{ "Event": { "published": true, "date": "2021-05-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-10", "timestamp": 1620691382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "482f4381-9c77-436b-82ce-50b7a1c86a4e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd77a2c-b15c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629690, "uuid": "3b88e5dd-c5c6-4e0d-a6cf-f833d9463ff4", "comment": "Malware payload (AgentTesla)", "value": "8acdbceec690a7c9b03a2a2368630c1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629690, "uuid": "efd7ed86-9cff-4216-907c-9605c088774d", "comment": "Malware payload (AgentTesla)", "value": "0009367e86aa9ae85e24b7c77099cd63a6cc652e5d848e59fe7193e2d9284aa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629690, "uuid": "81954358-de51-4b56-8ae1-710deba93943", "comment": "Malware payload (AgentTesla)", "value": "b19adf6950f3e72af640247dc15abc714405b50a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629690, "uuid": "0c64d47f-5c44-404c-a66b-6684c4487c49", "comment": "Malware payload (AgentTesla)", "value": "074b5b552836b882b1047f7776505b85ee333227c074cb70c6752bccad58ba5ab46fd33e012066f2f6328dc344da41b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629690, "uuid": "358212c6-b57e-47c9-b124-43c39652a4c5", "value": "70F4DF2037D8AA58E57F87761970C55073F2BA1BC322C75E6A9E904E1D32746C7B2B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629690, "uuid": "1b7a75ca-086a-444c-a321-71c422efe0b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629690, "uuid": "4c1511d7-7ddc-4c19-932c-469ec9387eb3", "value": "12288:sIKcEtHcyX5tBVw1hhh4QeeJXrU8qonk2B2N+H4Qubj+/c7mB4/nUVwMyFII:s18yX5PGhhh4veJAexsN+YQeC/c7mBW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629690, "uuid": "34a4aead-6536-4761-9e98-7567e6297eef", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629690, "uuid": "975c04cf-86e5-4ac5-9d41-ac4c7da47f69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629690, "uuid": "7a6e136f-853f-4012-98e6-d18a3ebbee59", "value": "dVMxk14XPULdlBw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29612733-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669868, "uuid": "26add9ad-e939-4a22-a6e7-ea7620b10ef0", "comment": "Malware payload (Dridex)", "value": "e3feeb145477930e4b9362906a492fe2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669868, "uuid": "06b2aeb4-31d5-4e33-be82-0c790a1e324d", "comment": "Malware payload (Dridex)", "value": "0018c469ca0c9aa27bb510847d85b7bc6b9d1a2ced84e04e572b0bef55f77446", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669868, "uuid": "ee84e731-ce48-4ebc-9cb4-22c17e5554ee", "comment": "Malware payload (Dridex)", "value": "58b0455942af7c02c105f82f4ec76a976d8a14ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669868, "uuid": "ad453250-101b-46b6-8802-026ecd690428", "comment": "Malware payload (Dridex)", "value": "91da291cc83acd8f75c52b9fd872227f766c8db876361f6e915337793c0d2f3fcfdc6d77634949639036f88e8e0d5eed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669868, "uuid": "4e427775-65fc-4849-b378-149ed26e3c8c", "value": "30F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669868, "uuid": "b30ae7bf-6abe-4d60-b3fc-575b7abcc5e3", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669868, "uuid": "8f9ed5c4-c3f5-470a-ad3c-8daed86c6293", "value": "3072://FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLIe:VbrE1kvcB74DXZ2Melxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669868, "uuid": "c2359bbc-5fcd-4988-903b-44e6d43f1b9e", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669868, "uuid": "076475b2-c015-4d70-9f05-f7e5a80b93b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669868, "uuid": "02033e47-e9df-491a-9c2c-266954bc3357", "value": "e3feeb14_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc46e89-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633744, "uuid": "5b3f6bf8-4a03-4f4e-9a0a-686de42aedab", "comment": "Malware payload (Dridex)", "value": "069a7f5af5556904b07bd9ab4a577875", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633744, "uuid": "116a344f-16ae-4a95-bdc3-1c26462b0117", "comment": "Malware payload (Dridex)", "value": "004364f124dfeef90f821fd3c105131fffe61c4e5d57daa3f3f20f987cad6a92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633744, "uuid": "38668f09-e9c6-435b-95da-4ef2fe5e7ca8", "comment": "Malware payload (Dridex)", "value": "513b820624ea4188783a01e45475eaee3c56e63a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633744, "uuid": "f124346b-d45e-431d-9cc8-097c3c9dc514", "comment": "Malware payload (Dridex)", "value": "07315f0e19198b82398a0d2abcc36b4be75b0f0b53cdcf1ffdf00daedbeebb65a536f265c666cacffd094e68bfe3cd70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633744, "uuid": "586dc76a-c97c-47c5-9f00-961343bda372", "value": "D4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633744, "uuid": "a1193834-2433-4225-bcf2-7fcaa601ab93", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633744, "uuid": "21b0896f-9da8-49d7-8961-312d9addaddc", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633744, "uuid": "072732be-4c19-41eb-88e6-938b0be5a345", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633744, "uuid": "5ef0b5be-94e1-4e57-8651-4896b22da81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633744, "uuid": "f922860a-5f5c-4bf8-9071-5dbf520ba123", "value": "069a7f5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b24b200-b163-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620632639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632639, "uuid": "267285ea-21c4-45fa-b8c6-7f064e07a686", "comment": "Malware payload (ArkeiStealer)", "value": "cad72ed4ab28ddc575d3e141c2352b92", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632639, "uuid": "48f1f3c6-0e37-422e-b876-6c2d1ddda2c0", "comment": "Malware payload (ArkeiStealer)", "value": "00565beb9bda142f73ff90dc5b41a5049df50affa4ae24b3943f78b8de343226", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632639, "uuid": "74a81dce-0bf3-4a98-9948-44bfe58c6f7d", "comment": "Malware payload (ArkeiStealer)", "value": "c3d2a95fad4135d334e90922574fb6146d54cec1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632639, "uuid": "2057b3c3-055b-48a0-8be1-460cbcf2644e", "comment": "Malware payload (ArkeiStealer)", "value": "a077e12b1cc29fe30d31812a4036e7d566c92a00abf34d1a60600d693270bab2e1f2cbd6ea38dde1e657db67890ca967", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632639, "uuid": "78521d4c-4784-489f-802e-c2ad1e5260b5", "value": "DBE4D031B1F0C032EDA254794625C7B94EFAB4325A2569CB7BC81B78DF787C1B62134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632639, "uuid": "53e25569-d5c0-4fdd-bfe3-496e7526098c", "value": "1081d08840e3675cc42893f00fa49e61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632639, "uuid": "276c72ed-3098-4c82-bcd5-fb4b08ef661d", "value": "12288:LnQLP8stgHQlDxC0xZW3a5R4WBZV9P+OHHTBhVvrDeVoFHj3AxRv8:rQr8/QxxN0fYZJTLsUHb6v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632639, "uuid": "6f379b8d-5481-423c-88d6-23cc2e09346f", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632639, "uuid": "1824b91c-d920-4071-9d7f-32d815d9b08d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632639, "uuid": "29cf7343-96c2-44f5-bf17-d1a97bcc97f8", "value": "cad72ed4ab28ddc575d3e141c2352b92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e618a24c-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680492, "uuid": "5cb89cb9-3e3d-4e18-94fc-45fc7dac80f2", "comment": "Malware payload (Dridex)", "value": "f8e81385ea8229597453a0e898b9d87e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680492, "uuid": "8dbb7363-d6c3-49d2-84cc-979545b25b77", "comment": "Malware payload (Dridex)", "value": "0066076d961fc1d2f5e5832e0bcc9cae648b456034695fb3191a80270e692cad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680492, "uuid": "6f39d860-20c9-4048-b90e-01682d16940b", "comment": "Malware payload (Dridex)", "value": "2f38bd2506433d4bb8b1c957ddc07cdf841b4ae9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680492, "uuid": "29ac32d9-5c2f-4a0e-9c78-20712a52f4b0", "comment": "Malware payload (Dridex)", "value": "6be05e97827d8efdd0c07324e4f1cd984835d2479f24f426f4f1372ea83719e46d2e88816d3e8d16971be5fdac652f85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680492, "uuid": "f19ae671-5310-495b-ac42-b829a52ae8fd", "value": "67F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680492, "uuid": "e2bc9e8d-751c-437b-88c2-64ac57a83424", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680492, "uuid": "62906eda-3ba4-46df-ae0a-79bfda4ed8ab", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680492, "uuid": "56fd9cb7-1007-477c-9c2e-b209c8284449", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680492, "uuid": "179cb182-ea07-4310-9eb6-ac88f3b39b1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680492, "uuid": "4f9b9f3b-861f-4961-9bda-730e7502ee1a", "value": "f8e81385_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48089f5a-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620684092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684092, "uuid": "8092d853-5e57-4893-965b-818fffac94ba", "comment": "Malware payload", "value": "0ca4a6217509c742d013ffa9f5ec89f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684092, "uuid": "c5c2cfdd-4369-4ad4-b5e1-b342d9d7e943", "comment": "Malware payload", "value": "00b7c149ac18beeb773560c7fa83cf231410c3631c4a7ae88715fcbf742b4114", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684092, "uuid": "f1e55e8c-6dd9-4c32-8aca-f6609a17b81e", "comment": "Malware payload", "value": "65a9fa569ee86f7807c66c3ccc5e46c44cc1bbaa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684092, "uuid": "e95a36c6-dc2c-4e47-92a4-16c34ae55d73", "comment": "Malware payload", "value": "619b6d3842fbba566144733747034aeb3b4662cc14fad276b58e00ed68fac12c686c7cdf43aadf216e6cfc87501c47f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684092, "uuid": "b7c036d6-5a18-4110-8b36-d2eacca9a785", "value": "F1F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684092, "uuid": "0bd08f16-1e22-40a8-a185-794a6aa4fa98", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684092, "uuid": "7fec7811-f18a-42f9-ab2e-7b355f92cd75", "value": "3072:MIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Fc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684092, "uuid": "448dfeb9-c4fa-4a0d-b51b-c832648c7662", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684092, "uuid": "c9b0bff0-7451-4247-8011-f50c01984799", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684092, "uuid": "ab9dd067-8d7f-43df-8a4f-97632ebeae26", "value": "0ca4a621_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e161cc0-b1df-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620685713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685713, "uuid": "e11c139d-bb8c-4daa-b11b-271171f007fe", "comment": "Malware payload", "value": "cdbcdf4556113dabacc3d3f19949ed75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685713, "uuid": "cc34aacd-e04c-4c88-a620-d43deb4e8a4a", "comment": "Malware payload", "value": "012a4ff40cb29b0f31d4ab1089eab7296666e3477bcb8e508517074df9768894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685713, "uuid": "065b5b78-303a-4f64-96a8-9da41a69e832", "comment": "Malware payload", "value": "824d9514de587cc921e04e6fb2c7dd2bb8c8687f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685713, "uuid": "7f56087f-9a41-4bb8-92e1-0d4e05c75fd6", "comment": "Malware