e1-4cd1-4b03-b936-79a163446382", "value": "196608:xQGNczi+PkUQ4FbFT+9/3MsoB/iIWIT6tPwJxwPALznvUil5q:xn6z6zW+N3MsohlT0wD8A/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998067, "uuid": "0230beb8-d00f-469a-8d07-8e75296c5bd6", "value": 16466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998067, "uuid": "7a94eb97-4efb-4f88-84ae-7b7e41a8d7f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998067, "uuid": "3397b8d5-630d-484b-8440-e0025e2d0507", "value": "nanominer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30909313-9054-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616997683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997683, "uuid": "22e69b7d-2144-489f-a8ed-24fc549eea80", "comment": "Malware payload (Formbook)", "value": "5a25b67da40198bb345afe80f0c5b25a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997683, "uuid": "1ec9252c-e899-48f7-8887-b4f28abcd98f", "comment": "Malware payload (Formbook)", "value": "d3d93903bfc6c4473c8285e4e1d9ad1f70eeb9834ccf9e699e9410ab71a9c431", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997683, "uuid": "bac5dcca-0307-4149-8900-dd04bed0412b", "comment": "Malware payload (Formbook)", "value": "f3c3cedfcdf90ec358516432f3954541f26a19da", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997683, "uuid": "f6cd2f79-9c5d-4534-88a6-1a9285bad083", "comment": "Malware payload (Formbook)", "value": "6148b8d74d9cfbc77cf8ba6764ca242ef6ccb7bf9068091f241f2aaa069012dba80d79888b9a2e4121adb1a6f7d48b38", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997683, "uuid": "598b78ea-3012-403e-bfa2-f3612ce2b2e6", "value": "F8C533EAA9DA8B37E9FF07F5C54BF5AA20296C461858BD5937583204253B3BC72C3344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997683, "uuid": "f6fd3296-04bf-48f8-9d92-2b993b930441", "value": "49152:cHx+bbXH3guvBtpUmIeW7bc4JV+YBd5AiIXYka0qQOxIamX/66:kxMbXHRty5eQc4JcYnsxa9QOgPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997683, "uuid": "902c980b-5cf7-4380-9fc0-84379f9a0e39", "value": 2561536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997683, "uuid": "b43809dd-e15e-4277-b749-03ce81fc5e43", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997683, "uuid": "1a2eebca-d7cb-471a-9f51-f7c48566db56", "value": "COAU7229898130.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c077e792-9055-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1616998354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998354, "uuid": "ac03b762-b73d-424c-ac19-325d9e85594d", "comment": "Malware payload (Smoke Loader)", "value": "33bc8eeed441d6fbeaae7e348f6fa5ca", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998354, "uuid": "b1d85f04-2069-44d5-94b3-3c56b7f5541a", "comment": "Malware payload (Smoke Loader)", "value": "d4b30fa63884e4758e5545848ad0846038885c9b0f55d33f0facae9e7f639a4a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998354, "uuid": "c01402f9-d39e-42a0-8749-bebc03e3fb52", "comment": "Malware payload (Smoke Loader)", "value": "7fe38f4dd6d1fd326f07ec88238a192520bd998c", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616998354, "uuid": "4fea659e-fef4-4ad9-826f-048af7720a0f", "comment": "Malware payload (Smoke Loader)", "value": "7a760a55d560a8a176a9e7eb1e077ada1f9a1e25c463550e11681fdc9ea82b26f41008967828904d8f4d114e088614c3", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998354, "uuid": "fa1e4887-2121-4f33-9bfe-9c98fb8803dd", "value": "79454B53018C95A5D23036308092AE3255A7DEB46E3FE847EBB47DDFA23DF856C24A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998354, "uuid": "5c878b61-1e7b-4ce9-b562-c479176aff43", "value": "12288:X7uffVFmmmdGK+vAMsrGhh2cB8S1q7KkRDDu+aff7:ruHVFmtGKCUGX2y8S1qdR/DIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616998354, "uuid": "0b049929-a87f-4227-8ab0-5aeaa30ea566", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616998354, "uuid": "116fe8be-71a6-4686-8279-d70cbd6479da", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616998354, "uuid": "9dde4a23-d6d5-4633-ad1e-88cf57bf0f01", "value": "Approval Tender List.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3334f3-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617032139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032139, "uuid": "345a43cb-63f4-44ef-8305-f0cf90d6f779", "comment": "Malware payload (NanoCore)", "value": "93aefc998731d9ac4ee1c30261e3c4cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032139, "uuid": "87e49e44-4b9b-4fa7-b13f-231471d0190c", "comment": "Malware payload (NanoCore)", "value": "d6115967cb6d42bcd92e2751bafb4a2560d393c81c48c8d0db54e3c7497a27b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032139, "uuid": "d185928f-d3bb-42b5-9065-bf4b66a8b621", "comment": "Malware payload (NanoCore)", "value": "8336ffbfe0b7cf009ade5dffe0ceb12a0356de17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032139, "uuid": "d87ab811-4921-46a3-9bfa-6a21d97e0c08", "comment": "Malware payload (NanoCore)", "value": "999fba47ed5293285447c103c9d26488e34bd806bfcef439578eb9d060d6471e2ab6e282f4f3a24dc44f1009c7b84960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032139, "uuid": "b1a381d0-8177-4f88-b917-2478eaa9542d", "value": "B99402157B654A6FE2CF8AB86112014283BDC3E3A8C3F7EF19C455B65B663E50A071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032139, "uuid": "495d379a-ea89-439d-8c49-7124f1b71ebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032139, "uuid": "8c642889-5cdb-43ca-b840-e2a03db04d4a", "value": "12288:4LV6BtpmkFmkyUYiF1QbPRfylrsutwv31iqv:KApfFmjUYysMpGv3Mqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032139, "uuid": "5a6abbeb-f3f3-4688-86ef-6d48801a7d3d", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032139, "uuid": "20611505-daa5-4aef-bfed-63bf0be58a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032139, "uuid": "16a3caf1-ab35-44f2-8660-fb177997434d", "value": "93aefc998731d9ac4ee1c30261e3c4cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d544a2b-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616999825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999825, "uuid": "b88a51ea-b0d9-4447-976c-4741042c67b6", "comment": "Malware payload (AgentTesla)", "value": "68b2d8b16764171e4f74731f0fb77d01", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999825, "uuid": "078ec44e-d528-4f90-b17d-b43a44750945", "comment": "Malware payload (AgentTesla)", "value": "d6f6c39b2b8850acea9fd3cb80b440f44957b81554c8f637d21fa78a12cebcf8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999825, "uuid": "3af69f8c-45dc-4cc9-8597-94fbb2c0d52a", "comment": "Malware payload (AgentTesla)", "value": "a0021c000b6f8033224cd857829bea892519effb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999825, "uuid": "32b8d8c3-ab0e-4f27-86f0-db761f536eec", "comment": "Malware payload (AgentTesla)", "value": "067e2fb313526f0252e5f17eeb415e4cedc097f1b9853bb37c33fdd29c813ee05686acfaf21a6423117b26f4db621f16", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999825, "uuid": "e3f25601-1ac7-44c0-9ce4-6cf3c8e09344", "value": "86B423C49B5B9E194716E08B15AC30DEC807A76EABCC377C43247917FC40A97D8B53AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999825, "uuid": "a6a1f74d-1ccc-439c-8b2c-2fffe2fb1cc5", "value": "12288:/otnVaSa8T4Sbs754PTkS/QCTs1ryxz9Qgk9aQEmLWR+v:YVamT4SwWPn/QCT+kpQL8QEAOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999825, "uuid": "f17034d4-2708-4d14-a00c-6d467a470dce", "value": 513264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999825, "uuid": "c2089204-729e-417d-9bca-1ae0fe4d4486", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999825, "uuid": "754f9c09-6677-4e1f-82e4-89d46a15d1ba", "value": "SRESTKM-series.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe76201-90e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617058509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058509, "uuid": "7c07ddf0-7b53-45c9-a2ac-e530c7d2ab5f", "comment": "Malware payload (IcedID)", "value": "e1f4b2210f3953bbe3092349a5d005a8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058509, "uuid": "6863922a-a7ba-4085-8fd8-311fecdf95e1", "comment": "Malware payload (IcedID)", "value": "d71b6f5264bff01b6ed8d5965a377ab7321cbb86f8fc7c1bba51966a07097e40", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058509, "uuid": "8ff789e9-9351-4195-89c2-b8b9627d303d", "comment": "Malware payload (IcedID)", "value": "afa937df64dc390b1a240fdfe13c2bc8c01f3b70", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617058509, "uuid": "fa1b0b43-0a8a-440c-aeea-a0be7bb4d1fc", "comment": "Malware payload (IcedID)", "value": "cfc34047b86878660bccdec4c182351708eebe1b762848b009a465e77cc8635b17db03cbc46b9b9204bdcf79cdb93ec8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617058509, "uuid": "459a0696-c0bf-4120-8d3d-993ee9f4f1c9", "value": "4404F01BDD094E63C40DC77C7E5B0CBD6B0CA26CA684BBED20B15DD43B882265DAB15E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617058509, "uuid": "e37b97bf-2258-49b8-b213-e7d808319878", "value": "3072:FTXFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBb:9XFYiB3kNBozoR8gOvljFy3ZIOXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617058509, "uuid": "29e38cb5-a45d-4d2c-a5f7-ee63aae057d4", "value": 189106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617058509, "uuid": "23e867f0-5d86-4a67-97d6-2ac7b81b158b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617058509, "uuid": "87ae1119-8f12-4da1-a631-72feaf22981d", "value": "d71b6f5264bff01b6ed8d5965a377ab7321cbb86f8fc7c1bba51966a07097e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eae9f2-9092-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617024592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024592, "uuid": "bc6db27b-4fd2-4197-a098-f28783cbc0f8", "comment": "Malware payload (AgentTesla)", "value": "438cf497eea2401b2500b7245b521c9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024592, "uuid": "d2b2e2d7-6d38-490c-818e-1103abdaf055", "comment": "Malware payload (AgentTesla)", "value": "d7e50206907fc346655f156d561d577e5b1acdcd9186f4a54ca5f66ed69b8b4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024592, "uuid": "4bff47a8-0168-413f-a46d-67be9ec5055e", "comment": "Malware payload (AgentTesla)", "value": "71f303a73f6c0e0179a445c144e220dbc5263ba7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024592, "uuid": "9c00fb0e-9062-451a-b9e5-31abb567d78c", "comment": "Malware payload (AgentTesla)", "value": "38e757e1a3a22bc90910176c604e182c00d552f3e5b056142c126a460f1b6f424328d4a1dd05bd112bf21ef727702f69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024592, "uuid": "c82422a6-ce3b-48be-a88d-2d09eff900cd", "value": "1835F0B1F844E2B0F5643BBA6571633106ADEEE21417AB0D7A4CF6E92039ACC4DD7D42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024592, "uuid": "1c3e4ee5-24a9-45e9-996a-cffadbaefefd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024592, "uuid": "6e135636-a98c-4029-a0be-c4fefcaaf3ab", "value": "12288:nXQs2cI3kGzAwI4dFWbXIW0WpSTk4fDtHtDo26U+LHHUKRslw52yZx959sAV8l3:AA3wrFWb4cSI2NDo2a700slwd39a3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024592, "uuid": "4a3a46c7-a06e-4a25-a72c-877c75688cb0", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024592, "uuid": "3a2fdce0-64ee-4aa4-91dd-42ef4b039ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024592, "uuid": "ec45c793-2932-4beb-bb42-9844d1a6f220", "value": "VESSEL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8606fc11-90a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617033045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033045, "uuid": "513a8b62-da84-45aa-b069-763e99f6d8e3", "comment": "Malware payload (IcedID)", "value": "4e2027692c010e9b76c7af6d5aa4bced", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033045, "uuid": "2ee92cde-a8e4-4399-971d-5965d15d1afd", "comment": "Malware payload (IcedID)", "value": "d800fd83e442a5a98c9baed2617242cb8abdcd13534c80eebed8b515c6e22109", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033045, "uuid": "57d15bdc-a792-45bf-8636-cb333d92bb87", "comment": "Malware payload (IcedID)", "value": "7c8d41d06ec6806f88e7943965ef1b5b33462f67", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033045, "uuid": "5686b394-f493-4f17-9ae7-cd27708297f1", "comment": "Malware payload (IcedID)", "value": "c13096377a00fba8951a82e26b2e458773976fca1000a8b4e5d5d531bb4709e141801fd758465063931e121193718841", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033045, "uuid": "036f1291-0c03-4a37-b351-c7ebd10d5fe8", "value": "AB133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033045, "uuid": "a718dc35-43f4-4dbc-ad15-568d5840d9c4", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtB7xEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtB4sc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033045, "uuid": "21350bfb-4289-460e-b94d-9987140508b9", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033045, "uuid": "0337bb2a-59a2-486d-8435-66871e72a9bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033045, "uuid": "ada289c2-fcf0-42a3-9a04-aaf0f832210a", "value": "d800fd83e442a5a98c9baed2617242cb8abdcd13534c8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaaac297-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028060, "uuid": "162563b3-7b40-4b45-a56e-7bcebc3b8555", "comment": "Malware payload (Dridex)", "value": "e440fca846c80dd9975eb1f3aecb20fc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028060, "uuid": "908e1ad3-3030-47c2-9214-5ad3fdd03452", "comment": "Malware payload (Dridex)", "value": "d8434979fe1ce7609666c31042c14b444773f283d9776ec5dafff86d15f1c256", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028060, "uuid": "730da1e5-87d5-45e0-ac89-02b9b7f90be5", "comment": "Malware payload (Dridex)", "value": "f00311b1ed7c95e2796dafaf1ad2cd29b1c55012", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028060, "uuid": "41b98b67-ca70-464d-9bb2-c3a85234a035", "comment": "Malware payload (Dridex)", "value": "b87b9e4a12ba4fa7edb6576d6d2765c8fc018b33fe7513410c1ebc151ea63863b1c7bbd9bd99c38721a814414dc11fe6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028060, "uuid": "03ebf051-543a-40fd-a48e-973d98165d18", "value": "EE14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028060, "uuid": "5f8d9dcb-9fbf-42ee-af76-ac7cc04ff8c1", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028060, "uuid": "1ff80e94-5029-448f-a6e6-d5489c977e89", "value": "3072:+pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:+BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028060, "uuid": "fe0c72fa-0c3a-4310-a337-69d7cb4b1558", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028060, "uuid": "67fcdaa8-3c66-4154-aa6a-7870ce7c7d90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028060, "uuid": "a78238d8-2d5e-49b4-bafe-8ffe607b1fc8", "value": "d8434979fe1ce7609666c31042c14b444773f283d9776ec5dafff86d15f1c256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3aa4f21-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617006090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006090, "uuid": "f5744300-779e-462b-9fc9-84addc84b30d", "comment": "Malware payload (Dridex)", "value": "743978456911c009cd76c002eb620ed4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006090, "uuid": "73ee3ad9-cf7e-4056-ad95-13ec486e655d", "comment": "Malware payload (Dridex)", "value": "d8b94bf0ec2250c0d20b1fb93bf852136da4f0306503cae7216f985d233b8267", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006090, "uuid": "f7452cbe-bc08-4c03-b994-54bf362eae92", "comment": "Malware payload (Dridex)", "value": "c82e8398e5e3b8875eb792d33b3e1f275745e6a4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617006090, "uuid": "c8c9e9a5-e567-4fa9-9704-e2407f61f9fa", "comment": "Malware payload (Dridex)", "value": "fda8d63fdadebd4bd04b46275119d31eb07d0ade95e5c526687946e010e793a340c25a112f2888dc7e6b7c5e4b057266", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006090, "uuid": "72a9dcd6-e504-467c-b1d1-2fbd46f794d1", "value": "0814AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006090, "uuid": "cd6c0199-3274-4eb7-9c3a-736460557854", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006090, "uuid": "19364cf3-7e52-42b1-8301-2914935e263f", "value": "3072:31i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617006090, "uuid": "4414b26b-e23a-41a6-b3ef-2c017ece3acb", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617006090, "uuid": "ec961d48-013c-41d2-8396-3de12ac48618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617006090, "uuid": "3d331572-a0f5-459a-9244-4693a3206819", "value": "d8b94bf0ec2250c0d20b1fb93bf852136da4f0306503cae7216f985d233b8267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16ca509-90ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617036231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036231, "uuid": "8543556b-c9ed-4f6c-a14e-38c4c70ec9b7", "comment": "Malware payload (AgentTesla)", "value": "739f623e87cc82e64cc9ef724b6c83e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036231, "uuid": "7952dfff-5834-4a27-9204-d044183e270e", "comment": "Malware payload (AgentTesla)", "value": "d8e9b0258c9738f62d5c534b3c871b124ab27c22ada54d63040c4917e3c36d46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036231, "uuid": "8f8dee14-8725-40c4-a4c8-ee493feb823b", "comment": "Malware payload (AgentTesla)", "value": "56d3105e9d10965b5a45216ff98a9a2ce57b9c14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617036231, "uuid": "2dc524a1-3b8d-4242-8804-c6fdefab2caf", "comment": "Malware payload (AgentTesla)", "value": "34078d8b5c2ba23f99a646e914d51a0ed986000eff0ff775933fb81e660142280b7b9d318d0ca889d6a50060f3721a0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036231, "uuid": "dad254b9-3ff0-4f79-bfb9-6c4b0e8e9005", "value": "71C4356311FC2AE3F9682BB91167665E0FA47F72A973CE4C997539F56371F800022D82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036231, "uuid": "a8ef2af5-4464-4209-acf5-7f7c473ce56c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036231, "uuid": "4dda7267-e8ff-48ad-bb23-a7d28b271001", "value": "12288:T36UPpolIFysADFNgHyC89OJXu+9BCd/1rf208+er5O:OUPpkMAD6Vd3Ba5fVor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617036231, "uuid": "cbdee72b-248b-4dac-9546-596eeb73cb59", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617036231, "uuid": "a918b8b4-813d-4523-acfb-4ca54045be49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617036231, "uuid": "1d1c8516-ba85-40b9-92fc-80359c79f16e", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c669ca-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616999894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999894, "uuid": "3a351156-db05-42f6-88df-8a02df798fc8", "comment": "Malware payload (RemcosRAT)", "value": "80c4c66aa03074c17d367dc1875448e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999894, "uuid": "4919a14b-7d28-46d2-9922-41c55a6285ed", "comment": "Malware payload (RemcosRAT)", "value": "d9b5613c82767ef51f5a918ec5e0c7ec646576038f0d0c28529ca1b0812321cb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999894, "uuid": "43965e19-3c92-4297-8294-6a0d14d1d46c", "comment": "Malware payload (RemcosRAT)", "value": "62d5231d3cb592a1ad9f442f94acc56de34fd71a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999894, "uuid": "c27d50a9-22d8-4841-a783-a401cd0798a7", "comment": "Malware payload (RemcosRAT)", "value": "8a3dab7583608aaa3b5598dc6505466b7984197070ef8266c1bb82f8c0ce0b27529f946fd01e86e4e997818d5ce7cefc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999894, "uuid": "819ed447-4fa8-418f-80b9-f73aa1ad53e4", "value": "753423E078C20C1AA81ABA6CC148D20F9157F57AE45A258BE81D99367F6D775C033CFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999894, "uuid": "d442a644-a77e-44e3-a1ee-4cb9e54fa260", "value": "6144:rDEWmMt7OJ8ZoUBgdWUhemnOiB1ZhoLX6OAy1gB:rwqiuoU65lzheqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999894, "uuid": "35c63e99-e5b7-4fae-af72-f83ed177cfaf", "value": 