payload", "value": "66cd6b3205a8173793bc90da907749b12afc0b49e1c579825c612dde352eadf7f7c4450e644eacc698def22e3560bf40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685713, "uuid": "a567ba2a-dd72-4bdf-ba68-e684371e7de4", "value": "E0733937A551C93AC01B91F01BEB9A62AC22BCFF0A72305A63E0FD655F398C11E59F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685713, "uuid": "f188433a-078f-45ac-9769-50c7daa660d8", "value": "1536:en45ZBrIbQzdHKb4lOX9nMD0ZXBD4X6buJELxwzxfU3fd:O45wbQdHKb4lOX6ESX6bumxwzBAfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620685713, "uuid": "28fcd721-081e-4f76-b25c-b4eeb98c8199", "value": 79392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620685713, "uuid": "196d5fad-0ace-42a4-a12a-d997b5b00495", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685713, "uuid": "6e49031d-0ab8-4333-a772-36f7c55efce0", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f62df3-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "a902c820-b0bf-4ada-99bb-1131afe7cf98", "comment": "Malware payload (AgentTesla)", "value": "0e5fbe4c8041060dec2d52de04503c44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "78c2c466-2782-4b9b-8bcd-876fde5b69a5", "comment": "Malware payload (AgentTesla)", "value": "0136fab4bad316f9ec7d7e9df3405dfac4341b5dfb61f74f906bff0a2b86d909", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "fd999081-f7d1-4912-8b29-6b360ef94bef", "comment": "Malware payload (AgentTesla)", "value": "1764f4140a8a61d5bcb38bf2a3a449e6b2284bb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "b26d3f13-311b-461a-8d62-8e99803b81e1", "comment": "Malware payload (AgentTesla)", "value": "b1eb810a3ee81c3d26a4f8faa30ac7f00a4bd4ad872adac5491810cf9c6ca455c08b20ba16c91a95d5f2fd705f16ec39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "2444a0d8-5b02-494d-9296-fc47274a88d6", "value": "68F4CF253398AF65D83EA7391135551013F2BE07D731EA8D7DF6B4DA0AB2F808626B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "5c8cf320-7c93-4751-b53d-af012f6274c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "6f5001dc-5a4c-48f9-8c9c-b94ec86b60b1", "value": "12288:xk7SMFppkX5GHjt3jLdOsrG5MESAftoQunwrhzOpX:xMSx5ARvIsySAdphz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651843, "uuid": "66f1673d-ec11-4380-91fb-ab34605ed9c5", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651843, "uuid": "d2e3ba6b-ae5b-4e48-b0f5-f70338ae8269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "a71c1762-934c-421c-a111-f20fce9a87dd", "value": "0e5fbe4c8041060dec2d52de04503c44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4927b2f-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620649109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649109, "uuid": "ca158080-abc5-42c2-9649-1e00223e20eb", "comment": "Malware payload (SnakeKeylogger)", "value": "6989acbd9d6104b59fdbf6cb0473cd35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649109, "uuid": "8213bce2-e75f-4252-afe7-ad59fd8c9641", "comment": "Malware payload (SnakeKeylogger)", "value": "014f64defb76d4f14751fc7352aa2e3f4a9b09e4f2f0e2ef506331fd78eb7636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649109, "uuid": "5641f325-be8e-411e-8dc0-cba16cbe8534", "comment": "Malware payload (SnakeKeylogger)", "value": "6a115b362b500baf8fa898214b37856615971f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649109, "uuid": "683bbaf1-6d57-438d-b358-55cf9c33c50d", "comment": "Malware payload (SnakeKeylogger)", "value": "a093b38e303257c16850951977e30505fc0bca2fd4e2a97dc4f72c49fb1d357310448c62197c11a8ca3e23a07d5961ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649109, "uuid": "e668eb28-3a4d-489f-8f78-3af3b2df5530", "value": "34A41248A6C9C705DAB74E7DA4D0C97473363F44D123EACB384BB28D477A305E6A0D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649109, "uuid": "3dade165-f307-4603-8e8b-5fd34ba5dee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649109, "uuid": "ec41242f-ad8a-409a-87c0-fb25a90ade82", "value": "12288:oHFMw7Y9MA59CyMAn0fsb/cjMiTq5oLB:oH+w09tV8sb/cAiTCoLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649109, "uuid": "3681c3dc-0b46-4a08-b1d3-d1911eea1c0b", "value": 457528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649109, "uuid": "d61378ab-4fd1-4136-8e4e-9a102eca8b7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649109, "uuid": "f544edc4-dd88-4261-acfe-8bd8db9f0df2", "value": "IMG_0125_30_227_06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36000084-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630805, "uuid": "9287d323-da23-44b6-a082-8af10542418b", "comment": "Malware payload (AgentTesla)", "value": "d6a10e82c19c5b8181ce2529ece74039", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630805, "uuid": "578609f3-26fc-464c-9b99-d9b7ffbe47ca", "comment": "Malware payload (AgentTesla)", "value": "01ec3c8e84c08d1a85b26ab924c54a9bcdbb21139b3be46cfe8040d88ecd3891", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630805, "uuid": "3e5b9896-4543-427f-8750-fdd48d4175f6", "comment": "Malware payload (AgentTesla)", "value": "f29dfb1a434a08ace74e83f0fca51be72353cb1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630805, "uuid": "85d6afd6-a993-4c63-a440-65644df55a85", "comment": "Malware payload (AgentTesla)", "value": "8163f7f5e51a954122fc7cf5c8d5f89a872d2ac43a7943ef83f6c7aac611321e232e909f450d431e4cc262ca29971418", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630805, "uuid": "fb71d470-4404-48a4-b395-3b78d0013047", "value": "282508AC721071EEC657CC239BDA1C25D620217A972F9607932303BD9E0EE57AF345E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630805, "uuid": "37bcdc14-ffae-4b80-87a3-2cbb3fac25c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630805, "uuid": "4f864e95-1b69-45f3-8622-036239eb501d", "value": "24576:q2sGIIoLAa6cUY1V2xdyp4SUWqsAOviK5G:4GIV6cj1Zpz5AOvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630805, "uuid": "c00e8881-2cbf-4521-b6f2-9ebeb70c5ed8", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630805, "uuid": "b3e6a7df-dfa1-4e9a-b050-d1c7b67c365a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630805, "uuid": "226f5de8-adeb-4941-b32f-515d8c8c0ac1", "value": "PO-87644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66537400-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648066, "uuid": "59db196f-4ab2-403b-8367-88e4d9fe7a45", "comment": "Malware