241310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999894, "uuid": "e1601cce-9dd2-4a7c-9f2c-0de3f9a0368f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999894, "uuid": "59c4bf32-c726-4e0f-9824-3cd787d6f648", "value": "neue Bestellung pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee90f4ce-9098-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617027207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027207, "uuid": "bfa55e5b-6175-4fce-b69e-b922c2cb6ad6", "comment": "Malware payload (AgentTesla)", "value": "d956fd601ea21172bad486408d6ab61f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027207, "uuid": "d37fcf14-f2b7-4ab0-9ab7-f4f18ce95166", "comment": "Malware payload (AgentTesla)", "value": "daa835004ba8c88d070d9553555c863372030fa67faab9c2937586f664002c3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027207, "uuid": "6bdcc6b3-ba77-455e-a2d6-17a2983e4a46", "comment": "Malware payload (AgentTesla)", "value": "60a72d2d4862587b975c8f41f2ece28d65d80311", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027207, "uuid": "cf42d3a7-1d4f-4165-a198-e7ce50498a00", "comment": "Malware payload (AgentTesla)", "value": "1dce7b71f5a6f64e987375001b9db3e0ad23d0719d3aa413e85c3e43e89ffac30ea02753c117a405d87b2732d56ca424", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027207, "uuid": "9921a59d-6afc-4452-bb2c-abcea67b47bb", "value": "D125C48C2D9AC1DAC6394B7842C9C4F946E95FF34F22887AB9C45FCBF431345E60A526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027207, "uuid": "a7494941-a0b0-44b6-896e-bcb84e6c4386", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027207, "uuid": "c1ba1a4e-6227-4e11-9913-b0a78a4fd4de", "value": "12288:IyK0BH9P9mLy2iNviTEBen26HMioCgBrl/6OQpS//6BLzTy:00BH9P94y1YTEBe2m9V2RSOQpC/8zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027207, "uuid": "6c309bd6-721c-4469-9af5-9484d66fd15f", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027207, "uuid": "7b51c6a5-bbda-4e87-a705-6a5e9b3b2fcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027207, "uuid": "5fa362a2-7535-4f4d-9899-c29000d579b0", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b49135-9072-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617010705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010705, "uuid": "87a433a3-d9e3-45d1-9ccd-197839510aae", "comment": "Malware payload (AgentTesla)", "value": "3e420784c0f1d677b3b068d904652378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010705, "uuid": "ba16ab65-bce5-4543-8bd9-212988a15370", "comment": "Malware payload (AgentTesla)", "value": "dbce8fe278a2c14f6e9d1db1d536d087da864d9870ee364dcb4c89322604729e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010705, "uuid": "38f11b91-62b4-48c1-bf1b-7fb7d30f24d8", "comment": "Malware payload (AgentTesla)", "value": "c0557454d87251735d2ffd1f8689af2f1b059d56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010705, "uuid": "94acb2d1-93d2-4aff-affc-9ab677a562fb", "comment": "Malware payload (AgentTesla)", "value": "71553df8bfdcf64dc123e263a469fe33ab0591d305ac0f8f78d45f42732f74e11e01e51d87d64c7a9521d63847977503", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010705, "uuid": "1ddb4d4a-153a-4964-8536-583708ec0f13", "value": "0925CF8836586D27C53C1DF060923A4483BD0D0635B9DBCAEECAB1D944FFB965923AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010705, "uuid": "f1b6d6cd-834f-43bc-acf7-89100d7d6973", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010705, "uuid": "bca5683b-2498-4aed-ba93-8dd48cfa4e7d", "value": "24576:Hca1LtnEkVItQrjKK/Z8SjYLASzHdKq3Wjr:Hca1LtnEkWKiK/Zdj/yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617010705, "uuid": "c677c3f1-2ffb-4ca1-a15e-f8bd7e9eede1", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617010705, "uuid": "d58285f5-6d6d-4795-8da2-8aa03fd1b140", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010705, "uuid": "dc7d9b8f-e6ba-4c58-a75e-f4b99c79ceee", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409fb726-9081-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617017037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017037, "uuid": "bee8715b-3d2a-4755-8131-81622ba2926b", "comment": "Malware payload (Dridex)", "value": "941bb7a3a23010aba331010d35ab28c7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017037, "uuid": "4eb9da41-ce8f-4830-b7bd-635b54cd9599", "comment": "Malware payload (Dridex)", "value": "dc06d5d5e1c1c0b07add79154c25941ad6bfe38068abc2c9dd5ed48fae232304", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017037, "uuid": "25f0fbdf-c15e-470b-b39d-003bf0f0bc36", "comment": "Malware payload (Dridex)", "value": "123e63e901b2688c86a009fa5b9be30899f65e4a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617017037, "uuid": "d0b32564-4c1b-4416-91dc-faaa0c50c1f4", "comment": "Malware payload (Dridex)", "value": "bc3791e42bc4a2ba3e0eee5f9487968cd5d38f18d40dce6b57da212cf054a28973ae26554ce196f5a63132356c3774a3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017037, "uuid": "7c9bda34-a7ff-4d5d-ac90-93644c7ed78a", "value": "6814AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017037, "uuid": "b7e13c6b-7b5b-410a-8809-9204541fcb26", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017037, "uuid": "b99fa66b-f239-4a97-8a8b-c722ac3f8e6b", "value": "3072:L1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ji78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617017037, "uuid": "fca4578c-2d19-41b4-bbfa-e71f96035cbd", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617017037, "uuid": "77ff02a4-3d8b-4a1f-b44e-bac62e7466a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617017037, "uuid": "66352079-1657-4fcc-963b-6091ebfc69d1", "value": "dc06d5d5e1c1c0b07add79154c25941ad6bfe38068abc2c9dd5ed48fae232304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbc23d6-907e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617015770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015770, "uuid": "5687c6fb-890e-4135-abe6-57ce5afb0d9c", "comment": "Malware payload (AgentTesla)", "value": "4e44591f41b6b7a2b396a46b89685c13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015770, "uuid": "3ea9f936-fd94-452a-b5ad-75351ca5b3c6", "comment": "Malware payload (AgentTesla)", "value": "dc4a2d855832f5fd64e9d17853060fa6e5a51aa2a2239208ab121dd022b7042a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015770, "uuid": "73bcafcd-aae5-4d11-bbcc-6c7a18b47eba", "comment": "Malware payload (AgentTesla)", "value": "5c47f5d67f73785b7f4515c213e92bcc673dc1ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015770, "uuid": "73a2fc0c-db25-408f-a71f-8725b3d9e09c", "comment": "Malware payload (AgentTesla)", "value": "11bf0bcef87192eedd82daabe1c2e9542e383979d12a1a5d26f8ea55e9c7f9c6444216a3d3cfc8a194d4f23eaff8e8f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015770, "uuid": "2458ae3c-c31a-4fbf-8d81-33591d74f98a", "value": "CDE423F40D35584C4A333BE14E20EEC2A84BE60969D635677199F17BCBEFA198E0C64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015770, "uuid": "f93a539f-809b-45d0-8f93-847fd7ccd3b5", "value": "12288:OGdB30asWwEvJ1LMms3Rf8LSpcVMYyV/gLqIdjINlkSPh:L35JEMSpyvyVYLqmjI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015770, "uuid": "d65da37d-c395-447f-aae7-7b51f0b6b50b", "value": 673516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015770, "uuid": "22ccd59a-36d8-4800-a582-b8a4bbd73933", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015770, "uuid": "948a3be9-d943-44c3-967a-a3ca9443854d", "value": "20210324000190100100.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5195066d-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028232, "uuid": "c8340abd-ee24-43b7-ba0c-c1019fb5ddf3", "comment": "Malware payload (Dridex)", "value": "c78473e1646a842df25a6b9ac646a3dc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028232, "uuid": "728e7649-76f6-4943-93c8-8f9879db8007", "comment": "Malware payload (Dridex)", "value": "dd42c6ffda5929a6ec56f678fcddae947e228efbadcad9db989f99cc67de6a8f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028232, "uuid": "648245a8-a7ca-43e0-a314-93d125db6b33", "comment": "Malware payload (Dridex)", "value": "2c76d659dc599ce1eec06a4d703dc56b9fed914a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028232, "uuid": "7d407564-2dfa-4a10-995f-17f1385c8953", "comment": "Malware payload (Dridex)", "value": "660c417dee202ea68287144933a010420065bfb5e078a81e1a9a367505e493a310017f5167402bc6c91add2da945416a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028232, "uuid": "fa6b9719-f0ac-4b40-afe2-0a92c167ef85", "value": "D914AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028232, "uuid": "8f7127a7-b202-4eeb-b16b-c44098f335ae", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028232, "uuid": "ed52d350-e5a9-4a0a-bab3-09bcaf29be44", "value": "3072:VpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:VBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028232, "uuid": "530774a7-2573-4d4c-9c6a-a717aff5f4e4", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028232, "uuid": "460dcfc9-cc6f-474b-b0bf-f6bf6a46e530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028232, "uuid": "5860b71b-9370-44b2-9bb5-97271089bb3d", "value": "dd42c6ffda5929a6ec56f678fcddae947e228efbadcad9db989f99cc67de6a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e8c9b0-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617025535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025535, "uuid": "b33a139d-8439-4dd0-b412-15163ca5e1c4", "comment": "Malware payload", "value": "e9680eff3916e657fe823a10464afb3a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025535, "uuid": "dc41f244-6964-4e01-adf2-341ef7195ef6", "comment": "Malware payload", "value": "dd53fc1f56138fd75e1daf631532f7086bfa823921d0503ed1a3425ef2f9eb77", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025535, "uuid": "19de1447-64d1-4e1f-8448-5926e4c61b5f", "comment": "Malware payload", "value": "67fb4b8738e2aa553a7b1cdbdf5768d22b67a82c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025535, "uuid": "c3314ca8-3f15-4980-8c5f-3f7b54af95a1", "comment": "Malware payload", "value": "9aa4fd2818045e9c9c56963bd0a46b89d40ba3dab55863d943a691394d7fa1978da1915160bef3207dba9aa8ec134333", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025535, "uuid": "dc1ea4cc-6fc0-4322-a98f-74fb45378558", "value": "0615AEBC76047DD6266F57ABDE96ACDC03B5276399CBA4C88068B7C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025535, "uuid": "46e8ce6d-8a21-4d56-8f91-08fa55e16bc6", "value": "24576:PwnV/93IgZ+9d1AWdyi92kUwrphO/pkqmZ1++1ljXZU:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025535, "uuid": "ea2e723e-1cca-485c-9e0a-05bab31a8000", "value": 933838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025535, "uuid": "ee4ccebb-b192-458d-996d-10ccc243de8a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025535, "uuid": "240a3593-0a06-4448-afbb-fb12c54184a3", "value": "RFQ Order Ref No. SUS307.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52436c87-9053-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616997310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997310, "uuid": "dc729d53-4753-4a23-b7e8-fbab1b9f2c91", "comment": "Malware payload (AgentTesla)", "value": "b66365afd38a11dc88d4e47aacfc881b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997310, "uuid": "2187ecbc-1fb5-4686-b03e-31daf3b0ab60", "comment": "Malware payload (AgentTesla)", "value": "dd62efa467c02276265a311a706552638d472b7d824698d63a1f2bda11a23279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997310, "uuid": "4ffd6afb-571d-4862-8976-d3d986d50a4b", "comment": "Malware payload (AgentTesla)", "value": "bc8769d4c98649c5f7c5969574783bdae5d8780f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997310, "uuid": "7e6eaf09-60b4-47ca-9b2d-414054f6631c", "comment": "Malware payload (AgentTesla)", "value": "4e7771a2469910249be8592869cc30f8ed0b7caecfbaa9ddb0d15bdf643d5a3c4b6e3f232bf4598fff17f1549eadc8b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997310, "uuid": "c783d7f1-ec40-4bfa-b269-99c222452b19", "value": "3C04AFB875047CD5266F526BDE96BDDD03A62A2399CFA8CC8078B7C305A3375FE02845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997310, "uuid": "1e6ded57-0fe0-4c59-be9c-114a0e536871", "value": "3072:zjcQ1hJOXL6vG8vU3LVaGCCtat3hZfTwEMvw5NT10QOp7yLCf8tIhpwMvPbA29pU:zw5XLC0Lx+3hZETy0y2f8KnwMbA2XPON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997310, "uuid": "63120f17-4087-436e-adfd-893094290a87", "value": 180759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997310, "uuid": "9343f819-a05f-464b-b9eb-f5e4b9b226f5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997310, "uuid": "118f9e79-58dd-4cd9-ad42-7491cc191bf2", "value": "OUTSTANDING INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefd9e9d-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040415, "uuid": "96855458-a3e0-4d1e-9967-26982de67336", "comment": "Malware payload (Dridex)", "value": "d663349d82ef0b66b2ce9cc81df6f7c9", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040415, "uuid": "a3d81690-b1d2-4b97-b422-c9d5746b29b1", "comment": "Malware payload (Dridex)", "value": "def63a88c368177bb18a00b2c15f0cb1a007d7acc9fb03bd7cc15b9cb3c61d16", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040415, "uuid": "2375f146-9f68-4404-946d-e075db45f21a", "comment": "Malware payload (Dridex)", "value": "7dd7cd983d98c94bb990be86b9aa3650e739575c", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040415, "uuid": "b23e550c-0836-45c6-90b1-4a8f17917ee9", "comment": "Malware payload (Dridex)", "value": "89f5aceb518459c425b89b6b8845675a5d2bcf7652decb9eab40fe7e14ac8865dbba124c9dd7b285847f03dd44682ea3", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040415, "uuid": "e7495216-3da7-4b57-9117-536a83e7fd27", "value": "C5C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040415, "uuid": "9b4c19e1-ecfd-4daa-bc63-883dadc478b5", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040415, "uuid": "fd87ab87-08d1-4407-b08b-001d6fa29ca3", "value": "12288:Pt+D1yz/1SXpqDaoWmAsF1Hk3eBWIcpd:PcA1aLoBX0eBjcpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040415, "uuid": "7053db03-df83-4ab0-9c87-4ac26c0bfa73", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040415, "uuid": "2703c209-288c-4e0c-ac86-ef2096c83d03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040415, "uuid": "9823069d-e1ea-447a-933e-737c38c5d335", "value": "def63a88c368177bb18a00b2c15f0cb1a007d7acc9fb03bd7cc15b9cb3c61d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97aa407b-9051-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996567, "uuid": "246f39be-615e-4e6d-bcb5-ddc27786f662", "comment": "Malware payload (AgentTesla)", "value": "49e563ab7ad98004e63cd2d3c7003ee9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996567, "uuid": "25d33475-24d6-40da-aece-02a3cbd04b88", "comment": "Malware payload (AgentTesla)", "value": "df15ad6bff46f0bfb7d9edd97ab6b0ed3c4bb9e3d49ffc0f534c99b75f23ec8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996567, "uuid": "9f0c66bf-ff2a-4d59-9d21-6217acfe690b", "comment": "Malware payload (AgentTesla)", "value": "066e65f4f19824743dc404d9c12d30dc2bb82431", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996567, "uuid": "2ac70175-9a7d-48e6-9331-991956a05e47", "comment": "Malware payload (AgentTesla)", "value": "c80b802548887cfe32abdf69e1d06fd5910147e0fb6b4e1dcc9ab6ddf065fce824fd66e1a7255852bc54f5a08054aa77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996567, "uuid": "62c88f11-a315-4644-bef6-b93d7f574a7d", "value": "C394234A9ADBD876945CA5AA63670D5B0FA28F0413F347A8354B40FF9E7C9C21C9ACC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996567, "uuid": "cddd6702-8d9e-4322-b3b5-e09ede809da0", "value": "6144:XwMY9ODTT67ZW1ucBohqtUG74krZJ7U6cpeP+CUirov0/pYgJ/x+nt0xg4VpQVo7:XwM5T67+o9ktJUdePAYofgDmOL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996567, "uuid": "6546bba3-ce2f-4c94-9731-d21c88fb0659", "value": 420298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996567, "uuid": "8d5999f4-0e86-4c5d-8d27-0bdb354cede2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996567, "uuid": "91c3a205-28b3-4bbe-914d-bd5ba3852981", "value": "QUOTATION 03-28-2021.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828ae71e-90a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617033039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033039, "uuid": "da9e86af-3b43-43f1-a377-66a374f35751", "comment": "Malware payload (IcedID)", "value": "c32bc33c63c34fe7a853c84a77999dce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033039, "uuid": "b5a40b2d-2fac-4002-a209-4f0fcb94bb23", "comment": "Malware payload (IcedID)", "value": "df8780cff5e2c8bf3105c53a0ea7375308b6131646636cda83bc29fbf5da859f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033039, "uuid": "8c44a6ea-b5af-4d99-9bda-0f67c7e51a14", "comment": "Malware payload (IcedID)", "value": "8e807b86a88056e5fe0a54301684b44c4a744c3d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033039, "uuid": "32c81d95-7acf-4b1f-8117-d97463c9b7f2", "comment": "Malware payload (IcedID)", "value": "9efba1d89521f178536c770a791235491f53e5c1132f2d749ad8b470e282189dd3c256547ad0582c746c9b1005ae7846", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033039, "uuid": "29297e7d-fb9d-4e11-ad0b-377f8ced8c40", "value": "79133CCA55700F23CA311AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033039, "uuid": "c2aca69b-b29b-4155-be00-e624a74a41fa", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtB4xEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtB7sc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033039, "uuid": "4801e29e-b8bc-403d-aef7-34ce2d94f1ae", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033039, "uuid": "cf67b611-08c6-409a-928d-efe4470b8b0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033039, "uuid": "057b82df-13e5-4a3f-a21d-41cf6e07ba66", "value": "c32bc33c63c34fe7a853c84a77999dce.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0017632c-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031532, "uuid": "e43d5e4f-bf57-4184-af0b-6b487b994475", "comment": "Malware payload (IcedID)", "value": "361717f736eb9aa17ae42de1b6d80606", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031532, "uuid": "d6aba638-030f-404e-a762-fc7068da2017", "comment": "Malware payload (IcedID)", "value": "e01d84cad44054e251e0978da7be67e56975701ec7e433cd1864b343a081a33b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031532, "uuid": "e9fded4f-d114-4b37-95b9-0ce32c49bcbd", "comment": "Malware payload (IcedID)", "value": "02f174dcb7e9e41c661985b0fc171109090895c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031532, "uuid": "86f69426-4079-434c-8093-a3210a8bf441", "comment": "Malware payload (IcedID)", "value": "25b2aad4744c49457e83b3cbdd3251b8fd418376a682b91c7dc3db66f34c98e0e93e1dc1e970e11084b6704baf4b036b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031532, "uuid": "846328f3-71b7-4611-9d0a-a522a22f66e9", "value": "E8A4F71AD6380BBDC512E879C517A433E1713C2502E889BB92E467776F32768FD6E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031532, "uuid": "8b44e744-4475-4165-888d-10660cbd283b", "value": "896f4618011fc8c614eb9c9053bf51a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031532, "uuid": "50298138-59d9-499c-81b4-13f3d1fbed46", "value": "6144:7uvnWwlxWgg8x/V/f1VK2+3uGWppAPFXYcaUohGtfJTzYJwa:7u5g8x5K2+R4APGRUoOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031532, "uuid": "9a72a62a-fece-4ea0-a061-c48226e1bcd4", "value": 483455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031532, "uuid": "0b84b63a-ac4f-47ad-b2a5-d207f31238ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031532, "uuid": "3e3d4fc4-356f-4cba-ae79-9238c366239d", "value": "e01d84cad44054e251e0978da7be67e56975701ec7e43.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433aa3fa-9088-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617020048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020048, "uuid": "a86c5a10-63d2-4ec8-af57-ca790d8a4b36", "comment": "Malware payload (Loki)", "value": "60fdd7fbbc8f049e835f4e8a3eeac127", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020048, "uuid": "17410fc0-b75d-4de0-b60a-ebb7bb371f57", "comment": "Malware payload (Loki)", "value": "e027e73c669d75c03155f57d9456a7d5e0e2b06df4cbebf3a7d63421d8f465c5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020048, "uuid": "2b1211e3-fea3-44f7-9558-133d7deb7a83", "comment": "Malware payload (Loki)", "value": "099bbdf0145da11c33e6f6f7543e3297b0c5e887", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617020048, "uuid": "51a2a325-468c-4bc7-9e74-e377f111b397", "comment": "Malware payload (Loki)", "value": "c34f9be451e6a071c2caa32a97fbe407efb3bfe126e3ed600f55feb4054e856dc08a8eda71f2f609a02cd3cfd6ea937b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020048, "uuid": "e8c7a061-67d2-4615-8b3c-10124cce4e83", "value": "46E42389AECD561F7F1E108FC850368353F730DC2AF059A5C0B9D4A4DAB9E939098AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020048, "uuid": "29016c30-e937-403c-910f-b1896519c5cc", "value": "12288:Ufdh/3ACizFI2IUOO2TZl0GskiIjOj9vIBTHXgZsHADtnKJj1K8dWc3g05IGiqj:UfnPAPFTIV70GsT5ZmTwCHAxKJj1K8pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617020048, "uuid": "99bcc19c-ff28-43f8-a554-355d43d2f30e", "value": 664367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617020048, "uuid": "388bf400-a0c7-447a-b3a4-1d5616f52dd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617020048, "uuid": "fe100dea-87dd-441b-b5e7-70ff4eb44c69", "value": "REQUEST FOR QUOTATION RFQ LIST.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e23057-9075-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617012044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012044, "uuid": "c3b860a0-2050-4593-9fc9-b0658089212f", "comment": "Malware payload (Loki)", "value": "e4442ff64c61eefbfdcf938fb1784f21", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012044, "uuid": "756f84f9-a625-4fbb-8a30-f97bf7528fe2", "comment": "Malware payload (Loki)", "value": "e0bd3abe86848025e8974448991e092550a0a59104d1f4279bef827193b33c05", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012044, "uuid": "80b5084d-5a27-47cb-931b-10ad19ba7678", "comment": "Malware payload (Loki)", "value": "98498350bdfb62e6ccd765874d73e67be5e2cb6e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012044, "uuid": "feb44146-4dad-4317-9113-47cf74c9b0e0", "comment": "Malware payload (Loki)", "value": "5782ab3d2a1ccb67290b8c61e7e02c1d60b74e0a4b094c97444805097ecb7ad77709638874761c0393abdbc8ad255753", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012044, "uuid": "8ca57bff-f0bb-4a20-9592-8ef405752cba", "value": "21D43391FF9B768EAD4884376852D70FA949C37D051824CA4C97A67FBB29C8BF1074E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012044, "uuid": "bd81d1aa-db96-4e8e-bfbc-16cfa2991e19", "value": "12288:IOg8j/Qi7qDDqWA8SnF+6r4K1mHf615zdCz9fmyShvmEp6SGK5Nwqq:XjT7qDpEF1r4K1THRCz9fpxSR5er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012044, "uuid": "fe3fea47-6f0e-41a6-a847-e3f54eab3f98", "value": 640046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012044, "uuid": "9dbe93cd-eb75-40a4-92d8-b59db42b5b01", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012044, "uuid": "abda9478-874d-43ca-8017-8b7794c66cf9", "value": "Order Confirmation-SA-NQAW12-NC9W03-doc.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f88377d-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "bf14e70d-5a11-47ad-b83f-0e441e01f0d3", "comment": "Malware payload (Dridex)", "value": "d87b090f055aa59f53fb9b277e04a865", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "124a5b98-65cf-4838-8cb9-71b4f7cbce4a", "comment": "Malware payload (Dridex)", "value": "e2ec81465f8a16fda578393d88d2e9446b97f6b0b458739b73e9efbf44380ef2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "8c38e477-532a-4ec9-b683-fd3efe14468c", "comment": "Malware payload (Dridex)", "value": "d3504552d70d13c79c11850780589f33406baa0d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028175, "uuid": "17fde24f-d252-49e9-a2c0-49b5a0e7e57f", "comment": "Malware payload (Dridex)", "value": "1032235f643a07fcbf9205fa3f774dbf00d20bfe0e0b582b1921cdd2b2c2db13ae9fe942a8eec6bd796b28acf57abc4f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "a11e6eec-446d-4f44-93eb-a511509fe74f", "value": "4214AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "3152299f-f1e9-4638-a779-bb80948d6345", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "4fc1a6aa-ee82-41f3-a1ec-8391150710ce", "value": "3072:MpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:MBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028175, "uuid": "97b39774-3f38-4bf6-b8a2-bf2c37140603", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028175, "uuid": "cb51a121-e600-4f3b-9edf-539bea9f1aef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028175, "uuid": "1f507413-cc77-400c-ae55-6cfb2e263ecd", "value": "e2ec81465f8a16fda578393d88d2e9446b97f6b0b458739b73e9efbf44380ef2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce978a8-90b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617038130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038130, "uuid": "d09dc171-89a6-47de-be39-d013becb4979", "comment": "Malware payload", "value": "4de0e1ccb70d6eea1bcbc9f563faf6b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038130, "uuid": "6757eee2-1f21-4d7f-a174-c9bdf5014b94", "comment": "Malware payload", "value": "e30ec6d2e72be61d41536b1dd264e4b76cbed32a030dc565b2123183c1bd65b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038130, "uuid": "7fcca3d1-b5d4-4610-8c0c-d88e2997f451", "comment": "Malware payload", "value": "b17ae84c773eaed73b9e22677551002c1f7c9df6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617038130, "uuid": "b0c91011-e89d-4203-85a6-a89cbb8b2cc3", "comment": "Malware payload", "value": "7f7c33b60fcd346893847ffc4370c1cf9c9d0b62ddd3726a97311855a1418cd7dd077102bef44986ac2d182dfb497ae6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038130, "uuid": "c6bbcee8-3373-4b54-9e73-2a9bf3d3b6b0", "value": "00E42309FBBBE8141D4D16925182A8E7E98BB4F93C074B6079B52BD5F4F9AC0F48D027", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038130, "uuid": "7ea23e86-7b36-4533-a60a-b103a1bb646f", "value": "12288:telSd+5Lm5GT+RCKK8WfwH2UhCax8YE/lHz4fkxM+6R+lG:Hd+4o+pKQptxsBZ56R+lG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617038130, "uuid": "023e2b7c-6a4b-46f6-8b6c-15040382e1fe", "value": 669254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617038130, "uuid": "97e9cf39-5709-48a1-a0c9-2c2d295f1555", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617038130, "uuid": "d0efba3c-5134-4a69-8e38-7177724eab38", "value": "NEW MODEL 34567765432.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066beace-907c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617014792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014792, "uuid": "56a79bb2-01ae-4928-be40-b2dff17662e5", "comment": "Malware payload (SnakeKeylogger)", "value": "9576035dc98cca6a6e6eb65e8b76e05e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014792, "uuid": "2533b884-5dfa-44d2-9c6e-d45f02d55646", "comment": "Malware payload (SnakeKeylogger)", "value": "e318ddbe84aaf358a8de0f591a877e6b1ac2e474cdc84a07e40391fcc2ea058c", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014792, "uuid": "07011d18-ae21-41ef-9954-b616b41ae863", "comment": "Malware payload (SnakeKeylogger)", "value": "fe2456f5794808d429a80e31f547c8ab6c6c9cd3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617014792, "uuid": "46f9b342-2f0d-425b-bd9b-dab549b1dc6e", "comment": "Malware payload (SnakeKeylogger)", "value": "8866b194a9dbe48183c32443c0cbdf0b99cdfc6015d5dacb780954fc9591f8df168682f9afa35fe19d7d3a33742fcef7", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014792, "uuid": "3246842b-ea29-4479-900c-73e5604dbc8c", "value": "7335188C9D9AC1CAC5750BB842DEC9EA46EA5FF30F22987AB5C857C7C432341F50A536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014792, "uuid": "995e9f35-efde-4b33-95ae-53a0e603702e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014792, "uuid": "2b700f6c-7460-4a86-ac15-32fb7e4dbbd9", "value": "24576:1xgucQSbp/WTd4NiUkVQ6n8Ca9rAjQ3dIXUYg:L4wd4NcWn90jQ3e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617014792, "uuid": "84fe4ffa-6d72-44e1-a095-b7f4f4a15cb3", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617014792, "uuid": "582bd3e9-5f00-4f96-a9cd-5a6a29f7a0b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617014792, "uuid": "d6985c3f-650c-43ba-9249-261037e67879", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b11e42-9098-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617026957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026957, "uuid": "78d95f32-1cf8-407e-a5d3-f41f75cb9bc0", "comment": "Malware payload (AgentTesla)", "value": "8b9f23529370807d6ed530da0cf600da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026957, "uuid": "4b096937-2dfb-412f-9341-eb109483f391", "comment": "Malware payload (AgentTesla)", "value": "e32b7bf0600fbe7eb6532a38497d019b4d6833510641dfbf1d960c7702cecee9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026957, "uuid": "ece2f26c-93a0-416e-8964-7344210b3870", "comment": "Malware payload (AgentTesla)", "value": "06fc0cebbf7a6625d9b1e82feafe51d9f8cb09db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026957, "uuid": "0d70f50c-c7b1-4c05-9c94-ffe028ae0088", "comment": "Malware payload (AgentTesla)", "value": "1fa49609fb99c6ead4b04c1464ffbd315038a74443ee1c2bde8a18cf1f45a5d0bc879819d7328d1c013dad77c7b1269b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026957, "uuid": "88d83e30-7d3b-4906-a7e5-8da34985ad8a", "value": "DB2419166715D560CB5F417FC01A820831F1DB07972AD38F5AA6D8FA2F812CEF92B9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026957, "uuid": "cf2a6989-a7c0-49ea-8231-8e589541f00b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026957, "uuid": "7749a97e-7123-4c5c-bee4-438a186a3bd3", "value": "3072:S9WPm0NqgwONqk3MqUsE3aZWc+7AoOcYeInZ5lTG0h9mhHAAc72OeG/lXtUbiV:SNONtrUuZN+0hL5lV9agAc72VGd9Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617026957, "uuid": "92ca0576-0b16-4500-a1a3-0f56617dfaa6", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617026957, "uuid": "294f8b84-4314-4bee-873b-3e5db38e3d13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026957, "uuid": "1aef8847-8853-4479-8435-4414908abf1e", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdd1f37-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "585bf1c6-77c3-49b6-8312-21cccfb71cfa", "comment": "Malware payload (Dridex)", "value": "82871713dcfdc8f8cc4f7902c6a7c8c4", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "c84d6bc5-eabb-48c3-b85d-d836790ee438", "comment": "Malware payload (Dridex)", "value": "e36ea94c75f7b7aab1e2f425759305bb1d07d73e6455c23956e97b13b9475ba9", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "927025ac-2bfc-4780-8fa9-7506dd0f388e", "comment": "Malware payload (Dridex)", "value": "cf0dbd110e34037e1d35246e614a037d9e42182f", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040410, "uuid": "736a270c-b7f6-4e57-8ee3-2b963a3ac135", "comment": "Malware payload (Dridex)", "value": "ebfc943653ee84b4bc1db4ee3cdaed3884af9f6e2b6dbd625ba0b905c34cac5f3976237150972ab623d9a6156c12970e", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "2a1e7e0a-5065-4bce-8f12-5862031cc284", "value": "1CC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "87c330b5-6e9c-4ae5-817d-1927a50807f6", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "6d29585d-4ebd-431e-b583-343a6eb5d690", "value": "12288:Mt+D1yz/1SXpqDaoWmNsFRHk3eBWIcWd:McA1aLoB+4eBjcWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040410, "uuid": "93938f82-cf5c-4412-9349-7304631581f1", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040410, "uuid": "a73fbf2c-eec4-455a-b9e6-5fc8f53411e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040410, "uuid": "d83cb4dd-1a57-4144-8a27-76d7a7e493db", "value": "e36ea94c75f7b7aab1e2f425759305bb1d07d73e6455c23956e97b13b9475ba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fffd1d6-90bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617042376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042376, "uuid": "9b8146ae-62c5-4893-813e-479b95a7c8d1", "comment": "Malware payload (RedLineStealer)", "value": "047ac6dbf6b978eb9d2b3696083facb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042376, "uuid": "38301a23-e7f6-4dd7-b933-48ef00ca0f2a", "comment": "Malware payload (RedLineStealer)", "value": "e3ca616249de36f3eda6f214ba9d2840a74cb77aafc6ca56c480ad7bc331670b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042376, "uuid": "c1cf521c-c0b5-43d4-a368-46652af7c02e", "comment": "Malware payload (RedLineStealer)", "value": "e207965e799fd7e71d684f6b274530e845bce76a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042376, "uuid": "6d951998-0965-472c-a7f7-73b64ff9fa00", "comment": "Malware payload (RedLineStealer)", "value": "350f02da3744d4372e8a68055dd9b841749ddbe1ba3f941dc20ea5defc8e2b44a88f884a7d5f16bda58b1ad7d92aa670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042376, "uuid": "9d7deb28-7f43-44e6-8343-3430db8146b0", "value": "8A346C1C2784CA1DE5BE073DE9B11214C330A14BF565D79B6FC190DCEF22B4AAD296B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042376, "uuid": "7a527083-9585-4d7a-aff5-55750665b445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042376, "uuid": "1cecf038-8017-4562-a1d6-c1ff917a3658", "value": "3072:uA8hig94Pcc4kSE1tprVxrJrQKtED6+2oO5pp4lEbJ5fGz0D8OblZs:u1ig94P14kSEhJ0Kf5pilEbTGo1blZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042376, "uuid": "8c26dd6f-8bfd-492b-ad76-313d686f276a", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042376, "uuid": "6f9e2b8d-c349-47db-b0ab-d046dc87c344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042376, "uuid": "e401ce90-a5f0-4d74-bcef-2c63bf003020", "value": "047ac6dbf6b978eb9d2b3696083facb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0ecf79-907e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617015961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015961, "uuid": "013c36bb-5135-48f8-95b1-8edce8fa09a6", "comment": "Malware payload", "value": "f77e56a9f06a7c9d5cf21a0a7ecb15dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015961, "uuid": "387306f4-c823-4d2b-917c-aaa2394a6de9", "comment": "Malware payload", "value": "e406c368b5812a8b8b3ca89cf7104bd246bef81e20284a33a19dfa4714f317ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015961, "uuid": "438a5d73-65ce-43c1-ae1e-711504771b96", "comment": "Malware payload", "value": "6aca6659b9198d2543e8e3ba388616424b782ac1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015961, "uuid": "f09a404d-88dc-43b1-91d5-772b2461568b", "comment": "Malware payload", "value": "111939e955a50fe1c4aa48908bfda8a23b0fca436636a0cba93264350e83931b625a682fb35a546daa3990e9a629c089", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015961, "uuid": "c8ff8bff-6217-4ebd-a935-00b8c73e07d2", "value": "D09502C01F4E6161DB72226857D8B39EA397F42893D3A90CB9CFD67D13BB114D866832", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015961, "uuid": "7157d536-4b45-4c49-9564-56ffed810706", "value": "12288:+2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2Q2So34PW:v34PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015961, "uuid": "cda7b494-981e-4f8a-80d4-81aea74b8e43", "value": 2014621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015961, "uuid": "695ed8c9-df53-49c1-ad4a-a66143dcda6a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015961, "uuid": "8a1c92b3-7d4e-4e9d-b23a-91ec7ae9dab3", "value": "Order Inqury-93-23-20.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff79fd0-9064-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617004500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004500, "uuid": "287b3a95-543f-409e-aa0f-39ea57373702", "comment": "Malware payload (Formbook)", "value": "e4c460102817ef8c49137d73aa98a21c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004500, "uuid": "0c656309-fb34-40ee-88c0-60a0968591bb", "comment": "Malware payload (Formbook)", "value": "e4787361abf9410a78aaf433095fb9c6086f4b6bf844a478645a7b4c9fa7cd1c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004500, "uuid": "62f0ff33-0c51-447f-81bf-f93149c232df", "comment": "Malware payload (Formbook)", "value": "ae79eab84ba058337ce086948cce77c96caa2ef5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004500, "uuid": "022b96a6-6a63-4a29-aaa1-5fb48e951a9d", "comment": "Malware payload (Formbook)", "value": "c6e8bb89649a64a0ca1ff33caa34d715225cc2f3bf5bfb020c7720b109bb1334064a064b3f25cd3ffe06a2981143139b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004500, "uuid": "0463d552-1826-4d7f-a409-e21de090ec91", "value": "D31423AF9B2057177E22F0E3FCDD0168E45A8011E26AB065B79E8C5776C12480EB736F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004500, "uuid": "c8849a0c-8ea5-4436-b9c3-d8258db1ac3d", "value": "6144:VO7Nm0SaS7zEAhT0QjAw5GZRda/Uh0j+S3:VoNbSJQAF0hw5WejL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004500, "uuid": "635663f5-163b-48b1-81f3-a8f7571b0a7b", "value": 197988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004500, "uuid": "9eab8704-fb1e-498e-a9c8-4442536bddd5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004500, "uuid": "97050090-fce7-40fd-afca-d05640f16412", "value": "salescontractv2draft.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91fc934-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996194, "uuid": "a1e7c474-468e-48a1-967a-947f84746414", "comment": "Malware payload (AgentTesla)", "value": "63de51ef0f885215d6d6544676ee5883", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996194, "uuid": "0a3dd303-1104-4c83-9d22-7bf888e24812", "comment": "Malware payload (AgentTesla)", "value": "e4c37c77632e0ac493520a7c4dc3f56cd22a5b40e51f890643544f1044803c10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996194, "uuid": "4b231bce-5474-49f5-b234-3a5e2d889dee", "comment": "Malware payload (AgentTesla)", "value": "21ff5359985c033e9ddbff394d9b15b315da9d31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996194, "uuid": "2b4fdb47-5fbd-401c-b1e9-7442b027026d", "comment": "Malware payload (AgentTesla)", "value": "3374036d8a512b64bb6aabb72ffdbbb22221be8b1bf4cef6ef5df921c6b98769a363f257176148a470b69db7e6a43e66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996194, "uuid": "df7863f9-35bb-426c-946c-5d0a9fad0ada", "value": "38F423F8861C2CBFDB6449389EC0F292B6F5AE0E6329C67D9A12D076C5F1075721E2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996194, "uuid": "3e51f409-fede-40e6-a3e0-b11ead039853", "value": "12288:pMYnbV4oZW9LgWWYDIB/9eyp+DZv8SmW6Xnva/FcB6otOk38:WY6oZbLqcgmfW+MotK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996194, "uuid": "c65508e8-d28e-478a-ac72-4693b81a72c1", "value": 731103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996194, "uuid": "43e81f5c-174b-463b-aa1e-5dcc12b7ed55", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996194, "uuid": "aacd3941-4250-4588-9e97-8323bdf2ae50", "value": "payment advice, EUR 61,676.