payload (Dridex)", "value": "2c21829477caa5d53d37cab66f583c95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648066, "uuid": "89f7751f-a780-4a6a-b667-393b10870b2d", "comment": "Malware payload (Dridex)", "value": "01f8854164ccddc7f528d6c7d80d029e0dd655b4d673272fcd16955e4d06a2d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648066, "uuid": "edb47de6-8683-4f74-8072-20ab5907b867", "comment": "Malware payload (Dridex)", "value": "3175e120077275489197c71522aa7f46bf33a150", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648066, "uuid": "4ac03a8f-5eee-4655-bb34-2e84b51f3450", "comment": "Malware payload (Dridex)", "value": "9513f63c56bc6be9e16b39307023a4b144ae8e38fdfdf78ace1daed6c180871adce2d9e3663c896d43ed017389e99041", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648066, "uuid": "0b7feba9-5f82-486c-b750-8956f092b8a0", "value": "34F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648066, "uuid": "b09a1080-3197-4e01-9c4c-4530d69e834b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648066, "uuid": "a8f63ddf-16db-4b71-8f87-8f0b72e45d39", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648066, "uuid": "68edd43d-04d9-49d4-911c-b1f48892b374", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648066, "uuid": "7eb2590c-0bbb-4326-9692-e98708a416bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648066, "uuid": "d916ba1f-3d87-4932-8a9b-df636cf62865", "value": "2c218294_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e0c5ba-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620666261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666261, "uuid": "1d085ecd-805c-4d19-9123-2191d7aa909f", "comment": "Malware payload (Quakbot)", "value": "8b242e226ff0378ff50ecdb6db2e2f47", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666261, "uuid": "aa1cccea-f90e-49f2-9c93-609043c9b4d8", "comment": "Malware payload (Quakbot)", "value": "02d173c5df66313e059863e96378097c8e1b9b16a8e3fd0eba2860b7c74ff8a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666261, "uuid": "6eb11137-7f4a-40b6-9c5f-c54068eb05fc", "comment": "Malware payload (Quakbot)", "value": "f1a288193f510964602d634e86f186651c2a55c6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666261, "uuid": "a379e73d-73a8-4a53-82ea-6fc1e1e1ce9c", "comment": "Malware payload (Quakbot)", "value": "6ca9715b1c06151fd7be5b6cdaea68e11b72aad45c102fcb071f1b999c18617045c87dc08ad23fd87746ca366ed46604", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666261, "uuid": "1be76894-9f27-4e45-9421-49dda9e9a3cf", "value": "09B3AC0BCC484AD7C16E93FE7D474DF86E0E5728D8926FEF00221F863A255A31D4B56A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666261, "uuid": "dc25bafa-5f4b-4d0c-ba32-6e2a4796040b", "value": "3072:TtWf/vKINbjvw548LMb/oqKO8NnS8+60KchLD:TwfaAbT648LM7D98Np+E0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666261, "uuid": "fd60e3f3-4e7e-4ce7-9578-296225349656", "value": 113128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666261, "uuid": "5cdea1d1-f60c-4800-bdd4-96a534c9762d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666261, "uuid": "6a4a8c9d-749a-4c38-85a1-a052498bafb4", "value": "3863969412-05102021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9fc580-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620649636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649636, "uuid": "6922ac74-7490-4ee5-8a01-c91ef546eae8", "comment": "Malware payload", "value": "fbe8527fb051e524feba08f22f1ec148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649636, "uuid": "bcae6930-248c-4a94-8491-80db96b4dafa", "comment": "Malware payload", "value": "03031069effcc682a77ef6309fa1cea1ea2393dc4e385312952ca9b245ec4a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649636, "uuid": "41e4a6c1-828e-431e-9e9c-19307abb9493", "comment": "Malware payload", "value": "05f5cb37f4d377af8cb625b692fa35f76e1523ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649636, "uuid": "2139117a-0554-4be0-9127-f746bf8e600a", "comment": "Malware payload", "value": "e39f54f1c3da722f9e091d03dc7fc6b67fdf2e86c3ee116155978b7e8de99875cd4b4e2762c9e48d5148ac3805c75fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649636, "uuid": "1d725b92-4b9f-45d8-b0e4-346fc4340111", "value": "C5F4BF2DB5947E10EABD0E3FC5A5A16080FEED065D17D66E48F03ACCACB77A8D41160B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649636, "uuid": "0ac637ca-e387-4990-aa07-d7d6c6d69e9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649636, "uuid": "8facad46-d64d-4468-bf2d-e17cb0794988", "value": "12288:pORak+kHVChgsrj3fm5PritcV+tLHFGSeMOOy8seMsPgOf0k5:p0a6sFjv0TIHFGV/b8seDgOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649636, "uuid": "eb7665fd-2e65-4de5-a443-41071c1f9101", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649636, "uuid": "841c93f0-dafb-412f-8d7a-ed1c76a87198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649636, "uuid": "93074bcf-87d4-4e91-bf52-4d504e5d3a3f", "value": "SKBMT_May Purchase Order 5870Z904_ PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9961c31-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620676955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676955, "uuid": "37698246-0d35-4b0a-9f71-3bad8c258cef", "comment": "Malware payload", "value": "eb57884ef883f253f324f0bd9a476bf3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676955, "uuid": "4d5d64b2-1f44-4f87-907a-de2ee51ecf6a", "comment": "Malware payload", "value": "03310e5677705d676c834eaef1ffad96fff6cc7f50e618c08c29853db06e94f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676955, "uuid": "d06a5da8-8b1e-4124-a7db-da1e61fff564", "comment": "Malware