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae6faac-9092-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617024356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024356, "uuid": "bbe6219e-077e-42f2-8a23-7657601275a7", "comment": "Malware payload (Formbook)", "value": "0148e679ae558bb19d675e10ea7bbb8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024356, "uuid": "de7f2685-f083-48b0-a3a4-330c8febcad1", "comment": "Malware payload (Formbook)", "value": "e65caef5b39ea27f95b2514c5d347df7a6e50e8d3886b2112b5db266769fcc71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024356, "uuid": "7c05a40c-ea02-46b5-aa3c-d7fe95765537", "comment": "Malware payload (Formbook)", "value": "a8c2fcbc407a5501d9daf852ab8434405a7c3c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024356, "uuid": "8e2a66b1-4241-4a74-8ccf-8d1385bec40d", "comment": "Malware payload (Formbook)", "value": "2f1ecc0a36d0b161b5dd52427cb6a5a5dc50c4eb09e04b45a898028429d7e27606fc55977d0d2672b3269ccb0247a4a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024356, "uuid": "e5451b53-70ba-46ee-a112-ec81bea7d7be", "value": "1E945985E98465A4DD19AB706A37CD3592237EFCA838941D29DE3E273FFB2D35026013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024356, "uuid": "f53d1a6d-52c7-47e6-a798-3ee722acd655", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024356, "uuid": "febd49d5-7037-4311-ab03-ee803ede2951", "value": "12288:GP7r9r/+ppppppppppppppppppppppppppppp0GbpyomrWKi5W1zUjYjrIYmjKS4:G1qkomqKicVUjYY92AVG6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024356, "uuid": "0dd3d885-56ef-4241-b835-9fe1246fa248", "value": 433122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024356, "uuid": "38f8e10c-4369-4063-9a00-f70f0503245b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024356, "uuid": "2d307c28-e314-48fd-9204-7d1fa1b883b0", "value": "Item List_11-03292021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee84b73-9059-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616999827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999827, "uuid": "f3e45cf4-0bc7-4b1c-8f19-cb7701138265", "comment": "Malware payload (AgentTesla)", "value": "ddece8e411a27c8511d7acc1f0002c0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999827, "uuid": "d281efc3-f8e4-4f74-b111-4e7b6c6b7e46", "comment": "Malware payload (AgentTesla)", "value": "e662cf42ad68f990971d60274c796013df8adadcf2743debd7e3e21c4400f949", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999827, "uuid": "9f263ca0-137f-4b9b-b167-6e2533ff256c", "comment": "Malware payload (AgentTesla)", "value": "ad707517ad2648ba9121a74ffdaa9b62169284bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616999827, "uuid": "268a0c5f-98d9-4682-9cf6-05fb56b4f824", "comment": "Malware payload (AgentTesla)", "value": "c51519c5b3fa5f8802d87382ec5297abf48020013e05ca3b8f5381e9f4aa698ce0b931f2c3733d15857244714aa07d25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999827, "uuid": "211d8869-6fb5-4499-8b81-072009a997eb", "value": "6EF4F13623A54B61E03E933D0438518453F6F605E732DA6E7EBF55CA5E71F8806B2B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999827, "uuid": "d042b6a9-db43-4662-b49a-0450cf987b9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999827, "uuid": "a453423e-bfc9-4f1e-b441-d7da4a40585d", "value": "12288:y4niO5yvAioJexddHA4RMbT+N6nt6Wr/OJp2E1uriu6WUYBf1ZQ:li9obgdHleT+N6t6W7I2oGJKij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616999827, "uuid": "74865f0e-644b-4ea0-8993-c3808159b669", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616999827, "uuid": "2a9b0a51-f683-4435-93c2-85ba5e6d901f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616999827, "uuid": "85d8bdd9-51da-4e02-9e57-f2526fe86a34", "value": "SRESTKM-series.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3db14f7-90db-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617055965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617055965, "uuid": "0beb62c7-6c4d-47dc-8bd1-996c86b43c2c", "comment": "Malware payload", "value": "fffe6598ef44800ce8638cf26a52c2e7", "object_relation": "md5", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617055965, "uuid": "9ddc38b8-64f5-4442-8d16-c2ff87657f36", "comment": "Malware payload", "value": "e6ae6ab9dd86575ba3cf68e949e90204caa3c378cd3ed0a03b29c6cd2e6f240a", "object_relation": "sha256", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617055965, "uuid": "0f5c62d1-0f48-464b-b92c-16567c636f05", "comment": "Malware payload", "value": "08cd5e37f0174bea4edcd9d82066a36245723d5a", "object_relation": "sha1", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617055965, "uuid": "cb5013fd-d6ff-4d27-bcac-82a5118c9228", "comment": "Malware payload", "value": "5a06a8b75af0686c23d630ea2262728e265df10ba94a144e7d6b2f3e191cf42dd1ce2099603268b6af1670b4d4cf50c7", "object_relation": "sha3-384", "Tag": [ { "name": "5566", "colour": "#E9D45E", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617055965, "uuid": "5e7a8145-a323-4e5d-b709-df3af6a6743e", "value": "F0B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617055965, "uuid": "84853df8-bb73-4c06-83bb-0a38859de71c", "value": "3072:226TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:2LTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617055965, "uuid": "8b76501a-e5b6-40af-878b-a26a26e0015f", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617055965, "uuid": "b4246bfd-4928-4f99-ac1d-6d05e7e1d141", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617055965, "uuid": "2fcdd533-c655-4001-90e9-b34103dfa98c", "value": "document-2112297424.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115809c1-90a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617033708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033708, "uuid": "fb48bf6c-e4c9-43b2-a6a6-94de0aec3eff", "comment": "Malware payload (AgentTesla)", "value": "8077de1fbc32999d0338e9bfcb1a8635", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033708, "uuid": "12450899-a4a9-4465-8239-c742d4ff1482", "comment": "Malware payload (AgentTesla)", "value": "e70284cc39380d172a8837a0fed2f3c2947f80d10e26b96cfa46a60584e3dab6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033708, "uuid": "5ccb474d-5666-48af-bed3-22983b2445ea", "comment": "Malware payload (AgentTesla)", "value": "810e99f8800b38d0f60a7ce9cdc6856603c9b407", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033708, "uuid": "5e5db17f-1409-403d-a364-1c76c12722be", "comment": "Malware payload (AgentTesla)", "value": "a78df8f992132aba9010967d82be38e5c3bffe41da128273f807220129983c774ee7cf1ca078df22507951d4c3c61c4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033708, "uuid": "af34cf79-2984-40c6-823d-852779e4ec21", "value": "2205333EF10D4EAAFDAB2A45C06188DED47A052DEFBB205EA410F276D3BF0A45171971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033708, "uuid": "0b3e28ba-34ed-4a82-b7fc-8a0769ea631a", "value": "12288:abOXMuy7N+hFuNpVizISzsrTv25Grynt6bGTAzfzV7IRKfeJYR6LKgTMascIkd+7:abVxizIS2kEbGEfV90YRaKgAYD8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033708, "uuid": "ad6aa945-d205-46c2-b164-1c61d6e8ce8d", "value": 869240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033708, "uuid": "a4445627-0ed7-49c2-b198-da48045d15cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033708, "uuid": "d9680bfe-9dd0-4f16-bf28-d28cee412c87", "value": "PURCHASE ORDER COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f04237-9067-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617005872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005872, "uuid": "655ee1a6-210b-405e-974f-2c3955cacb2f", "comment": "Malware payload", "value": "584390dc2e152c9145d0af6f1be7729a", "object_relation": "md5", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005872, "uuid": "9354255d-5927-477c-8b24-44a3f6374bc5", "comment": "Malware payload", "value": "e85230a1b9b9c364056b1a2674cb85304cceb0769c6897a45ee498984973da8c", "object_relation": "sha256", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005872, "uuid": "84d7f18e-7655-47ac-999c-0aa339032fdb", "comment": "Malware payload", "value": "a20b104a011d1faeb6c285356db44a6287b49487", "object_relation": "sha1", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617005872, "uuid": "05b20426-75d6-4ffe-a04b-f135d6e277b0", "comment": "Malware payload", "value": "1b5d165799ee703d1787f1f1ed517613c1bb674c2e501c6bd194183edfd7aa48504d596cb34f80766d09a9d0b3b75318", "object_relation": "sha3-384", "Tag": [ { "name": "Bisoyetutu Ltd Ltd", "colour": "#6142F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005872, "uuid": "58dec0a4-ac55-4a84-be6b-e6f9056c03dd", "value": "3AB6F101EE858473D4B3013452B79BBB597AA9202B25C5D3A7943C787A707C16A3B3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005872, "uuid": "14979664-0e19-40d2-bd6a-ebcc9a4ef771", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005872, "uuid": "ae2cdaaf-23e4-45f4-ac10-f4c7b22ad807", "value": "196608:x9berPbnq5FqSG0A4qnyk7eHno7SC8XKVM4:snqXVAp+oYXwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617005872, "uuid": "0b031384-1cc0-4992-9128-63305a2d70fe", "value": 11123104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617005872, "uuid": "0fc61ddd-432f-4a14-9990-52de5b9e7d30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617005872, "uuid": "ea126b95-d3d1-45c8-a9df-c358829575c3", "value": "e85230a1b9b9c364056b1a2674cb85304cceb0769c6897a45ee498984973da8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be01647-90a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617034236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034236, "uuid": "92468159-92f9-447e-befe-2a25ae814b5f", "comment": "Malware payload (IcedID)", "value": "5fde528a0ac521abb8015c910ed5c663", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034236, "uuid": "7ce3e6a4-d7a5-42ba-a98f-bda641bed952", "comment": "Malware payload (IcedID)", "value": "e8a173d233228c5d464ee9028c58bdbab50367db00e99b4817be9d0d7f677850", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034236, "uuid": "7a415acd-aaed-44a0-8323-c55d5f4d20c4", "comment": "Malware payload (IcedID)", "value": "100bf394df7a4649d8bbff5d9933e0d9e981ff95", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617034236, "uuid": "cd233e0c-83db-460d-a624-8438e9d6e30b", "comment": "Malware payload (IcedID)", "value": "9e4de6c1e8d287fce8284d73c307bd2c91555c9d0d1b02d2b7348078c14f873ade63a7b028d300a0602b3f7b5bc8509c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034236, "uuid": "4303f395-37ca-485c-8388-be33dd2d040b", "value": "7A133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5C583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034236, "uuid": "17bde2ef-bbbe-44f2-9128-3dc44853cfb6", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtBlxEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBmsc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617034236, "uuid": "8414d1ed-1b00-4dac-9540-08525f202672", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617034236, "uuid": "90708acc-b6d9-4c74-885f-6c847b055516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617034236, "uuid": "3f43e362-51bb-4e4a-855d-5048a3708567", "value": "e8a173d233228c5d464ee9028c58bdbab50367db00e99.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ace97c-90d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617051533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051533, "uuid": "19b23289-d558-40b2-96af-1b23b0c079a0", "comment": "Malware payload (SilentBuilder)", "value": "7a4f8a8f08517669df1c5757f4504290", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051533, "uuid": "d732925f-d3e5-4379-9390-5c0af2756c78", "comment": "Malware payload (SilentBuilder)", "value": "e98e15ea657cdf448599aa9600815d30984705e92f82fbd2aa30648c8323d760", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051533, "uuid": "780e22c3-9f95-4eb4-b782-808cffe798f7", "comment": "Malware payload (SilentBuilder)", "value": "cb204de43f5d566aea2c57d9516cf203ddf0d58c", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051533, "uuid": "c86eedf2-d184-479a-be64-9ecd35c8a73c", "comment": "Malware payload (SilentBuilder)", "value": "c1070ddce9fae2912d04d31cbabe69fb6e850ac2751cd57afef38220be211f6727dd4ed89fd7f4d476fcf2dca9226468", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051533, "uuid": "a210d311-bfe4-478f-a155-a880b60ccee8", "value": "0DA412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051533, "uuid": "ce1dc873-ea5e-4b02-b164-b408c721d726", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7p:dEKXJ0MDs8QTjVJVf4k4Zip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051533, "uuid": "6f7ad9e9-5ba4-47b2-8deb-190156c3dfbc", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051533, "uuid": "861460ac-8f43-4aba-b9dd-2b252c40b3ce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051533, "uuid": "e062a7c2-e4ea-4256-8630-19083255c60c", "value": "SecuriteInfo.com.Heur.9526.4945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3e37a6-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617001781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001781, "uuid": "e4be2ed4-daf4-4578-af4a-8826d3835da7", "comment": "Malware payload", "value": "f58080851e63a29f9d243a238b17b1ef", "object_relation": "md5", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001781, "uuid": "c3a5860f-ecbd-47e2-8623-888e4fcf2793", "comment": "Malware payload", "value": "ea0623979d7a7a03dfda901509f8b17cd7fd9347d463e08737ea5f412dcc0464", "object_relation": "sha256", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001781, "uuid": "8f3cf925-4894-463f-8e3a-6f2f3921a5ae", "comment": "Malware payload", "value": "698402456e17d7e04d454ba91c11e3dda22b8a93", "object_relation": "sha1", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001781, "uuid": "5007c289-244a-45a9-ba84-aeb00fa64524", "comment": "Malware payload", "value": "dbfeb76cd539b7cf7755d154bbda41fd50c2683de3d8f4aea85f50bf78c7b38d252c9907151ea4db0c9a76e8d0bf126b", "object_relation": "sha3-384", "Tag": [ { "name": "LTD SERVICES LIMITED", "colour": "#6F794B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001781, "uuid": "9f07e66e-0c63-4381-8017-0d98c690dfc8", "value": "13B6F101A9858573D8B3113412BB9BAB597A69202B25C5D3A7D43C387E707C17A3B3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001781, "uuid": "2f3f93b7-bee6-4e1e-a43d-8b8dc1b029ae", "value": "bdc5a9caae3c3cac8c0aed5418f3c304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001781, "uuid": "eed4e816-911f-4c21-86e4-8ad8f0bf5ab6", "value": "98304:e9Yyb5er5PTIHykLIbh9AGsUPSGVdB2z3Sewc68asI4vqytlfelnCJ3LWySDCX2D:e9berPbnqedB2LSzc6QqDMoyZHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001781, "uuid": "91386408-2c87-490e-943d-fb4c36047601", "value": 11139808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001781, "uuid": "64cab28a-3272-4dad-a402-db6cedd18f8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001781, "uuid": "ac4faefa-60be-43f1-b2f5-bff63036944f", "value": "ea0623979d7a7a03dfda901509f8b17cd7fd9347d463e08737ea5f412dcc0464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ec1f17-90c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617047290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047290, "uuid": "d76a1f10-2a72-449c-94a0-7a90b45cdd3b", "comment": "Malware payload (Dridex)", "value": "609c12160bee83a946014ce663f7bd1e", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047290, "uuid": "f9c029d5-7851-4451-ab7d-b2be7040269c", "comment": "Malware payload (Dridex)", "value": "ea65113d6c5e110e7be972816d02a7714b6727409ba2dde01487a0f0ef4584b9", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047290, "uuid": "688d6c03-2e35-4f0d-bc25-95e79fad3dc2", "comment": "Malware payload (Dridex)", "value": "aa9155639fd0bcc4609641bb28a1fc3a1b6c36a5", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617047290, "uuid": "7a6b1dcc-b4d7-4aea-9e80-c72cdc37fb6b", "comment": "Malware payload (Dridex)", "value": "934632653fe1e870c32975e220a4b172bff4da6642e46299157743fcb536dba35b8a283a98ad1e9eccaf64885d4d7213", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047290, "uuid": "739f1457-8b9c-4521-a3f1-c4b20b9009f5", "value": "70C4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047290, "uuid": "5c3fdcaf-0fd7-4ba3-9bb2-b9fc9f20cfd0", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047290, "uuid": "5982d342-2b02-4d06-a284-a168436fa73b", "value": "12288:yt+D1yz/1SXpqDaoWmxsFVHk3eBWIcRd:ycA1aLoBSseBjcRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617047290, "uuid": "b7c3b67b-8ab1-430d-9e7e-63001cb60297", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617047290, "uuid": "02726123-4598-4dfa-8618-6ca86e951a36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617047290, "uuid": "1fa11b93-4198-4563-b042-d1bceb831984", "value": "ea65113d6c5e110e7be972816d02a7714b6727409ba2dde01487a0f0ef4584b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17a3886-9085-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617018971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018971, "uuid": "35c14316-b2b8-4f53-8421-5886de834c42", "comment": "Malware payload (GuLoader)", "value": "86fa26e33879d3c04152301eaaaba518", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018971, "uuid": "e09046c7-dd96-49ac-9472-e0d01a0793f7", "comment": "Malware payload (GuLoader)", "value": "eacf1b7b8d612e5a500f79a03b06f9fb919768a1fb053ce3522f3288c36067f4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018971, "uuid": "92eb35a6-b318-4319-9c88-61387e574d5a", "comment": "Malware payload (GuLoader)", "value": "3c75755b8efe897bb18ea99f6014dabd5492d32c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617018971, "uuid": "98be700d-39a3-4791-a255-bd3d13b1562d", "comment": "Malware payload (GuLoader)", "value": "21600f467f3003d765f2e2e31c207c2202ba9186109b8a4c2cfe3ebcca13726f79fea24f3780dd2b70a52fa598facd07", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018971, "uuid": "dfa67606-9e9a-450a-9abb-44f05f3c7c49", "value": "B2A3B4CFE0719B23D2407DB2A748C76E3F00A804B51EDF5A0E65B278357451B5CEDAA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018971, "uuid": "b9b6e416-1e36-458c-8794-e55ffdb7930e", "value": "a8b86b6cb5a304f5649372dc4fc7de67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018971, "uuid": "15978552-eed8-465e-8099-c0391ebb2d19", "value": "1536:nle5CD3/URwKGIOzE7YUzlDX0UEeQpe5:lBrURwUOzQYk5ZQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617018971, "uuid": "84449e60-ebed-4c02-ab41-30e56a7748d5", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617018971, "uuid": "5fc75e38-f7d5-4e91-bef7-feb885f48511", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617018971, "uuid": "348773b8-487b-4b1d-b76b-93d58b4c34d6", "value": "Payment_png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5746390-90b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617040453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040453, "uuid": "de1a95db-1c9a-4857-81fe-5757fae2d58c", "comment": "Malware payload (Dridex)", "value": "721d0b62a72bb3953fd9263930768656", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040453, "uuid": "3aa7f1a2-fdd6-46f1-b067-de39e0a479b1", "comment": "Malware payload (Dridex)", "value": "eb120a9eaa04f976f5bee426c0b19c8e2b000c71390d1c79c0dee47a2712ee4a", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040453, "uuid": "690f7662-51d0-41cf-b045-81f25cbbb9b7", "comment": "Malware payload (Dridex)", "value": "24a51e35b6c67c7d43a43f868bdafa8ba4eed44c", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040453, "uuid": "159ea37c-9e35-411d-b92d-95ce4194a47f", "comment": "Malware payload (Dridex)", "value": "7bb2efa0d92dc297ce5cac7f9c8536404a4496698ce16bf47334dd1a4e1008b0c830feab9e7a2099042ce17a7ee0bd90", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040453, "uuid": "c09f50b8-2ab1-490e-93e4-91c645df0bf2", "value": "5FC4BF43A3E55421F6735F3808B349024BEFBDE28934C5A9A6C9214D2B2B7D44B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040453, "uuid": "ed25c327-d948-44e2-8b78-11a4165ecd3b", "value": "edc6948b5a0e28edf5415e634ea66606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040453, "uuid": "194f3c8a-7dad-4017-b34c-8ef974b583ff", "value": "12288:At+D1yz/1SXpqDaoWmdsFxHk3eBWIcGd:AcA1aLoBOoeBjcGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040453, "uuid": "fea08ca2-961d-48eb-a0d4-6cc516945684", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040453, "uuid": "0a5cfdbe-adff-40dd-a400-8f84a9fa7b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040453, "uuid": "857c194a-cb29-4301-9e59-628033ac3eb8", "value": "eb120a9eaa04f976f5bee426c0b19c8e2b000c71390d1c79c0dee47a2712ee4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091a4471-90d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617053451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617053451, "uuid": "fc35b067-ea47-4889-8943-c6c92834c19b", "comment": "Malware payload (ArkeiStealer)", "value": "50d41b7f128197f4c5fbaa59bae98c66", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617053451, "uuid": "a0678004-8686-41aa-8928-89b7ee2d3873", "comment": "Malware payload (ArkeiStealer)", "value": "eb2b82c14b81523edd762536c3dcd308624821dd6840e8cabdf94327d55fcbf9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617053451, "uuid": "901522e1-a7e3-411e-b8a2-0c6eb9e173ad", "comment": "Malware payload (ArkeiStealer)", "value": "99bf0c70f44e7b795b4bd2349dd6d575080cbda9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617053451, "uuid": "3f3cc575-d2b9-41d9-87b9-a9b57ec5d2f6", "comment": "Malware payload (ArkeiStealer)", "value": "f2cb6b2cf3d398f9b2933bb6fbbb08764b30ea92e98dca9486ec6dc6961601f628925862a731d79d86099473ad044948", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617053451, "uuid": "555baa62-7384-44ce-9762-ecb5bf6af07b", "value": "D686338A756940F2E524293D064AD3F2B036BB0C063DA55FB7FE4E7F842375D28152AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617053451, "uuid": "34decee2-8e2b-4305-af1e-d3e6bfd01049", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617053451, "uuid": "67be3208-8de7-45e7-801e-39e9ded644ee", "value": "196608:itJ+7MBr0wCCoxY85JzuXG03mB0ocqskbaiziecOpwnO:q+7MmdB5JzSwB02RbaAlcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617053451, "uuid": "2c0a0344-93ff-4ab1-a6e2-2192d1c071ff", "value": 8311197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617053451, "uuid": "83023822-3c00-4d7b-9a99-bfd20b038462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617053451, "uuid": "9d23ded2-0754-41f8-a417-2a951c001ea3", "value": "50d41b7f128197f4c5fbaa59bae98c66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b389ac-90e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617057841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057841, "uuid": "b5e39306-1f48-443d-bb64-8bd8359994c4", "comment": "Malware payload (Dridex)", "value": "7cba65c341dc3f27071f7a9cbcdd5c4c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057841, "uuid": "ea14c7cf-acd9-4640-ae47-3204a9b9768b", "comment": "Malware payload (Dridex)", "value": "ebf336c0002abaeda840e20097bf561a1c9fe3d4f4cc14fe850767e36269fe38", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057841, "uuid": "eff3a550-b21a-4d44-afd7-1d200826eddc", "comment": "Malware payload (Dridex)", "value": "d7b8b83b1af34d8e465adb1d7641827fa0eef808", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617057841, "uuid": "3203acd9-2ee6-4552-824a-10136ac52099", "comment": "Malware payload (Dridex)", "value": "83027e24e3455c09779a919e4039e0a290d62ce044e8b16328c4f0e2496c37515dbc6a592c2fa999a405a9d9b9e59a89", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057841, "uuid": "86a66277-f6ee-4d65-a2ea-1b20a2b2f7fb", "value": "5B14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057841, "uuid": "9ae5d6e2-4617-469d-bf40-4db98e770d17", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057841, "uuid": "098cffb2-02fd-4fd1-bf99-dae30eb1c820", "value": "3072:J1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ri78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617057841, "uuid": "cb570a50-a68d-4456-969b-9c6cc19dee73", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617057841, "uuid": "3199bb9d-62a0-442f-abd5-37e5d7e53db6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617057841, "uuid": "b9f4b6fa-008b-4ea6-815c-a81d37e3a83a", "value": "ebf336c0002abaeda840e20097bf561a1c9fe3d4f4cc14fe850767e36269fe38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3482c54-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031832, "uuid": "4f260e6d-6da9-47d7-9be7-38d5e1da3cd5", "comment": "Malware payload (IcedID)", "value": "c8afc3ca3dc9ed9c6b2c885d234df7be", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031832, "uuid": "42c2c89e-a976-4f29-8586-1aed3a72121f", "comment": "Malware payload (IcedID)", "value": "ec20cdaed754ef7fdf125b0d75462a2cd42c8410853ddd1b27e2c42cb9d4b081", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031832, "uuid": "32f7c27c-1779-4481-916a-a4736e0220ab", "comment": "Malware payload (IcedID)", "value": "77c6becbb9c5716c9931eedb87aa6cb8c0a74052", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031832, "uuid": "7e7c7750-bfeb-4cef-b777-fc15c9317e8e", "comment": "Malware payload (IcedID)", "value": "85808434dcc26139f01b180826c3cbbe1df3d20ea64d8bae219731c16a01485fd9ba0ec9935863a49b38cee9f98c1457", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031832, "uuid": "d9fb412c-74c6-442f-83a0-8858f943c57c", "value": "2204122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031832, "uuid": "dd8d58de-a8a1-45ba-8ea8-b654d29df10e", "value": "3072:A3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:AnE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031832, "uuid": "82b6f14f-0412-4560-b91d-0c38df86bf60", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031832, "uuid": "fb1a30c9-843b-4038-9cd2-906a0382b8b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031832, "uuid": "5ced6729-a8dc-4294-b198-cc3e8e91cfc4", "value": "Claim188780667703292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea3f5b2-9090-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617023396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023396, "uuid": "129bd371-06e9-4ab7-ac8b-1d25e5aa2bd3", "comment": "Malware payload (AgentTesla)", "value": "6561db829de6ac8e9f757bd41ebe3556", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023396, "uuid": "301ec37f-4b17-45a7-9891-ae6d572c0435", "comment": "Malware payload (AgentTesla)", "value": "ed920f7881aa5158b8ebee1a73331be4dab23da17fad9a14463e92c6d032f494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023396, "uuid": "3f052c72-68cc-4192-b0ba-c477b4dc77b8", "comment": "Malware payload (AgentTesla)", "value": "1a947a4019ba0e70c44b3bcbdec95f25af50d059", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617023396, "uuid": "cab76ce5-f49e-4760-a965-336e43155e0c", "comment": "Malware payload (AgentTesla)", "value": "7ddfbdf01f90982da1dbdf92eb59590534f4c314450c7bc990682ee7f0396e3f0cc4dac39a071a9560a5082e8700f115", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617023396, "uuid": "d226319a-7d4b-444a-9c83-3cea379078f9", "value": "529423C5F65A2EB318B511B2B49838502052FA6481CDCDED21FB9B1F0EE772F8552A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617023396, "uuid": "8f572cd9-08d6-4290-9e01-60778db8cc33", "value": "12288:mwLc7LASV4GcZf3x/wtGDinABOq01rCIawhSdVM/9:mc6LASV4GcZf3h8Y5kqqaZdVMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617023396, "uuid": "02473a49-5bc4-42a8-8485-054eab88b05a", "value": 429076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617023396, "uuid": "d43001d0-45e9-429c-8937-4ccf91157b63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617023396, "uuid": "de228b75-eeb7-4497-bd08-fe42bdea321a", "value": "CTM_request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e680fe36-90bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617042656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042656, "uuid": "d2d6db50-64dd-4020-ac57-db9474c3b01e", "comment": "Malware payload (RedLineStealer)", "value": "118361019e34b064bd77e5075b36be89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042656, "uuid": "34a2c0d0-8659-4508-ab12-cfdc2f8ff0f0", "comment": "Malware payload (RedLineStealer)", "value": "edd437fae0128015cb46fa7bc90b0de2740051657fd66ade89f1b44e1a03bb65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042656, "uuid": "a1d048b9-3023-4c51-b573-a0c6530fbe7c", "comment": "Malware payload (RedLineStealer)", "value": "cabf679cb53eea611d6890177a168c3d402924bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042656, "uuid": "acaa5749-4b36-4cce-9ba4-5ad73d292b95", "comment": "Malware payload (RedLineStealer)", "value": "2dfa030a69c4ec2517b01f0b4e369c39160dce9731da4038664a9afc89a91413951619beda26cc32bec875777670d3cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042656, "uuid": "12f42707-175c-4f6f-afd0-5478207d07aa", "value": "B3345D182B98CE18E5BE0379F4751114C370A147F465D79F5FC0A0EEEF13B8AA9296B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042656, "uuid": "99485dfb-f75e-49ca-97a9-c13b6950dd92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042656, "uuid": "f60f2262-8bde-49af-a71c-d927c45d88bf", "value": "3072:cA8hig94Pcc4kSE1A+kndvZtED6+2vu5wOU4ldby5fAzlD8OblZH:c1ig94P14kSEYZc5/PldbQAZ1blZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042656, "uuid": "03ad8084-e0d0-4557-be36-f9ec08b0541c", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042656, "uuid": "8d31a6dd-204d-481e-a68f-b968a4f83a90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042656, "uuid": "852c7934-0039-430e-abd1-272e57b450ef", "value": "118361019e34b064bd77e5075b36be89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49c0b72-907e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617015943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015943, "uuid": "4e2d470a-4515-4a16-9d29-0348b306e9a1", "comment": "Malware payload (AgentTesla)", "value": "f91551d0be5d0a1a1599568b753f93af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015943, "uuid": "9568f199-771e-40c2-92d4-630012d800b0", "comment": "Malware payload (AgentTesla)", "value": "ee589997b5ca149b57c775a367186dadffeba775b8cb6955a32de307137fce11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015943, "uuid": "f517c3be-f320-4240-ac9e-022f627ffb7a", "comment": "Malware payload (AgentTesla)", "value": "56a8ada80d027d279ccaff8e18e5462406b3e052", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617015943, "uuid": "75cebd8b-8cad-47ec-85ed-ebc96df8bebf", "comment": "Malware payload (AgentTesla)", "value": "04ecedd0e6b77a97ec41ab7bb181594c50a7d44b41079a4599f080a57328c060bd31ecbd0e9479a6cae374d818a3f5e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015943, "uuid": "42d6a8b1-71f9-40fe-bd0b-39ecb58d6bab", "value": "9DE41268CB373B89D93513FE10BA478A4AF4E70C5213DFFEADE260E514622166AF5430", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015943, "uuid": "3237e7dd-b72a-4e06-9549-f1144bed719a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015943, "uuid": "8ef7122d-71ef-4ee1-bb58-d68cc975fabb", "value": "12288:vT3EoujMxfU0uBCyG+6x3piFcP9i1A3LObWr6nRo5pNx:vT3E5jgfU0uBCyGbdpM1OLcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617015943, "uuid": "173e13f1-af39-48f0-9953-f4b64af39b32", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617015943, "uuid": "31dc2236-1fdb-4d19-8e46-aa4a1e975407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617015943, "uuid": "095164e6-559f-40a9-97d9-532469c5bdfe", "value": "Document Submission.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff2f587-909a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028068, "uuid": "7bc9db8b-1fb3-49a3-81e8-fafc9bd892f4", "comment": "Malware payload (Dridex)", "value": "74958f74c51215b56ccb5e4d24af600f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028068, "uuid": "0d7a942f-3829-4cc5-b16b-2599ccd5aab6", "comment": "Malware payload (Dridex)", "value": "eecad1b3b24ab3dd5a5387941a2818863f4049cfb0c9e4a351a8322d03e540e5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028068, "uuid": "9c667f41-11ad-4558-b9d8-293cb383f9eb", "comment": "Malware payload (Dridex)", "value": "67cf2f46dc56066491a97f394cab7064b2f4e447", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028068, "uuid": "0f85e67e-5d94-4b67-a77e-e99f9f816901", "comment": "Malware payload (Dridex)", "value": "08bc43805f79b790c59079973a53ae162011220897f7551de6474278f701685af902743ed800d6b634fab226c3467304", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028068, "uuid": "7eb3e126-5b3d-479e-870b-f9a83873069a", "value": "A414AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028068, "uuid": "5f3154ba-2329-4baf-b768-c383bb16e1ab", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028068, "uuid": "f32ec272-e45f-4d9c-8b6b-e7cac97103ee", "value": "3072:qpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:qBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028068, "uuid": "0be1a074-a8b3-4c49-8d55-34694e04715c", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028068, "uuid": "d2847f2c-afc4-4cde-af7e-9cfc7ad0421c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028068, "uuid": "8558be70-94af-44cb-8f3f-ad07467a278b", "value": "eecad1b3b24ab3dd5a5387941a2818863f4049cfb0c9e4a351a8322d03e540e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68429703-90a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617032136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032136, "uuid": "52161069-59df-4d41-a38f-cede1cb826c8", "comment": "Malware payload (IcedID)", "value": "5044b485c6e3256dbe4e85ed7f40f8c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032136, "uuid": "aae3dc5f-abb8-43c5-9701-95fe96589020", "comment": "Malware payload (IcedID)", "value": "ef40d547e887d0fb80d6f7902dc477de2cc7feb175cd16ebde2ecafea75acb30", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032136, "uuid": "8fca84c1-70f7-48fe-a061-ccd563633d69", "comment": "Malware payload (IcedID)", "value": "c1715c624b57f6da964a512fe564712f0720fca4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617032136, "uuid": "0be596b1-bce7-4c55-b582-0504b0b2c2e4", "comment": "Malware payload (IcedID)", "value": "72dadbbe305ed962093cb9065d19518b9e2f67f62ebd9d290e754b6b850ef5f5acac5e2a15c5af7dffe23f5e67157e32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032136, "uuid": "8e6c302b-40a5-44bc-bb28-2db8d351d529", "value": "62133CCA55700F23CA312AB6C9F21B18C236F740B79358FBC158BBA5D583194DB729B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032136, "uuid": "36caac27-08df-4b2d-8f10-0fadea5862e5", "value": "768:PZ0JYAgQQdfuTt8FrmZkPdmeJwtBExEgMRFtCiOc7aHVmNrrPUJ:cYA/Cfvd1CtBvsc4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617032136, "uuid": "3e11cd58-ee2a-4a8c-a59b-5950b88c8bec", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617032136, "uuid": "92c73b35-d9d1-44d2-a893-e19ca3b3c2a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617032136, "uuid": "141f0caf-82b0-45f7-9438-04b327071461", "value": "ef40d547e887d0fb80d6f7902dc477de2cc7feb175cd1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46107f93-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617002443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002443, "uuid": "3f59b846-17aa-4a98-a736-8438333d5fce", "comment": "Malware payload (Dridex)", "value": "0cbbbbc9c2a227773bd048ae9c3ffe1c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002443, "uuid": "75f5c919-06bf-4406-99ee-4cb34e1b8708", "comment": "Malware payload (Dridex)", "value": "efeacff2b0e6d3cfc9286203e132c9331195e45329c5b6d900af8dadeebdc184", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002443, "uuid": "06e5011d-869e-4496-bfab-66c82ef7e477", "comment": "Malware payload (Dridex)", "value": "3bb837de893a127771a0b319f0731d254d14f302", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002443, "uuid": "2423d04b-6a59-4ddd-8149-4770922a982a", "comment": "Malware payload (Dridex)", "value": "0ead45a5d005b8774ada634fa459d195021b67f2353eac824e5b78670a20722e05ed1b2a478ad25ce0ef12605b4a10dc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002443, "uuid": "c32c8ab5-1c34-4ab6-8538-49502e387666", "value": "7614AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002443, "uuid": "e45de841-4c5c-4737-a100-3fac360a794b", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002443, "uuid": "0bf0bc46-4b3b-4a0c-b469-873ba6245dac", "value": "3072:0r1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:0pi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002443, "uuid": "baa1317e-7433-478f-ac32-f196c34cf212", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002443, "uuid": "5b45a46b-2381-40b1-a163-797b7ddd4821", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002443, "uuid": "31a38d67-346d-4e79-b2c6-037d1f3ae928", "value": "efeacff2b0e6d3cfc9286203e132c9331195e45329c5b6d900af8dadeebdc184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d20d1d-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028177, "uuid": "049e71dc-7099-4f87-9823-bddbe1c1d473", "comment": "Malware payload (Dridex)", "value": "4149686bf7328d03e4755ddef294a662", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028177, "uuid": "8b76f8ec-9edc-47fb-96c3-1e2af327d1ed", "comment": "Malware payload (Dridex)", "value": "f07e1f3e06c38521f19788da9241eb5236e988fcdca9fecd78b9803f0a7f8814", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028177, "uuid": "7a0a29e6-f184-408c-8d1c-80e5bbcb1f91", "comment": "Malware payload (Dridex)", "value": "b2038d1569bbda9599d9fb4b9f8ad2452fd43032", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028177, "uuid": "2d7fa924-faf6-4de3-9bca-8d794ce9ce9e", "comment": "Malware payload (Dridex)", "value": "0bdcf4042c1eee0256692253b3d1e13d72ca8a440b7641f48d54f7b43a77faac824f86aebc12d8e9f0bc9bb6079f92f3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028177, "uuid": "dce784ad-dbe4-4346-b997-4b45c4ce46d7", "value": "7E14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028177, "uuid": "7b5288c5-9118-479e-bd4d-981d977fe677", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028177, "uuid": "e4ad9855-aee1-468e-a9df-ae4ba15bfddb", "value": "3072:SpRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:SBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028177, "uuid": "86241874-3bc5-481f-939c-fea0e0742714", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028177, "uuid": "8ff5377d-8593-43c3-80ea-b71ee8845a66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028177, "uuid": "8dd7a53e-7b05-4ef9-a114-4cfa90888084", "value": "f07e1f3e06c38521f19788da9241eb5236e988fcdca9fecd78b9803f0a7f8814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aab0f27-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028221, "uuid": "f0dd6867-2640-44a8-a816-43e4e82e7889", "comment": "Malware payload (Dridex)", "value": "e92adaec8fde4886ef0c99d2cbb7fbcf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028221, "uuid": "16e63fca-0812-47ea-b364-9c6bfd82a5bd", "comment": "Malware payload (Dridex)", "value": "f10c76a0a2e4d683af95904b67e4f34ae4f48d428ccd69d4a03fa98352f76395", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028221, "uuid": "ce1aeca4-c639-4728-b494-9ba01495ffc2", "comment": "Malware payload (Dridex)", "value": "f48151ee72d23158ea17c69f5033b42894f492c0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028221, "uuid": "dd8df019-d007-4cbc-b602-ba325ab9053d", "comment": "Malware payload (Dridex)", "value": "d85e16abfccfd6ff585e333bd35e196a7f089076abe0e06dc736b697a2611ffcbe161d968fa6200be97b1746c74c0f8d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028221, "uuid": "d4c2c214-b137-42c7-bf1e-585154b9d1d8", "value": "5D14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028221, "uuid": "bce23a9b-2d14-46ed-8165-179f3ab74862", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028221, "uuid": "23391b6a-3af7-4307-a689-e83803ea5dbe", "value": "3072:spRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:sBPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028221, "uuid": "f72c5c4e-d50c-4aa2-93a3-5793b724c293", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028221, "uuid": "0ae5fcc7-c024-4437-b223-63e546251b92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028221, "uuid": "49427368-70d1-4356-ade9-7e4db59fb540", "value": "f10c76a0a2e4d683af95904b67e4f34ae4f48d428ccd69d4a03fa98352f76395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e388ee6-90bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617042373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042373, "uuid": "fd6bd09c-a0aa-4f72-95ef-496b53edee10", "comment": "Malware