payload", "value": "a554e9d0feca3657e9b55eaf124ee59154d481ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676955, "uuid": "dff80aa1-c6d8-4ecc-8e28-b9502258570e", "comment": "Malware payload", "value": "3dfb0c31ca249e5f86615f39ec8a40fac9560766957df483951b09d50ba472d22bf7e57ecd719fd7c0e787ae3f055112", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676955, "uuid": "6bea31dc-bf22-4ac7-a080-b04ab790476c", "value": "7203E02F877F5059C78F02B38C852A5CBA12F8B109837A153635CC0C6BA7B77653A12B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676955, "uuid": "cb13454c-d8a9-4522-9a35-af5831ac3ea8", "value": "768:xQ7cUx4dTVuspEbjrTiLV4fzJsf7/Ov8T/POQQXIGA9+OlQ/HkJ0n0R:5VuXfY4fz0dHOcMyCEEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676955, "uuid": "c93c6720-1fc5-4e8f-8f80-35ad9408fda3", "value": 38437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676955, "uuid": "e8b89270-ae3f-4d72-87ec-5835413076e4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676955, "uuid": "af4318bd-9e5b-4794-83ca-95d1923c1f49", "value": "eb57884e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21ebc1b-b17b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620643039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643039, "uuid": "aad7c04e-6c96-421f-ab1e-fd4a4d6bda70", "comment": "Malware payload (AgentTesla)", "value": "9d3aa67b04af92698f51bcfb156197e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643039, "uuid": "5a328200-e623-468e-a22a-f6a5d5cb4d46", "comment": "Malware payload (AgentTesla)", "value": "03d0c28c82537bc47e03f83532cdfd576b1524451a4dc7ea69f150b30cfaf65e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643039, "uuid": "5b7afa3e-c4e4-4b2c-9d52-4ede3d4a19d4", "comment": "Malware payload (AgentTesla)", "value": "cddef66035b1230850f40cc3d989b9e7693cd80c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643039, "uuid": "f110ba98-5814-4f64-be0e-ae92fc92820d", "comment": "Malware payload (AgentTesla)", "value": "65cd208e5f7c0798ceccf03ca16a598b2f7be747d03c737de06235758c9f2e5f4d37a0680483d8e3bd79e326dc0bb6cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643039, "uuid": "d3202f06-9925-4c00-92ee-4abfdcb4cef5", "value": "21C401B457485F2BC27E18BC208022C153F9E1326E53E78D5EE844BD62633EE4A716DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643039, "uuid": "aab2633e-38f2-4458-82fd-b612d64a384c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643039, "uuid": "8e67fd86-5b62-4a4f-bcff-a599796052ea", "value": "12288:3Ptu98gi9I6izNzbyb9e4G6oMDO6f7DHcgm+MeeqR:3MS9bizxYvyMDO6f77cgm+V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620643039, "uuid": "22a593a5-0189-4c25-bd6d-0c76efd2647c", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620643039, "uuid": "63e9f481-6df3-4b18-8a14-ae5300006fc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643039, "uuid": "532f192c-a690-448c-b8d6-d6be856bb543", "value": "PI.479363_003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c0cece-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633760, "uuid": "390c54fd-6b47-490f-beea-5147d32f3204", "comment": "Malware payload (Dridex)", "value": "74cc2a752813faf608013a3194ea65ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633760, "uuid": "2cf1a711-7398-4d78-bf3e-2cd7e7514f1f", "comment": "Malware payload (Dridex)", "value": "03e452d8279b7cae30554b229a4b0a0faf507fecb01c1e75c2f655ae3ceb51b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633760, "uuid": "9e1f4d95-48ff-445c-8bea-6c1d35267735", "comment": "Malware payload (Dridex)", "value": "4af6df8baac366a184a521462c0b8170d9344379", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633760, "uuid": "e30e8148-b7fd-434b-b0ea-b3be195c4a35", "comment": "Malware payload (Dridex)", "value": "e457a3db36ad95ca3df1c0105f68d64d6f436e87dddf9d2db1311d361176d0c1fb2d454f90d6e9b6a3d7fc8e96e46352", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633760, "uuid": "bf00d785-fc87-47dc-83b0-99f28bbf1456", "value": "F8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633760, "uuid": "3b8b5cb6-458e-4e90-8bbf-34cf39746cf5", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633760, "uuid": "23597a97-c04e-481f-a9f3-753c7b452ab2", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633760, "uuid": "4dea1070-7d82-49ce-bae3-174e129851b8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633760, "uuid": "62469bba-a19d-4e48-9a7e-59d1344cf8a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633760, "uuid": "05762d09-4ff6-4b5a-95e4-d545562bed00", "value": "74cc2a75_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49d91f5-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669779, "uuid": "abd8fca7-58f2-4b0d-92b8-3d5d69a28099", "comment": "Malware payload (Dridex)", "value": "9acd906193cea611928ab7497d2c4f40", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669779, "uuid": "99cd2991-2c29-4c3b-9a05-68bdbfc26ee1", "comment": "Malware payload (Dridex)", "value": "042c9610426fc441d7789841fd4bee4a6f4427ba0e432c1e3cc993e41f99054d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669779, "uuid": "daf51208-93b9-4017-b5db-20e3f349fe8e", "comment": "Malware payload (Dridex)", "value": "d79135918e8bd87baa5a9e378ed79c651f8e22e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669779, "uuid": "52f22b71-6a08-48b7-8eaa-e5bc318a57dd", "comment": "Malware payload (Dridex)", "value": "e8c8944aff7cd7adc48d210ab2f4128395c954e6dab01d41fcf797434e9442b09c496907ee6103d5775bd70facec8137", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669779, "uuid": "90687ff0-a6be-49d0-9cd4-d369623ebee8", "value": "A4F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669779, "uuid": "f3b67f32-ed92-46e9-879f-bdaefa53a6fb", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669779, "uuid": "d22314bf-73a6-4147-8dc9-6b64ea94f2b5", "value": "3072:+/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL0D:0brE1kvcB74DXZ2MelVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669779, "uuid": "a7eefec1-5a27-43a6-a7fd-8b19b6dc9a2c", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669779, "uuid": "e298d78f-e29a-42db-9401-8b7613006eaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669779, "uuid": "7afdb243-c1b3-4203-8999-3f894d4d7d6b", "value": "9acd9061_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36731001-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651851, "uuid": "051ddacd-c10e-4bc1-b4c6-cf52d898878f", "comment": "Malware payload (Dridex)", "value": "7e67ac8f4deb515121cae3de3a8f1653", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651851, "uuid": "28d1b46b-1d60-4b5b-818a-78fc2a8aeab8", "comment": "Malware payload (Dridex)", "value": "04454d4ce74c80096e62649e097172dceee6c16e9814f533441be84e2941ef30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651851, "uuid": "6242cd22-a9db-4d2b-9bb7-4894f93c0dd2", "comment": "Malware payload (Dridex)", "value": "9ebcd5e844b8a9ea20c4d1d5549fe696b8749085", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651851, "uuid": "5c28a084-88e4-41bf-8a57-979876c20e84", "comment": "Malware payload (Dridex)", "value": "8dcc00bc163f4b98841c38bc26c57a0801613000ca6c549427b5da426db9553f134d925f4c264d29a7db620bfd33bb52", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651851, "uuid": "1d4f6b2e-9f05-46fe-b886-a0fbc4da8734", "value": "19F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651851, "uuid": "1dbccf08-a274-468e-a26a-2a76d0c01463", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651851, "uuid": "0f83d6c3-61a3-4945-ab3b-e28b56713b70", "value": "3072:YuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:Y0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651851, "uuid": "eea4b761-f8e7-437e-8356-fb1983854a87", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651851, "uuid": "1ec83a4d-b36a-4f76-8bd6-d9ad7824e967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651851, "uuid": "a5929918-6670-43b7-8bd3-4467b4cc1bfd", "value": "7e67ac8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f0c029-b1cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620678957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620678957, "uuid": "5b1c28b7-13a9-4767-85fb-25c9647f07a7", "comment": "Malware payload (STRRAT)", "value": "a2ad732abd9ea9e17106bf15779ef8ba", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620678957, "uuid": "b6d78d05-8103-4286-8e42-1db8a75a4eb5", "comment": "Malware payload (STRRAT)", "value": "04573581b8dbac32d0691319c9a4afd6b98a00bb76e5c056bd2f0b41a4273c41", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620678957, "uuid": "3681bad3-3e9b-4403-b89b-f794ed34fc89", "comment": "Malware payload (STRRAT)", "value": "fed9ae875af4b0e9b079faccb3b4aea3d64668ae", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620678957, "uuid": "4d6a87cb-7429-4b1e-a5d2-8b965f695e62", "comment": "Malware payload (STRRAT)", "value": "900cc3debfb752688aab37bc21ac88372b655c8ffacd1ace4621f8972a5b2b698d55eed7065716ada8b87ea1101fdfd6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620678957, "uuid": "dcc1ef4a-ba4f-4e29-9cf2-ea8e13448194", "value": "83A3E00BBC9AE8C0EB4B403718450A72EB5D9598E905A02FABFC75940E70D7D9E46D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620678957, "uuid": "341de57c-d723-4a2a-8fd0-18eda0a89d41", "value": "3072:sVQdnS2j8naWMWU+h719s3+vmVDDr75XOMP:sVQsnlMr+h7wJDr7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620678957, "uuid": "763a6e14-d15a-41ca-af27-d6c98918c2dc", "value": 103028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620678957, "uuid": "a39384a1-106d-442f-a986-0e4d5e906a29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620678957, "uuid": "4eb4e603-a1a9-4215-8a81-36951e98d570", "value": "Signed Contract.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0fd1b5-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624857, "uuid": "ba4c3607-d481-4fd0-a9dd-e42c80973da0", "comment": "Malware payload (AgentTesla)", "value": "f2039b53a2a8aa0aed12522a45d8aada", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624857, "uuid": "2a6c2a57-ca0c-451c-b07b-54664b5def54", "comment": "Malware payload (AgentTesla)", "value": "04c9f1b4dbc87aaa1c68c06f21a6b882b1a2de447ffd87fcd0972cb5b13e6c2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624857, "uuid": "84a250b5-e185-4731-8e95-273271fec148", "comment": "Malware payload (AgentTesla)", "value": "eff9abf581bb3879c6b6733406ac46c8fde5cfba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624857, "uuid": "81b3451b-74e6-49bb-97fa-727545a6025b", "comment": "Malware payload (AgentTesla)", "value": "6f5ac141e3a0621bfa1133f11ca7a00a2c50c80165aa34e9ffd172e811436f097a91285a82bedcc9c50c1ca4410f8604", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624857, "uuid": "0462f7ab-9050-4813-b373-e10c830d1bc7", "value": "CED423B7EE25D7F30BE4BD4EED64B72349853402BA72F31A0D05BA4A1324570AD60F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624857, "uuid": "11c1f2b4-d7e2-4ef9-95b1-3fd020063b20", "value": "12288:8d9KtRhzgsTNnl1dpfy+NwS1Yb6IwJyUk0/oMBe9mC7kt55dusth:8dUtRFgs7bp6s3YuIB0RBFC7kb5kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624857, "uuid": "8eef9d8c-bc32-4ae9-bab3-d4b860472d74", "value": 597786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624857, "uuid": "8bddf368-07d4-4215-9587-69e3e41017c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624857, "uuid": "6b0ec745-d9fd-42c8-a4a0-e9d40bc6fda4", "value": "HBL-20210510 INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6ff8cb-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684044, "uuid": "3d6998d9-476e-4eee-863f-a8bc5539e61e", "comment": "Malware payload (Dridex)", "value": "79981eccdb2fa9c8e70c5ff141a07108", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684044, "uuid": "c4241048-223a-4be8-b0bb-35a57f4d2a26", "comment": "Malware payload (Dridex)", "value": "053f81fafc034f54268260330bf947400b112ec9463d72b8391848b335c74d04", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684044, "uuid": "0fcb4933-f4fb-4573-95c5-39e728e00797", "comment": "Malware payload (Dridex)", "value": "29cdcf0d4465c2d75933fa8af41a4e958bd323e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684044, "uuid": "6ff424a1-80cf-4272-bb8d-ed7e497ed498", "comment": "Malware payload (Dridex)", "value": "e2295b3bb69908ce88c22a907ec82c74dab60ba52dcf9ad3a4a7249df967ec76f970a531fd9ecd9579f4168c97705a67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684044, "uuid": "df4f311f-e129-4016-87bd-70c56ed94ab0", "value": "E7F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684044, "uuid": "8151424a-c9df-45fc-9dfe-a6608faca4d0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684044, "uuid": "6f3d7e8b-ba23-4d73-b2a9-7f9554958bef", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684044, "uuid": "3a5cd51f-b2d9-4ede-9ac5-2b2f8ff5af55", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684044, "uuid": "f968027e-860d-4126-9e2c-6cfec87cba46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684044, "uuid": "8db852d3-f3b5-4e4a-be83-2230b909f36a", "value": "79981ecc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760b7548-b17e-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620644226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644226, "uuid": "b33a60aa-b5d7-4a07-9fba-80c767c33c15", "comment": "Malware payload (SnakeKeylogger)", "value": "f4733844cc2cff123bc89c40f4d516c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644226, "uuid": "87df3ad3-9951-43ba-a6af-b4f33c6920b0", "comment": "Malware payload (SnakeKeylogger)", "value": "055b0123b03fa1f419602ae22be4ba683b3d62eb10c3584643ff510f72ad0151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644226, "uuid": "ac683a96-f481-4a33-aacf-cad5fd8c859e", "comment": "Malware payload (SnakeKeylogger)", "value": "4add8b9f344dd008c981d900e2c44a6e85ac92af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644226, "uuid": "a2562e32-c1e4-41c6-b15a-c78f30b06150", "comment": "Malware payload (SnakeKeylogger)", "value": "e8b2ad02e1a8d917720e75bfca8a01d3b27886f335d0521af850838e0cea81b5fc3b0f3df6c8cd478130a76172d807fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644226, "uuid": "204fb684-24a3-492d-9e09-c5fb8ba60f50", "value": "22258D98314498E5D21B2DB363CF5C1142743978A43BDA0E1F9127BE59A7F13393AB8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644226, "uuid": "f75c7eda-4662-448c-95ce-5005fe029b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644226, "uuid": "fc7697e6-7a86-4e89-84eb-ea433f2c39d5", "value": "12288:zArbMR/UkooLLoS60/K7yh0uEpMSDOB2WatVF50AWnaMQ5hQtyXHnHSiyyjK:MnMR/UkooLAuilDIEF5nWnaVAtcHHd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644226, "uuid": "77990f8a-f8e0-4159-9e1f-569efa3cd622", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644226, "uuid": "07234933-2d78-4a8f-87c1-8e0df19219cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644226, "uuid": "37996c32-4f01-4788-9978-5100298925f9", "value": "LPO-6809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c31c92-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649992, "uuid": "d64238f7-191b-413c-a91c-ce7016343143", "comment": "Malware payload (AgentTesla)", "value": "42aaa42db2f9b98c663b5adb79393754", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649992, "uuid": "b20135fb-9eef-4dd4-a345-bc16824351f0", "comment": "Malware payload (AgentTesla)", "value": "05a9b623cb12a105466b4b0ae0856813279588fafaac224a0b735842d2dcd5f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649992, "uuid": "8cb69969-2b15-46ac-ab4c-b7a864652193", "comment": "Malware payload (AgentTesla)", "value": "aa17588a69719e3d64c97812292480b1f2df7995", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649992, "uuid": "789b4f66-8d58-4faa-af9a-17d1bc04f639", "comment": "Malware payload (AgentTesla)", "value": "8ea934f218c54f0eaa518d0ed4cbcd770e8429de5591e1da569c7326f0ca3e7b3c88be8e2daf8e8220aebb21b24bf55c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649992, "uuid": "99df2311-0f6b-4247-9002-a76113b4a597", "value": "1BF4CF7D8E954D11FAAC82BC8CB05035E2F96D267152FB458FD07CB87A312A89E06C7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649992, "uuid": "9041fb7c-a0db-4c85-a93f-ef45e96c1054", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649992, "uuid": "03af21c7-e3f6-49bd-b805-3d06f42f132c", "value": "12288:3+eADPGc0P0nHyX5L+qwQLDPObrtuE7l00Xsc4342N:GCcSwHyX5L/wGDWUE7lT8v3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649992, "uuid": "f590be1a-f79a-493a-bb9f-5c8481982406", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649992, "uuid": "6c7ff625-1410-412d-a94a-512f1ecee043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649992, "uuid": "7deba2e3-eb9b-41c3-b4d0-5f6ee770b1aa", "value": "bu7L7N0jITdmG87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24fa041-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673533, "uuid": "fc500736-dbac-4115-aace-71df123df1ac", "comment": "Malware payload (Dridex)", "value": "e9cb64e206660c56cd7fd38cf5f9864c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673533, "uuid": "b24b523c-19e3-490b-a42e-bef65fe6e64a", "comment": "Malware payload (Dridex)", "value": "05be09ca3e7a07a75bf196e5818ae86188f7ef60f4e01f4633ed9ba8b2c5cfd9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673533, "uuid": "2ad005ef-f21d-4284-84cb-111eedf1757c", "comment": "Malware payload (Dridex)", "value": "f63a8c911df34fb223c9452c57de77bdcbecc136", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673533, "uuid": "ae45ecfa-dead-4467-b9e6-97571124991d", "comment": "Malware payload (Dridex)", "value": "9ed76b3ba8f4bea579e922e0305f4a802de12bb0b63a3446c6e55cc9d04f99a4402792ee02a6c11d65cfea1a6fee8029", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673533, "uuid": "d50880d5-51ca-4830-ad67-5d3f3cb813ac", "value": "35F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673533, "uuid": "d0a85431-fefd-40f3-9c94-a06e61cbc62d", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673533, "uuid": "d72ba2b0-f5aa-4a44-9be6-ecf211f72f27", "value": "3072:Hesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:r4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673533, "uuid": "f1630469-4c39-456c-9211-b614b22f0cff", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673533, "uuid": "4ea60a42-24dc-413f-a968-c8ac7cb93427", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673533, "uuid": "c1c79760-c184-4053-8121-706e58616a36", "value": "e9cb64e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cfd2fd-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651063, "uuid": "5cfb813f-c984-45fe-8b34-1d2331148b6e", "comment": "Malware payload (AgentTesla)", "value": "0fa3994dcd0481d392981bff7ec6f0d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651063, "uuid": "4fbd0744-53f1-49a9-ba56-6dc642c7b1b0", "comment": "Malware payload (AgentTesla)", "value": "0628b671fed105b7e4aa6f1b8fd17fa24703e4442e661b6f0a56f69bfade1ecd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651063, "uuid": "437317dd-eadb-4066-b789-d63aaef87b24", "comment": "Malware payload (AgentTesla)", "value": "9eca3ddfeaa6652c85fe377e5fb97a76e1ae9d5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651063, "uuid": "6709de52-a43e-4409-9903-8d3669bc3ab4", "comment": "Malware payload (AgentTesla)", "value": "79ac78fe4576efaf76b6a80a2a8389cb594fced96397fdc750219fbe27dfef3b92976539b2aac4905e9b17549323d4db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651063, "uuid": "9a24050a-9941-439a-99cf-d9f298445a14", "value": "2805D06877A4C956D7BD46BC84B1923807F87E665D42E70E1EB030EC3E7B721CD12A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651063, "uuid": "c45fe599-a6cd-4da5-9a17-8990e36356dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651063, "uuid": "b7cfd634-64c4-4f39-9360-09ba8d90386a", "value": "12288:1rUqgzxV5K1V7s5cSKRkitxVwyYQojE3MjvLe:Of5KPsqSK+GDIjEavLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651063, "uuid": "365bc383-ab75-46fd-aadd-94c258dd22d0", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651063, "uuid": "46b37b88-6477-47f6-b38f-c2aab6350421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651063, "uuid": "a4e606e5-bec1-4ca8-a371-35197bbde894", "value": "OLy4KI85kB3HENF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aae191c-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673386, "uuid": "27589c48-6cc7-4bcf-a132-e9496e92d226", "comment": "Malware payload (Dridex)", "value": "3c86335533629f86252b8bc99f40509a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673386, "uuid": "fead8e07-3f16-4f75-8c93-ce0f1cd0912b", "comment": "Malware payload (Dridex)", "value": "06b0e108674532a5517c1ddb4df0e0a2db4ee1b65b389596cd8082b9e9ed8987", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673386, "uuid": "406cdd3e-0f2e-4967-81a3-d8d98dcc0379", "comment": "Malware payload (Dridex)", "value": "7c7cb6b853c0ab07eeb25817bff62c88fc99d9f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673386, "uuid": "8e2d0fee-3286-4e62-b592-70e43a6882c3", "comment": "Malware payload (Dridex)", "value": "edae80e2ccf06854335e2929594a1361b58efd78e8053fb67e64d2a37db53e90dac9f15fab8fb4710c070e27ced9db11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673386, "uuid": "ee71a2ec-23e6-4bfb-aa1b-7a96108c6751", "value": "CBF3D0906A9BDF0ED9C13CF96A96A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673386, "uuid": "76d11dde-1f41-436d-a300-0453f7fd8b22", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673386, "uuid": "efa8befc-20c7-4a77-80a6-59586e965701", "value": "3072:cesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLP8:G4+VZQpt5hyPsa1ekiEY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673386, "uuid": "facd8d21-37c3-470b-ad2d-31a97a6bca21", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673386, "uuid": "74ceb3b5-74f4-4d97-8c98-e10ed4d54d5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673386, "uuid": "d4920e1f-83ce-45a6-928a-bb495946fe1a", "value": "3c863355_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbdcf08-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687649, "uuid": "3b2a384f-d0cb-428f-9b7d-06822a666da9", "comment": "Malware payload (Dridex)", "value": "02c9d6ee3b7139e4a480bc65a4ee788b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687649, "uuid": "d82cd848-55ed-4b0b-b1b8-a25540de7b86", "comment": "Malware payload (Dridex)", "value": "06c4ae236cda89fbbd635c5cdba4404e8aef1584cfddc0b1540ac4bf9991bec5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687649, "uuid": "794989ce-5c3b-432d-8ee0-4588e3b406a4", "comment": "Malware payload (Dridex)", "value": "24101175ff017f5514b7b80575e0689938f9f608", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687649, "uuid": "3a97c14b-0596-4e9f-856e-43bd7a65145b", "comment": "Malware payload (Dridex)", "value": "7c466a266610ed3d1618d4c3924d7a36e3ee713e116fa52a0acfbb15839778c5834105537bff1d429587f264761412aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687649, "uuid": "4042133e-71a3-45c7-803b-71f6a278df84", "value": "0FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687649, "uuid": "71251c8e-ed34-4e3c-a5a8-027f5f877146", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687649, "uuid": "3f41c535-1f1b-40eb-8717-0c7531510478", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687649, "uuid": "66f4b3e7-defe-4f8f-9245-9edeebf710c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687649, "uuid": "393e13a8-19b2-4e62-a504-5d08e0fb2b26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687649, "uuid": "677eff7f-f17b-43fd-b090-