payload (RedLineStealer)", "value": "7202007f66f01f1c554de7c470499ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042373, "uuid": "c2e44330-205f-4a09-9387-7a8c1282669c", "comment": "Malware payload (RedLineStealer)", "value": "f10d670df193cb35227b29f95643b09a8a6fd7cd3428d11aecfcac55e9d90294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042373, "uuid": "35eb3f16-3a87-4d23-aa3c-1d2c2643493f", "comment": "Malware payload (RedLineStealer)", "value": "937e7f7e79f667d46df9c36e6a75744e9641a5e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042373, "uuid": "85653028-3a27-48ea-94fc-d1fcedd3ed94", "comment": "Malware payload (RedLineStealer)", "value": "bc2451295c72cd0d7bacb5473b48bc9d24d1d719829c0daa232ceaa48bcabd7227ebcecd200b4e63d0cfbec8dd63fe5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042373, "uuid": "d71dacd8-2bc2-4710-8c8e-0eed13682c97", "value": "C8047D2C2794CA1DE5BE077DF9741114C371A14BF265E79B5EC190DC2F22F88A928AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042373, "uuid": "26c91c37-1470-4af4-ace7-08c1b2ed5e96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042373, "uuid": "0a76eb87-a25a-4673-ba53-74d25eb314a3", "value": "3072:oA8eGgR4Pcc44nvi+mbe6C3BLstED6+2r9H5is4lEbN5fApQD8O+:oKGgR4P144nqg35sjH5i3lEbnAS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042373, "uuid": "24ada6a8-85eb-41ff-b7e9-e0ea441f6c21", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042373, "uuid": "a9e52008-a957-45fa-b795-56dd7abb6e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042373, "uuid": "98dee4c2-6fcf-4485-9eec-7449ea7df381", "value": "7202007f66f01f1c554de7c470499ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321261b1-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "2d65dd3f-c50b-4b91-bb86-21dd7143b0a9", "comment": "Malware payload (Dridex)", "value": "21ded46c141b7bb669b79622526eadb2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "4b4b0964-6114-4842-a557-7d57b3db7a50", "comment": "Malware payload (Dridex)", "value": "f171714711d13e3b10580f726b55d8d830baaa0eab23670ba62d0aa964a692ec", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "86a4ba80-5d86-4a52-be8c-4194c6c0c2e5", "comment": "Malware payload (Dridex)", "value": "547010dfd04b38c06478cc9b504d471b872dd46a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028179, "uuid": "61732872-ff35-425a-91d3-45209e13096b", "comment": "Malware payload (Dridex)", "value": "e2c87ed572d331b878328cce5d98e052522555c2b57c13d9ba982c181afca84ad2325ff327e4771730610b61c5fcbf01", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "17960d78-ea2e-4a70-a61a-8f74539f2df1", "value": "8014AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "0ea350b4-44a4-4fa6-bdb1-aa806f677783", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "8c99c198-a606-4d10-9341-8059ed04a575", "value": "3072:9pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:9BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028179, "uuid": "ee70a2a3-bc25-4e79-b72f-37f08dbe2578", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028179, "uuid": "81be2352-7fe6-419b-9bfb-8a402d2fad26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028179, "uuid": "89ccff77-0566-46d5-bffa-a444b9269d0a", "value": "f171714711d13e3b10580f726b55d8d830baaa0eab23670ba62d0aa964a692ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7654d1-90d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617051955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051955, "uuid": "8a0de9bc-8453-4b2a-ae4f-17a1fcf6ca4f", "comment": "Malware payload (NanoCore)", "value": "92dd7a7fb36943c6777d7b154fbf9acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051955, "uuid": "44e7e56b-eef9-477f-b823-ea43a57d6b53", "comment": "Malware payload (NanoCore)", "value": "f1dedca298529e4cbcb5f9afd04ba1bd38e1d784fc0ef230e72128a5f0b48a1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051955, "uuid": "406d17b3-ee99-4d09-89b0-c7431bc17325", "comment": "Malware payload (NanoCore)", "value": "dd44b8f3d28bfc99c0c50c736c50eaa24f0aa462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617051955, "uuid": "7decf239-5f05-464c-b2a5-5c825f6ddf31", "comment": "Malware payload (NanoCore)", "value": "50f90659b4aeabf829960e5a36a819afccf425d289d9824943d11fa94be66efe5a1f6da89858c471c7c9d082f5eca687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051955, "uuid": "ebdf7f6a-cd86-4712-bbc7-916db46cb238", "value": "718633904CB0CCBDE3D9C5B5A1E6E3BBC32D64271CA26644D516D8C9AD38FAC5E0F852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051955, "uuid": "8ff910dd-2c62-4bed-b334-c77686ffad9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051955, "uuid": "4bbc1e75-0de2-4ee0-8dde-d85c94240ad1", "value": "98304:toxMbX7iSoW3kIPa/aNJNCX/NWQa9JcEOJRE51UWAB9XvuRwA/aLioGmrfxwPraZ:ye7RkIP6aNcDCWSUWa2wADaqMJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617051955, "uuid": "9457ceed-5022-4ba9-9e39-a9a7ac7eb9da", "value": 7979008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617051955, "uuid": "b3aae73c-162a-4da6-b3df-8d42a88cd523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617051955, "uuid": "ec501271-f1fb-4bf2-9ae7-3253880c1fb3", "value": "92DD7A7FB36943C6777D7B154FBF9ACC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518d47dc-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031239, "uuid": "d4fe6e7f-237e-4025-8825-d5690141b4b3", "comment": "Malware payload (IcedID)", "value": "dbcb2496f8d63fd332706c1f8005bf2b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031239, "uuid": "4f61e80c-9070-43f3-aa9f-11e95436627d", "comment": "Malware payload (IcedID)", "value": "f2d7190c4b37453df57ea9afd0755ca3db19a654a7c7d77e30a969028b11eb69", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031239, "uuid": "bdd0b867-c2d4-4772-9b96-6b8cfd87b07f", "comment": "Malware payload (IcedID)", "value": "eca4f132cd04c0ee11b75bdfd66a5cd2a270f840", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031239, "uuid": "594f172d-2c46-4044-80ab-2b1d40c84d0e", "comment": "Malware payload (IcedID)", "value": "66fc109dd306ef1b7afadd8675162d84f6cf239b64eccaf61cb3a28252f0e9351456eceaf7a755b6f406b45fe18b42cf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031239, "uuid": "135ecfcf-a2e0-4297-ac66-0b95f2c8bfc4", "value": "22B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031239, "uuid": "2dc88d65-a50b-46d5-ba06-5635af5e599e", "value": "3072:+26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:+LTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031239, "uuid": "6adb712d-cb12-44d2-adb8-f385e191f1de", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031239, "uuid": "dee784bd-98c1-4d7e-b0b2-44ce07ba7094", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031239, "uuid": "04c99156-d20b-4e65-8ac0-0eb846ea36d5", "value": "document-509173130.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518366b9-9053-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616997308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997308, "uuid": "b13af329-0b03-4d94-b296-38e36fc96e4b", "comment": "Malware payload (AgentTesla)", "value": "16fced1104d5b42a006d204113ddbd7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997308, "uuid": "00db79c0-2112-40ea-b0ba-e435527c1738", "comment": "Malware payload (AgentTesla)", "value": "f3343704cbf630ed889003d45e94b81794cf64021fba0c6b907846c4c98c83f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997308, "uuid": "2727e332-c388-4f73-af86-c220057a039a", "comment": "Malware payload (AgentTesla)", "value": "b142314ff974ea9fe0d5d2778c3af70724a277d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997308, "uuid": "a2790063-05e0-4bbd-ad9a-350bfbac7908", "comment": "Malware payload (AgentTesla)", "value": "c995d7059825fa5ab68a235dd5179552c2cfc6130263d265d3b7f8db3893ca8106cb8e0065ba09ab5706db54fc5a0352", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997308, "uuid": "f5aed1d7-c707-49a2-b899-7a1d5203f0ae", "value": "C1849EB875082CD6E66F576BCA96BCDD03A5FA639ACB94C94068F7F30553361FE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997308, "uuid": "5bf1ae1f-20e8-4f6f-9888-8416446ba8ea", "value": "6144:s0s6qGmn2GkyFUkotw5uJVRrHuoednFlG6AZ1+iSxSg5YthWbh1C4Jpx7tfGH:sgPRmS+5FA9Z1jZgqEbRv1GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997308, "uuid": "c9386d54-789e-4687-aa54-beff2a84f847", "value": 373100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997308, "uuid": "08db571d-aa43-4509-bfd7-f063c086f659", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997308, "uuid": "e923a048-8d8f-4851-a4ed-25cdd287fbe5", "value": "ENQUIRY - SPHERETECH INTERNATIONAL DOHA QATAR.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e0d3ad-90c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617045035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045035, "uuid": "400d66e5-3331-41d2-80f1-fb15a7ce97ef", "comment": "Malware payload (Dridex)", "value": "ecaab545b342711455efe23a8384a221", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045035, "uuid": "bacb1251-d91f-4aac-84e7-013fccde6022", "comment": "Malware payload (Dridex)", "value": "f35d3a7a63840470db102edb4bb29d475e191ff740213f062d772c8e55781162", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045035, "uuid": "032807fe-8f83-48c8-8bfc-4ab2c010d92e", "comment": "Malware payload (Dridex)", "value": "88108746bd3b2cb8c647b913a699eff90b53503b", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617045035, "uuid": "e674cc41-e485-4716-9a88-548b37aae231", "comment": "Malware payload (Dridex)", "value": "289e7a6ea8300b79b066cbc8297ad3458e841cffd5939149f634bd5f38dc69acdb77d54acd8e3274e6357fada2894047", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045035, "uuid": "e20c54a0-7b52-472f-9b2d-feb38cd9e197", "value": "DD84D01367E15031E6721F3848B389518AFF7DD28A34C9AB22C9115E2B277D05E78F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045035, "uuid": "50b1a7f6-c6d0-4937-a905-5e6bc2e75b63", "value": "10b339eba7ed6a12d0c67a18515a94ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045035, "uuid": "fb7c0779-79ae-4991-a562-b1505f28f32e", "value": "6144:IbazNBbycfmKsyUlVlMdUFIk1KyHNwoAupFp5xMzC1h:rzeTlVl/7HN5p5WzUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617045035, "uuid": "7f51e404-75dc-4f52-8b72-293ed84677d5", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617045035, "uuid": "79720997-1c1d-4195-be09-6fd081409caa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617045035, "uuid": "0ae73889-7ad1-445c-b611-fb4be6ec6d1e", "value": "f35d3a7a63840470db102edb4bb29d475e191ff740213f062d772c8e55781162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3216cf66-90bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617042353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042353, "uuid": "b842645f-0bc6-4770-8711-4a5c93bd26b8", "comment": "Malware payload (SilentBuilder)", "value": "3ac6401e1073063b4a9d6bbba0c674fe", "object_relation": "md5", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042353, "uuid": "d9a957ba-061e-4f8a-8936-554d4c93d808", "comment": "Malware payload (SilentBuilder)", "value": "f397f061c42ac2a46914680cd373afbd295f0d54b6ed3406d951b516f28a9802", "object_relation": "sha256", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042353, "uuid": "44200092-bef4-4948-82f0-21fb631628bc", "comment": "Malware payload (SilentBuilder)", "value": "424e4d562331a876d21772fd3757264be0e848e7", "object_relation": "sha1", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617042353, "uuid": "2e1199bd-9aad-4a12-b8e0-62e8c6d0838d", "comment": "Malware payload (SilentBuilder)", "value": "47cedb6144283473bf410696d1c5cd7083cb6d75ee8efa7fdeee2d68c6084c3551dce501bf68bf5da51097745f22d614", "object_relation": "sha3-384", "Tag": [ { "name": "rob39", "colour": "#F9A0DB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042353, "uuid": "d5b82499-18dc-40de-8ee7-e5d93843f09d", "value": "18A412B5FBF69EA7DF06433084EF8586B272FC800B03664B3245F747E67879065126A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042353, "uuid": "3d622de8-1db9-4187-853c-6ca7516367c3", "value": "12288:dCfxDk16+8fJgU5MDjkKglr1n/iQTj8gJVtJ4k4ZNQ7p:dEKXJ0MDs8QTjVJVf4k4Zip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617042353, "uuid": "86de69d7-a591-4465-9074-eba57e74b33a", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617042353, "uuid": "31ace3b0-0252-4569-9e7f-59b3d30dac58", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617042353, "uuid": "5ffe6861-ea06-4edb-945b-542bab9eba48", "value": "inv_252006230_1653916413.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57890e9-90a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617033581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033581, "uuid": "72d6746e-cc61-40c8-91c8-3e39ada09775", "comment": "Malware payload (Gozi)", "value": "53db205ed3adc6574d6966234c8e6476", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033581, "uuid": "e744b224-0383-4a85-91fa-bb16305f018c", "comment": "Malware payload (Gozi)", "value": "f3ca48e01059fa75f4954d2c5a6d463f01ecf3590e76c3693917d80cc057ee7c", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033581, "uuid": "c41cc4e9-4563-4329-a772-9d887cfdad65", "comment": "Malware payload (Gozi)", "value": "a33a3e209db23a3f20445ceda7e67ccc091c472b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617033581, "uuid": "9920ad0a-8f6b-4dc5-99c3-9dfc72089a5b", "comment": "Malware payload (Gozi)", "value": "fbde624dfbbccea9df48c65a7533dc4915774587dd8d7a53453b7400392979fa13b1f01f613da99e37b94a009e6f36f1", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033581, "uuid": "a1289fac-b940-4fe4-b3ff-d4ab89284461", "value": "BE54D03237E6B4B4D89342394BA5DA628E7EF8522F3544C3B6CC674A87696C08735F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033581, "uuid": "17f18f3f-ac23-4fe4-8d6d-8949c702b9e0", "value": "b93e2757083fc8740867882d3bf40c21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033581, "uuid": "1405999e-b8f2-41a5-bd91-8040d54f27f4", "value": "3072:NEGU0QU6VrJEIKb2ltLrSL4TncvuR/TbsSXrz27CJ2L4JE2o1kbylr7TrRC+LBvx:HU0G9lZ2v0seR2L4+2n+bF93lr7WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617033581, "uuid": "f0e6eb38-2637-4552-90b1-49fc5eebd7d5", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617033581, "uuid": "2306230c-3544-4524-967a-0a35d33cc355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617033581, "uuid": "cff71c7b-6fec-4b34-a2aa-f52187288287", "value": "anatomic.ai", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4862c04b-9080-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617016620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016620, "uuid": "da8e24c5-d5bd-4641-8b08-c25ff6c44397", "comment": "Malware payload (AgentTesla)", "value": "471cc9559e4aacf236800717228fa425", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016620, "uuid": "83b5731d-be2c-4240-ac16-54a09e99993f", "comment": "Malware payload (AgentTesla)", "value": "f462d107da84ba7b8c4f2c68f3e69106a478a180f5d4ba3a75157cfdbc98c3ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016620, "uuid": "a945bf08-383d-4ee1-9145-4c994f59b4b8", "comment": "Malware payload (AgentTesla)", "value": "b7405f7c1bb17ba5c0af52e924dbad4fb93017d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617016620, "uuid": "8c894d03-c6ff-4cc5-bd83-682506a6c9f3", "comment": "Malware payload (AgentTesla)", "value": "7fa81759c973107ec568967bd7a3360acd6c9d165097708916df04c45d58a5c4eaf5262345e5705057179963ef102e6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016620, "uuid": "f2ba347e-98be-43b7-bb3e-fde0918152a6", "value": "43053A50E2C8ED94C03F12765838B13463A9F74AE27BCE293E6DA0595477392B167F0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016620, "uuid": "c6f374e4-c00d-45ab-9a6f-893e2110b4fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016620, "uuid": "aa8278b9-fcd6-41a9-acff-1eef488a2869", "value": "12288:XVK5P3mbulrfyB8hfHQeH8BWZNWmCpgs8yP:g5fmKRyB8h/NcBWZ5QJ8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617016620, "uuid": "a26bee06-b972-40c3-b5e8-b38dfa86bee4", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617016620, "uuid": "65900bc1-f09c-4e97-aa28-0002bd7370d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617016620, "uuid": "fd8f3207-60c8-4c83-a6b8-81e9a8e0bf9f", "value": "Purchase Order #07916813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff32f9c6-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031530, "uuid": "f67e91bc-3a44-4b70-87b0-fab2e2e1ce0b", "comment": "Malware payload (IcedID)", "value": "4de121637bb415653ad4c378aab9f13c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031530, "uuid": "f9ce90fb-424d-4db3-bd48-248261d462b8", "comment": "Malware payload (IcedID)", "value": "f47925d2bd9b30671bc31af80eada4dfa153be8feada9a8a7df7abc5c02e7e1d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031530, "uuid": "f21a7fbc-9d87-4e3f-b5c4-42a5081951e4", "comment": "Malware payload (IcedID)", "value": "92c3b3ac8db2a280593a83adb5627f58aee89f5f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031530, "uuid": "0cf0b093-1a80-4bda-8430-591ebb89d63b", "comment": "Malware payload (IcedID)", "value": "a2fe74c3c3fbb9dea3731b51fd1bbba869ee5a4fd2ed28293ce7878bc6db445fe047bf56a469448e68b036198ac4d4f0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031530, "uuid": "a3c43e0c-0f94-4f44-9566-68474522b483", "value": "C0B3B0BCCB06B0A7DA54DF3C854AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031530, "uuid": "664ac9d3-9170-42ed-ad6c-85e70df8c8aa", "value": "3072:g26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:gLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031530, "uuid": "0caa7a29-0e87-42bb-95a5-78088e26edf5", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031530, "uuid": "5b015dea-b14a-4986-914a-d3ac750bc045", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031530, "uuid": "9079721d-2bb9-43c6-a627-a265d37bce22", "value": "document-5505542.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee82757e-9092-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617024630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024630, "uuid": "8da265f1-e7a1-456d-99e3-951fc6272334", "comment": "Malware payload (Formbook)", "value": "79fadba8a7155fb566c5dc526ea0f811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024630, "uuid": "797aebfc-c228-4dc6-8fe8-4e7a127757b3", "comment": "Malware payload (Formbook)", "value": "f50a8bd310705fd2a5d2aaa8ecf2d11fb7f1e64530b1bebe6b88a68b64ca2797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024630, "uuid": "778c6f10-32f8-47c2-ae6f-de9997abed2c", "comment": "Malware payload (Formbook)", "value": "8eaffd73b8cf9d4e67e592c4640b2ed9616408c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617024630, "uuid": "b6d49a0f-8e50-40ba-976a-2ad7cc0f5d36", "comment": "Malware payload (Formbook)", "value": "b32669526c800e60340333c9046f7a009000fa270e48991eff3af7ff8e3c6578b5d6f5f2dfed154403e5d1b62f32ee5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024630, "uuid": "964aed3f-f4e4-4f21-ad20-f563275f373f", "value": "CA2412A937F8A4B7D43A113206B3A3BDEBBDE3412B34500BA7B10F8965116C6D5271DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024630, "uuid": "9d99dd8c-3d30-46b1-96e7-e935874250f7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024630, "uuid": "93649b22-7f66-4d69-af78-4f1eff349710", "value": "6144:nAPIYn8o58X8LY2aHC6XC1QwSH99DTW6c:bG18XKYRB2SHTW6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617024630, "uuid": "33959255-11e7-4e01-ae1f-8bbfd9712caf", "value": 217889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617024630, "uuid": "69d28398-49c0-44c6-95f2-0baf7d35afd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617024630, "uuid": "f6276638-2e98-4c87-b61b-eaf5cb1c8ef3", "value": "New Order-756678 SEG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04df718-9096-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617026244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026244, "uuid": "8638576b-5726-42db-bb35-fcef4dbafa82", "comment": "Malware payload (Loki)", "value": "39291411ed14b0827245c81d2800ceeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026244, "uuid": "3da78cb7-bf1f-4cec-be45-3974e6b79369", "comment": "Malware payload (Loki)", "value": "f56732d49b44a54bd841c98e78c86dc04719eaec2fed43c2b6429abbcf7eee60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026244, "uuid": "64ffd3f2-5544-4114-a40d-ae9631ed8a79", "comment": "Malware payload (Loki)", "value": "d5c5900ab669c2b9aee41ddf9cdd3085b3af5a69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617026244, "uuid": "4ecdd9f6-fc5c-4385-94e7-b53e9dc950a7", "comment": "Malware payload (Loki)", "value": "5f1ef05f04c34a1c2d76dada071d82d56a5a68d5af93eb2896fbe965c429406732e3a223ddf4c065b5d5663dd72e71d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026244, "uuid": "3b6061ef-a488-4f1b-a2b3-1c1d7db6a4eb", "value": "FF25D38C2D99D1CAC5790B7986C9C8F646E95EF30F12C87AB8D82FCBF430795E106526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026244, "uuid": "b63cc5a9-fd2f-4f11-89f2-38d7d03820db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026244, "uuid": "5fa70149-1d42-4d1e-a012-539b7643d328", "value": "12288:a4A4KQ2LJZKEn2iN+CtmUk0TlnjxZiD7oAB45C7AulkCZxeE:a4Qzzn1OUllTSK5HkNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617026244, "uuid": "1b4260f4-d8fb-491e-b95f-27d349614a73", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617026244, "uuid": "7811385a-5849-410c-aaef-1e3928024167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617026244, "uuid": "a6ac5e7b-aecf-4a12-bdd6-27c5a51dc801", "value": "39291411ed14b0827245c81d2800ceeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5041e7bb-90a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031237, "uuid": "259b87d6-f68c-439b-9744-17e97a9f91bb", "comment": "Malware payload (IcedID)", "value": "2128ebdb9cc40d4e7c9221b984ab55c3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031237, "uuid": "050583e5-856a-41a4-9924-d54e4f2edd78", "comment": "Malware payload (IcedID)", "value": "f7074d4c10f9cae8402492c5cecff965b952ab3145034c945f3973b317f7b8c6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031237, "uuid": "af4f8222-2cda-463a-81e2-31249ff6756e", "comment": "Malware payload (IcedID)", "value": "e2fbf40cc225ecf9b7352d4073be299e185d4976", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031237, "uuid": "b9ce2e95-c7f3-421e-8adb-6c7998658c06", "comment": "Malware payload (IcedID)", "value": "e2eed47b26933838c0ddee5a981396c69fdf2390efbfb6af779ccb84089df1873210ededdb0b92c4c7512181cf7976b6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031237, "uuid": "cd1c9a10-a171-436e-ae5e-ec863f2d8a02", "value": "22B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031237, "uuid": "b3eed59e-e5d2-4ff3-8ac3-1e5e4880021d", "value": "3072:+26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:+LTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031237, "uuid": "3a49c3e7-b187-4c9c-a526-77471c899aa7", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031237, "uuid": "8da3e8ed-8f0a-4cb9-a2ec-50cc10bc3739", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031237, "uuid": "eba15d87-2ba0-497a-bc09-41335870745b", "value": "document-570232986.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28abe6ea-9071-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617010125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010125, "uuid": "a49cde52-85a5-4768-803a-b1857ecb9bc6", "comment": "Malware payload (AgentTesla)", "value": "d1be2fb23beea223c2832156fd9b6ccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010125, "uuid": "33e17bcf-4574-4cd5-ba23-fa6ced4bdf55", "comment": "Malware payload (AgentTesla)", "value": "f73561b68573c5ac9722520fcbf1139d8af507078a706495605adf1312ec007f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010125, "uuid": "000abc16-a4ba-4cec-8c4f-5417c12bd79c", "comment": "Malware payload (AgentTesla)", "value": "705ed8b6a43b034392f753b3800004b7c2eb9bfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617010125, "uuid": "5c70bc24-94b3-4946-af63-ee5c9131fa36", "comment": "Malware payload (AgentTesla)", "value": "82c2105550fa6dc2dfa38b6fe9ee2bbcb721cb61d09f3feef4c6b3e7080e66a0216f3b280ccf0d71b65fbb069d10922d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010125, "uuid": "2e8ccda7-cfd7-48ac-9135-4e16c59617e8", "value": "7725C28C6D9AC0CAC6390B7846CAD4F646E95FF30F22887AB9C45FCBF431745E50A526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010125, "uuid": "5bcaa4d7-0ae6-4dbb-a721-bedd2eb146ea", "value": "12288:uUgMhlttH2J2iNhXkHm0B+okEUDRpybl2mLNGmB5kkcg:JgMhltV2J1rkHPcU0HypJLNzJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617010125, "uuid": "8a373da9-57f5-49f4-812e-375d07598e79", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617010125, "uuid": "ce05d7d7-8325-4f9e-81a1-e90c3158f904", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617010125, "uuid": "46049a6b-52ef-4cf5-9849-d54fcb15a0ad", "value": "Rate_request.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53dc440-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617025903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025903, "uuid": "d4d2996e-1cac-4851-bf46-63ff42d5c6be", "comment": "Malware payload (Formbook)", "value": "32a337e8ac0912ec32e54553a0db095f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025903, "uuid": "6e18c53e-c944-4fb6-94f8-c0b500b1424e", "comment": "Malware payload (Formbook)", "value": "f86b0f3ec06d574080bd86e2980c7d04c29d4093d025fe592a567b5767031d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025903, "uuid": "46b45f59-9fce-494a-af32-1c2dcba38a12", "comment": "Malware payload (Formbook)", "value": "cae9825ea896c0dc7406ecfc07dd93504defceea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025903, "uuid": "6a935492-f800-4778-bd96-c9644a46c6df", "comment": "Malware payload (Formbook)", "value": "7fb564230aeeb5d4177e846fba1c95a7448c4f0f4ace3ed71a50c343d7265c46f63b9922de83d6d8f3b2d8d14d8cb7d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025903, "uuid": "15e8ffb0-e6b6-4f91-874b-b5f7de9b6fe9", "value": "1044C001B6F1C432E552097A4822C2A54937FC729F3466CB7B907F7E9E312E18A36757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025903, "uuid": "d42fca25-8bf2-4e0f-a30a-c20f9964fd6d", "value": "c76e846ddcafac1d54c770f3946391e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025903, "uuid": "332bc03e-223c-4499-8d0d-c8232a0fe845", "value": "6144:/FRQC4ttnLO7nWXckWyZ9Q3eYhRyGNadC6D1Z:nQC4txQn/kWC63VtaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025903, "uuid": "d05ab8ec-5b94-4779-a9dc-36d014ba3c16", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025903, "uuid": "bb6a66ce-e941-4f5c-a0a8-02bdc2f7639e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025903, "uuid": "aca48bc3-d7b9-49f3-bb0d-60a1e84f6b4c", "value": "32a337e8ac0912ec32e54553a0db095f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd44c822-9050-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616996201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996201, "uuid": "93d6a28a-ae4c-4c8a-8f0e-4b53d9f62f3b", "comment": "Malware payload (AgentTesla)", "value": "bac924457653072c31e7a12800642813", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996201, "uuid": "e3f36fd5-3d8b-4906-b346-1b883b63ec4e", "comment": "Malware payload (AgentTesla)", "value": "f86da0984972a912636cd654ce3650c36b600e2b69ed6276b5b898519bec6f48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996201, "uuid": "cf067fe3-28f5-4eec-9690-a19666bd8a7f", "comment": "Malware payload (AgentTesla)", "value": "d02a47290ebe02907dccd36622f787a833747a84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616996201, "uuid": "00fa0178-194c-4511-aa55-d38d113c5705", "comment": "Malware payload (AgentTesla)", "value": "549bd8ac7218b61d550f35224f6118c73bcf673013482a29a5d6451ce0f38b6010ac14428fc895bbe93abeab9fc4d514", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996201, "uuid": "47f25b07-6807-4b04-afe3-09990d5ca7a2", "value": "8A35289C2E49C8EBD2BD0A7842CD96C942E98AF32F21DC78BDC047D7D1A07C5E7125A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996201, "uuid": "6848d74d-d0c2-4abc-a1de-ccfc86eff809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996201, "uuid": "aef2c003-ae7a-44ab-9f16-951794d0f425", "value": "12288:vQzAzaz+5RhRtdaPjEhzg/GRDl55UCKwCs8cdcfU7YhTf742g09A9s0CRSel2ELl:HzAE6gZNKwCs8oKU7k4+iCRvlnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616996201, "uuid": "48227591-78c2-4e50-8035-f5a1e82d6bad", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616996201, "uuid": "61c0aea1-014a-455d-98a2-f47f694d841c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616996201, "uuid": "fa8b591f-15d3-4703-8abc-04d479d083f5", "value": "DTkJDjKTMtJ53Wf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceaff8a-90b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617039311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039311, "uuid": "527c62f6-6f90-446e-ac1a-abbcd5ad5996", "comment": "Malware payload (SnakeKeylogger)", "value": "ad826c2ed70b375bcd36786a60d3df86", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039311, "uuid": "51f90e34-7fae-4362-8419-0bbe21b27950", "comment": "Malware payload (SnakeKeylogger)", "value": "f890f18fdb71a95abcb3e4a0caa9cf8b86dfaf136d2e5351cfa4178badb79e21", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039311, "uuid": "b6b75bd7-49d5-447d-88d3-20340e6bac48", "comment": "Malware payload (SnakeKeylogger)", "value": "62470f30f73fd54d742d49953d43403be49402a0", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617039311, "uuid": "b1329542-ff6c-401f-bb9d-ac91f9032347", "comment": "Malware payload (SnakeKeylogger)", "value": "045d2a44e7e979ac7e46989bef9581eaf416784b67bedf89eb9248966999252ff1847e13f2aa02b0d1e4000a7753b5ef", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039311, "uuid": "c2dbe33c-43e9-4e46-800f-f38ea39643f9", "value": "65A423AA67F564DBC25358732DB3B13267B1A1C60B315EDB7FA83D4210126C4AE3A64C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039311, "uuid": "8c9f1786-57bb-420b-a07f-6ba6408830af", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039311, "uuid": "923c8568-4895-4c6a-8e49-45eb5db7e410", "value": "12288:Fbpi5BcVMYgmeuMtCRR32FSJ0NLdV2m6c:Bp1smnMtxo0l6m6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617039311, "uuid": "71699da3-dd69-45c3-a941-1b2148a79511", "value": 451015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617039311, "uuid": "6c78a251-6857-4519-8984-90f07dbf6021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617039311, "uuid": "522b5198-67f9-4ee3-a47d-ead44b078ff8", "value": "ej405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3c1231-9095-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1617025839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025839, "uuid": "0476a73a-4a4c-4ad3-9649-f7077f3cb3da", "comment": "Malware payload (ZLoader)", "value": "aed91721d74c66aeb070e54ec6ce713b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025839, "uuid": "95101da5-0255-4b9c-bb92-79a34ac0755c", "comment": "Malware payload (ZLoader)", "value": "f90816409b4b73f91008e5b1ff0d937a0d01fc500e772b5e99432bb40d55c1fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025839, "uuid": "15447907-3d9a-4469-ba21-9770a87672ec", "comment": "Malware payload (ZLoader)", "value": "320002e13e8df6fd157ef6e1c7fdb43df1a16a19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617025839, "uuid": "ca81d3ed-c43b-4972-942c-c83b04ac1e7f", "comment": "Malware payload (ZLoader)", "value": "040fc2d85906ad2544cdb7d59fd5c8370798534055d4b80daa137c23a7c078cd8f14c372da402125108146e00d2a5985", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025839, "uuid": "7c8e295c-e3bb-4b46-aaaf-fd15d21dd06f", "value": "C5630996B7C5E916C94907364CE6D7EA3322BC526F57C74B3288F72E1F366808E02647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025839, "uuid": "bdd19d44-9b09-4f29-a44d-33a2ceae96ac", "value": "1536:IUk3hbdlylKsgqopeJBWhZFGkE+cL2NdAGssMF4F1WT8UCLkCvqomMi9:IUk3hbdlylKsgqopeJBWhZFGkE+cL2NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617025839, "uuid": "7a5d994e-61d8-46e8-a2fa-39f48e3438dd", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617025839, "uuid": "f3db7bdc-fc71-48f4-9a46-ac084e301e4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617025839, "uuid": "5e7c3fc8-8fc2-4998-997e-8ddf9e87c9f6", "value": "Payment_Receipt_0624.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc5c84e-90a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617031826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031826, "uuid": "cbece65e-8d51-4a44-933a-bcf926c517d4", "comment": "Malware payload (IcedID)", "value": "dbb5b0a7b15e833b696eea2e5cfead25", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031826, "uuid": "beb73fef-e08c-4757-9b4f-4f1b6382305d", "comment": "Malware payload (IcedID)", "value": "f93612b70ba63d19e19ac0150eab50f6779463299074bec51632a577f9759c90", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031826, "uuid": "6480abee-80b5-410c-bdcb-120cb93427af", "comment": "Malware payload (IcedID)", "value": "53e6a110a136181e0552d20356fc41c867b811fe", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617031826, "uuid": "ec125791-86b1-4d99-9c3f-3b69b606f454", "comment": "Malware payload (IcedID)", "value": "6d2d5759940195f2db2430a7864e6e4bd6c66da785c9f643ef8ea44299ed55a583a78d3b0e95f7e3d9b3efe3edf3cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031826, "uuid": "760a0eac-32c8-46e2-b378-2e12c20604bd", "value": "9BB3B0BCCB06B0A7DA54DF3C854AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031826, "uuid": "fe922592-4c66-4069-8ceb-eb429deceeac", "value": "3072:826TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:8LTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617031826, "uuid": "0c46ac19-5dde-4d6e-aa5f-4905ab53baad", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617031826, "uuid": "8d625528-5566-4f8f-81a5-bc75340dacb1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617031826, "uuid": "fcdb98c8-2e4e-45b0-b812-bebc864cb94b", "value": "document-266184449.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df809f3-9098-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617027072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027072, "uuid": "c2b95c1e-b272-4d56-8f3d-f8e44a15122e", "comment": "Malware payload (Dridex)", "value": "a11e3363144d96a8a6fb059f27a1d42b", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027072, "uuid": "847768a6-a293-48dc-aa7e-644e699ed3c0", "comment": "Malware payload (Dridex)", "value": "f9cbd63dfa11a2994f05945f9efefb9ce3d5c49942e68715ee738cf345a2b1f0", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027072, "uuid": "8405dbf5-4d56-46bf-aa31-2335ede6fc45", "comment": "Malware payload (Dridex)", "value": "4cf3106fe627bfd250102d3dd5add4c2e592be80", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617027072, "uuid": "c180bf8c-39b6-44c1-8908-d47cfb5d5f23", "comment": "Malware payload (Dridex)", "value": "a0ace13659d17dd4c60b73f854039446076a66e45d9d2b410eebd527f5ddffbe2128e266ccab775c626fa91334906a50", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027072, "uuid": "46d8edf3-7ff5-4664-8730-e24bee77d69e", "value": "A874D013B2E64432D2725B3808B7D6108AFF79D09AB4D4EB669D265C2B177C05B3C39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027072, "uuid": "0e495a14-fc51-45bf-ab72-c5e53bb9c2d9", "value": "e7e490e0da58e39dbf299858321fb1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027072, "uuid": "4996833d-8740-453b-9952-44b2cca47e87", "value": "6144:NNcV3VDdp8+t1yTdawJZ1b9u7Q79nP+ymljFmboliWuh:DcVddH1gxZaE7h/mjsbRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617027072, "uuid": "1ee06e37-ae24-48f3-b18e-9a5023aeeab7", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617027072, "uuid": "8c23b9a2-75cc-4bac-87b7-b8d589796294", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617027072, "uuid": "caab635e-c3e4-44ff-a567-9526117c2e25", "value": "f9cbd63dfa11a2994f05945f9efefb9ce3d5c49942e68715ee738cf345a2b1f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc46447-9078-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617013190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013190, "uuid": "0c0f3959-526b-452e-87cf-a5710cbb8371", "comment": "Malware payload (AgentTesla)", "value": "acd216396d2889e229021aa0f9889137", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013190, "uuid": "4449b54d-5c64-41fa-a7cc-47e59b04316f", "comment": "Malware payload (AgentTesla)", "value": "fb072af644ead62b0a4abc9d795b6e400cb152d5e6b6aa6cf8f443716701383a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013190, "uuid": "ac5099c2-528c-4864-85c4-b6531fc614a3", "comment": "Malware payload (AgentTesla)", "value": "ec81bd5912ca7b24e6c3a36e6452e9d393d73646", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617013190, "uuid": "bed497da-7294-44bd-902f-99aa34c95627", "comment": "Malware payload (AgentTesla)", "value": "43c3aa35c69cf2286ce55f20f793b3015f4fc37e5288f695c3ea956549d20591dc894646c488c2d45c523db30e2c9150", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013190, "uuid": "668f0e4f-16ee-4d6c-a9a6-b21b9c2a5438", "value": "99B423846AF2E8247F0EB907E6FD467E19BD120DD51EC5C825B06EE24D6A234FD3418B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013190, "uuid": "2b7e7b5e-9ddf-4a1d-a1ae-a8541018d8cd", "value": "12288:n6bGm1IXywQD/LPFSNZePfz1kpAUde3J8zpOkHpFulKlISHQ:6bGo+URSqHKOUYilOC7Pi4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617013190, "uuid": "86a2a5e2-5f9b-4f95-a7c0-0045566d7e14", "value": 533557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617013190, "uuid": "e00584c6-10ee-49a6-b29b-bb05977c2214", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617013190, "uuid": "fef2c890-d689-4f9f-8931-0d523ddc3564", "value": "Proforma Invoice No.42037.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a139d8-905d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617001510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001510, "uuid": "731c74cc-6320-4877-b0c0-ff9f8daa9be6", "comment": "Malware payload (Smoke Loader)", "value": "e0059c4ad73116bf0ea29d575ea2c175", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001510, "uuid": "afc4f40e-cb27-4d6e-ade0-db07c00e24ca", "comment": "Malware payload (Smoke Loader)", "value": "fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001510, "uuid": "f7665003-fd89-4bf5-8c07-b309f35fc472", "comment": "Malware payload (Smoke Loader)", "value": "a1316534bb8a3b52ec4f14d8c3172e49f6c5760f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617001510, "uuid": "01592c1d-8bf8-46af-8782-edc55ca21f26", "comment": "Malware payload (Smoke Loader)", "value": "c11aecbe6c18a7a13a19779a0765415a752678fd7fcc40b0bde5dc20fae1bab87fb1c02099fac0b85ebfef07b26c0da5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001510, "uuid": "15dcb508-24f6-468d-bc35-1de0c96e12f1", "value": "B4F3AE0139D6C473E5A629714874C2F1163AFCB65B2256CB7BC43B6D5F322E28A39B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001510, "uuid": "ed4f20e5-3f3e-4051-b335-4f2570274603", "value": "3ecbda6de31890eaa5cd272ab1b192ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001510, "uuid": "dce0ef22-2ff7-475e-9e1a-646a1a57b230", "value": "3072:qCSrRmUaOy/LE6vTgr7kuvO72+wrtmGhoG7MqOKe/l0:qCSrROOSLE8MrbvubwRhHVol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617001510, "uuid": "dcef015f-82fa-49a2-ba7f-3e638ab9b7e7", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617001510, "uuid": "a5c498b5-9659-44b9-b2d4-0928452750da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617001510, "uuid": "e9d62fa3-0751-4ab4-8cf4-0f8f8ef0dbda", "value": "e0059c4ad73116bf0ea29d575ea2c175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459ace9d-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "2196b69c-8dc1-4b71-a757-fa7795a8e5d2", "comment": "Malware payload (Dridex)", "value": "f4b4cf0029102cac9dbc1039438b0bfd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "5dd7e429-af48-4f65-8c52-8106c909736b", "comment": "Malware payload (Dridex)", "value": "fb62ca3eb29dbf749d616e284177528c5103f71ae02f7c8dafdb4fe5951bb414", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "a1b00c51-c8ee-4eb9-9a76-871e3c1e73d3", "comment": "Malware payload (Dridex)", "value": "514b5dcfa746a972350856a0510bd4d4ce77064a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028212, "uuid": "892c9adc-a887-407d-8c2b-90b4cd18f6cc", "comment": "Malware payload (Dridex)", "value": "2adfe1c1306707ef51dc057863f9e6aaa97ff5abb4fa5cfd4de10d35ada99ecd63a2ddf7124f145b39d7b246ee1740be", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "6ee68e7a-48cc-4d5c-8bd3-141e989c3709", "value": "DC14AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "7092edac-c1ce-45ae-8925-0f5e7dc1da6a", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "11f7cb89-3ff1-4186-95f8-b29c1ed99919", "value": "3072:3pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:3BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028212, "uuid": "e853808c-cd16-4a82-9706-17118e859906", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028212, "uuid": "749fe481-cf97-4039-8d76-ce7eaa3130d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028212, "uuid": "db4f6966-b27c-4627-94f9-48bc16e716bb", "value": "fb62ca3eb29dbf749d616e284177528c5103f71ae02f7c8dafdb4fe5951bb414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c343f9e7-9076-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617012532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012532, "uuid": "9687751a-314e-400b-a938-6a9006fb79b8", "comment": "Malware payload (SnakeKeylogger)", "value": "9e21f3435acb635d83b1ba160dfc1c7a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012532, "uuid": "e730d449-5728-4e14-80c8-4a8b2551de28", "comment": "Malware payload (SnakeKeylogger)", "value": "fb7b7e784ab47eac5a00d76256305f9cccbb64606612105e236907e14a1e7aa9", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012532, "uuid": "0c54fda7-ef91-4c9a-b1b3-f394439b0e3c", "comment": "Malware payload (SnakeKeylogger)", "value": "6dc5b1c5088cf5718a19397dc534be6b0b3d9a0b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012532, "uuid": "a618b7e7-c24a-4bb1-a095-b90ac525ec70", "comment": "Malware payload (SnakeKeylogger)", "value": "8bc9992b5cb2d118fe4ceb6b9d8d5d58389e60f423d270a48c2a442092770c50254334195b21ed7b36cee75a2a483431", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012532, "uuid": "203b21cb-79d2-4681-b239-4f0711458664", "value": "A735D29120E8DD90D465ADB8CD5BDFF23716CDA38780D7E636BCE4762173B9AD00242A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012532, "uuid": "b1cfb6dc-0630-4cf3-b7d4-c603c6158db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012532, "uuid": "e1ad9b6e-ff9c-4bf9-a91e-858da29391b8", "value": "12288:6GNuif2B2vD1PLxJkKob1Qg7PqdjU7ccuzeUd7gi1UkJ:wiu2vpPUKobn7CdMcCmUi1HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012532, "uuid": "ad946311-e793-4ae3-b7ac-7abfa7410beb", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012532, "uuid": "8bda0392-98aa-461f-810a-9dc9f7907ee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012532, "uuid": "9ab9c72d-027d-4ac4-a91b-c125d641e12d", "value": "ASB swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2a93eb-9053-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1616997304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997304, "uuid": "2ad9a9f1-b01b-4530-9c84-0cd8665d88e7", "comment": "Malware payload (AZORult)", "value": "a9bc939e2a01a46f0dfde9ecf623e3bf", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997304, "uuid": "1bb4229f-3c65-4859-ba38-6a1a5e49d42c", "comment": "Malware payload (AZORult)", "value": "fb801d92deb2d8f21d2f12a825e2080613d0829ac3f3178fdea1da9a137b7c28", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997304, "uuid": "211a6b71-d9b7-4ec2-93d1-8eea15685f60", "comment": "Malware payload (AZORult)", "value": "93d7b5638eac3c57901778adce24857effc74512", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616997304, "uuid": "995fa3d2-d925-4109-ac4a-715a395e094b", "comment": "Malware payload (AZORult)", "value": "e7c84c01ae7eb78c62a967aea141486f54c9860b7721fc8dffc4c69aed79b4733bf101f664adacab84a8fd4eba0b6473", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997304, "uuid": "05411fbe-77ab-47e1-bbf5-b51034948a1d", "value": "F28483ACD19747ECCFCDB3B46A191E891208B76DE384E5533638A7B52B93C7A9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997304, "uuid": "52060f30-bb80-4176-8a12-f66d8a3865a5", "value": "6144:UmIq93P6RPd7b1m5cV0P80A/a+dbvMFro9irr5BAciP:XcPd7b16cV0PvANhUF5ROciP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616997304, "uuid": "765efecd-4a09-4a6d-accb-cc8be3e6e1a1", "value": 371019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616997304, "uuid": "5b15de66-da20-404f-9839-943cce7c9a8d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616997304, "uuid": "9fe73e5e-e5e6-4dd1-82cf-373941910c14", "value": "RFQ - 14000102697.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fe60f5-90b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617040593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040593, "uuid": "1698e8d3-175e-4e2b-a224-3e1543577633", "comment": "Malware payload (Formbook)", "value": "c774c3df375b0d8ad7cb452595ce6df6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040593, "uuid": "83974447-e8a8-4430-9965-240879258b6f", "comment": "Malware payload (Formbook)", "value": "fbad572e61544a5d6c132e233f6fedcff90d5426f874bb703de0922e53c5f2ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040593, "uuid": "9d584cbd-6c03-490d-9b46-401906ac4958", "comment": "Malware payload (Formbook)", "value": "4322dd5d4c44ecaffdc31a761a7493fc045d074f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617040593, "uuid": "7bb0dc49-5c56-4687-bb1d-455247832ddc", "comment": "Malware payload (Formbook)", "value": "a252264739fd271e00423491c7fe9217e9f256b6485e6344cccecfc3c2bdabf2d82ce3014aa1da0707bf0c0e77347df5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040593, "uuid": "7102952c-c560-45a9-88c5-044925521b9d", "value": "BE527D90977E5832C74CA1A742AA364E596DF1F51A1360F0BC8DB0E13FB12231EBE5B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040593, "uuid": "c1df5549-618c-42b2-898f-443fe96a2f67", "value": "384:DQG8cEPdmpmSJUlkRERISV3ccYLgdYvoL+gEp2gzhf9I:N6lgCcyV3SAXEpzRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617040593, "uuid": "e6b394a4-f9ba-4a78-b47f-942ef9921a52", "value": 14333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617040593, "uuid": "28e1d078-2c39-4185-908f-550e46385e2d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617040593, "uuid": "f11cc587-2158-4903-aa63-bb0ff0bf6dff", "value": "c774c3df375b0d8ad7cb452595ce6df6.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481f79f4-909b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617028216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "e54b480f-4935-4237-aa25-dcfc0b8f077c", "comment": "Malware payload (Dridex)", "value": "bf4484c2783a0b89cd10511ec7286e78", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "4cc5b805-3f5a-400e-9826-6eed20bbddd1", "comment": "Malware payload (Dridex)", "value": "fbcc45fdaf46057f15b2417a2c21ce244a93b5514cd2df1098e9ff99e0d0a96d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "8c655fa8-257c-4ec5-9650-6763843bb1ec", "comment": "Malware payload (Dridex)", "value": "362bf34fd67d8aa479ccd42ef784e96614b88abf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617028216, "uuid": "ac17d63d-767e-48c1-bfbe-2b2716150de1", "comment": "Malware payload (Dridex)", "value": "6a3a7880c6f4397db9131e676698ca67303efe24efd94a2c462cd6dc1edf5274db95dd16d6ae159de258096dc00072cd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "6ace4b59-2155-4cbb-b003-e23eba6e3ad4", "value": "A814AD6DCB76C4ABFBF7DEF111980A1248679D1184AF5848B8D1383FE83F4AD0AA554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "4218e858-d12d-4514-8eb2-f85ee0add0ae", "value": "8dad4a8aac2257f7f2d1b1616ddaa327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "32688d3c-1f4c-4b66-bc5f-cc4dd161a269", "value": "3072:8pRlPjgXYrhucUeTRtVkExtbArvPAyDGAbVNlhvkYbXLOrfO:8BPjthuHcZxVAzAzAdXbXLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617028216, "uuid": "f48746cc-7c8b-402e-a202-b96b4af77a21", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617028216, "uuid": "eef5788a-60b8-40bb-a90e-34ef1fa8d25e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617028216, "uuid": "8fb0f98e-8719-484a-b271-1f975a10d061", "value": "fbcc45fdaf46057f15b2417a2c21ce244a93b5514cd2df1098e9ff99e0d0a96d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fc32ea-90e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617060081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060081, "uuid": "e4f94dab-6a20-4e00-9f45-172545104715", "comment": "Malware payload (BitRAT)", "value": "c1399b4700b751dbf73eea4ca5f2cecc", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060081, "uuid": "9fe1ef4b-44d9-48e2-8090-03ac51b3f42d", "comment": "Malware payload (BitRAT)", "value": "fd4aa4467cae137c03d9658c1964a833e7d1e2a657e9425f6cbe212291351766", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060081, "uuid": "d5a2de24-eac9-4486-8453-1e8530ba189a", "comment": "Malware payload (BitRAT)", "value": "2f73e3252b2de380d19a3e559a09da4422622fd2", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617060081, "uuid": "f81b65e2-f977-4375-9366-274d338c5ba8", "comment": "Malware payload (BitRAT)", "value": "607723136bc48e4f473cf0e820db883ff6c3f9a03d18617ea45d13623193e3df68a6badfe4dfae2dbb79ca4687bd056d", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060081, "uuid": "3ba69907-4155-4529-944e-8808d0e99306", "value": "E4C321672091B259E2D309B42D16E8B43A09DF345984E10DE422B54CCFBA9F7BCDD8ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060081, "uuid": "d6ecc80b-0388-470e-9f9b-0ead0792b5c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060081, "uuid": "7d50a7ce-f341-4beb-aa3a-c267f169cde9", "value": "1536:uE34oFCHWlcq0vAfPy+5Zsy/M6GBTkCIqRCt3rEUZ:FCxadIKt7EUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617060081, "uuid": "37269cca-9483-4ac6-a76a-096ba8616df9", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617060081, "uuid": "2d2ca253-68ed-446d-8ec3-b91f8704a5e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617060081, "uuid": "ffc8ee7a-d29c-4365-a28a-b26782df8259", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7160acf6-90c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617044177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044177, "uuid": "1904b1ee-3f2c-40d1-a309-5cbaa42767f9", "comment": "Malware payload (BitRAT)", "value": "997f1fb7550282dfb7191d40396e9d3f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044177, "uuid": "b45e1566-7d83-427a-bafe-154406f7e93e", "comment": "Malware payload (BitRAT)", "value": "fd52b7c2b69a57bfa5bfb3ca6414665be1ff6f17d4d7ab061a8df45721fb3307", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044177, "uuid": "ad0d50b1-494c-4e85-9e53-6050bcfa6165", "comment": "Malware payload (BitRAT)", "value": "7fb7096ce28f8c07c50e0f2f7f22616539e0cd4d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617044177, "uuid": "84475392-1f0f-42bd-8aad-520bd2e026a6", "comment": "Malware payload (BitRAT)", "value": "8aa7b7223653b76ac1677294c65594f8d8324ab82a887669322e9fd59cc1de528ca9c214c565560b87b95d9a97344ff3", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617044177, "uuid": "ffceab76-05ef-4fbd-b3cb-1476d56f6f03", "value": "FC53C9E8C96514E7F9ECFA7093D3909EA635EC77A4114A27219781C3C4CE7826CC51BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617044177, "uuid": "91c0c42f-ea1a-4938-94f4-cbd00edcc5a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617044177, "uuid": "7600d60a-685f-4d1a-a60f-4594d3fff8d3", "value": "768:m7shpDPQDeuqvf1oQLcGmNyl8EauHStA/Gfl7KGflvx/FIwJGun51ulGflvx/FIm:m7shpDPQDeuqvf1oQLHm4Hoqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617044177, "uuid": "a9765f80-a057-48dd-9029-106674a05a49", "value": 66184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617044177, "uuid": "b634461b-7fc9-4cda-bc3d-d4e5d3cc9e05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617044177, "uuid": "f272dc67-45a6-491b-81b4-a8267820ce30", "value": "997f1fb7550282dfb7191d40396e9d3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7449c9d-9076-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617012619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012619, "uuid": "81342058-84d3-4c3c-829c-dcfb07805af5", "comment": "Malware payload (Loki)", "value": "96efb9d5b340d2210083381d3f81e9f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012619, "uuid": "3e18d7e0-c2fc-469a-8ff9-a5898fd85a91", "comment": "Malware payload (Loki)", "value": "fe54c015deab00950d33a3383af04379eaa0982e7db2252a8849a084e49d11b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012619, "uuid": "97874a27-b997-4536-a11d-75f79ff4b4af", "comment": "Malware payload (Loki)", "value": "9e1bd687ea2cf9d95121f6c34f223f2d59fb4d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617012619, "uuid": "ec2af239-915a-4d83-aca5-de42e9b41b03", "comment": "Malware payload (Loki)", "value": "97a468b453a29625323da2fbfe6d88a33972d2e775ab0573eae772b2520c6ba8b3fdaec847bf66b2ceba2954cd9b13bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012619, "uuid": "ec129c9c-97f9-4258-98a1-b800fabb780f", "value": "1B15C3CC1D8AD0E6C1758A7812C9D4F546E95EF30F22897AF4C85FCBE531749F20A62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012619, "uuid": "528d464e-220a-4638-aabc-5e5b4ab8f991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012619, "uuid": "05f13ce8-115e-4107-b688-58248c96d8f9", "value": "6144:BpgMhltv2cBbBJ2GhNPElTIhklsa9r2zzu3tkrTwCm4l1KVfQwIDTUOe787UgXSd:BpgMhltJJ2iNLk6ahmzE61EkY4KwsUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617012619, "uuid": "6a3b4665-8cc5-47fb-b8a3-9324aec6c53c", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617012619, "uuid": "40acfbbb-e17c-4c66-8a8a-c95a7082199f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617012619, "uuid": "0494eb41-8b32-4508-a40b-b1f539ff5d74", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a51811-9063-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617004394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004394, "uuid": "2fb7b561-033f-4ca8-9397-f3c869899e46", "comment": "Malware payload (AgentTesla)", "value": "7ef3d2c5621572fef4fe6c898a68adf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004394, "uuid": "a2bd3824-cca2-44c9-8947-191cde35562b", "comment": "Malware payload (AgentTesla)", "value": "fe8e69539064f02829922daa446bed806a0fc74e0036d961f1fd53021444f529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004394, "uuid": "4eba5a0b-bfe9-4db4-9004-4ea83cf72994", "comment": "Malware payload (AgentTesla)", "value": "b4cb7bb630a686b1071778867df8fb240711d3e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617004394, "uuid": "62e65c93-8b50-4c6b-84eb-c094df32fb1b", "comment": "Malware payload (AgentTesla)", "value": "b7fc9e2133f806a962542c3f9870ff10bb615cdea74111e4e463444579953b05d5859a4fa334717b091a7dc6a216f355", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004394, "uuid": "97719baf-2728-4790-aa3e-a4436ff5fdfc", "value": "62B308827C4F06A3D19D7DB301CBFA4037EEABE61933654A9D1C42732A71EC721DA15A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004394, "uuid": "5ea5c64a-0eaf-439f-801e-a3c08f7cf3d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004394, "uuid": "9cbf334a-3179-4d70-ae91-0effc59a71eb", "value": "3072:/gUM4AiOw9WpEsAuKcPLHcoYyWIWyxA5U:/gUM4AibU8uKqbWIW2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617004394, "uuid": "0d2f4dcb-e998-40f7-8e4d-47c2f5c539df", "value": 113328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617004394, "uuid": "b1417038-02d3-43e5-b13e-46b73fb12e9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617004394, "uuid": "0ff10ee4-ba3e-4532-85c0-52b002ac72a7", "value": "PO# 4648_9605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450827f9-905f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617002441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002441, "uuid": "37440e00-a9c2-48dd-8859-0def0eef733a", "comment": "Malware payload (AgentTesla)", "value": "c7412ea19bbb688a8cfc8ee443e900f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002441, "uuid": "1cedbc0f-85ab-4847-81ee-47f2ce8feec6", "comment": "Malware payload (AgentTesla)", "value": "fed81a580515d245c46a8225866fe46646e59c409c8e74eebb5023a57bcc5925", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002441, "uuid": "08ffc642-6beb-4b2c-a3ca-d7d100f366cb", "comment": "Malware payload (AgentTesla)", "value": "cf0745103e539967bea755c7a50611f3c8b261da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617002441, "uuid": "e5e2efcf-8cc3-4315-af14-8a7a32c36946", "comment": "Malware payload (AgentTesla)", "value": "0f59611711bd7e669181de999d903934dd8240edfbe5d78ab8300d71adfe784edaea63988c775fa19472cbddaae3c062", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002441, "uuid": "c14b7112-2a86-47d2-9787-db146d0ab7a3", "value": "1945498C1E98C2C6E2794BB881DDE49943F56EF38F22CC79BDD547CBC220B41E606526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002441, "uuid": "2e938fbd-470c-4d1f-a1ea-15c4da0dcd64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002441, "uuid": "7620d4c6-759e-4f1c-8221-5f39b4c65552", "value": "12288:Z/4RpSjKu8/y9kEidpJt3BJjBP/5dugJhQCc2Nl1sh8NUatNYHPOL06pNm3Ua:ZJXiD3Bb5dfeCj1shEdN22oa4Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617002441, "uuid": "4d6c7643-fbfb-4361-a610-78bd336083de", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617002441, "uuid": "cc28d55b-f609-4367-a1dd-3b8d12c4d80e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617002441, "uuid": "fe009289-d3bc-42a5-995c-9e90a1e7c4d4", "value": "c7412ea19bbb688a8cfc8ee443e900f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71e04f2-90a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617030658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030658, "uuid": "232fefa5-22d1-4a14-891e-3980f78015b5", "comment": "Malware payload (IcedID)", "value": "9f7ec20671693642998197b0c4837b39", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030658, "uuid": "3d37149c-6d28-488e-af7c-88897ca52dad", "comment": "Malware payload (IcedID)", "value": "ffa8f778b0e80f1925ea4a96af67086763bd3d77f4ed20eb81a2021984aee02d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030658, "uuid": "d7396b0a-cbdc-4628-9665-1e04adb98907", "comment": "Malware payload (IcedID)", "value": "8d4ab8028f4fd232220646220a7a48bb25c7de19", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617030658, "uuid": "14b9b8d8-3613-49ec-a82e-ce6c5f942e47", "comment": "Malware payload (IcedID)", "value": "921f3ff584c7b83089ad52284995735879602db1b3b8f10805818a4b6c14e747ca2eedc76179e512ec849131e543ac9c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030658, "uuid": "ebd2018b-2f90-482d-9803-7c2faf65f118", "value": "9904122DC0668D18C29280779854C699583A3426BCFCA56DB658BE8CFF673F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030658, "uuid": "08cc4035-a2de-457d-accd-c833a732a7ca", "value": "3072:23XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTMx89C10p:2nE5SDvbXAyHbVt15wTIxT10p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617030658, "uuid": "a0331562-c8ad-425f-83e2-a4861a11a152", "value": 177577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617030658, "uuid": "ba7234cb-dc03-41c3-9b3a-6821ab800d98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617030658, "uuid": "1c908de3-64c2-4112-b287-d38de3d09467", "value": "Claim50770662203292021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }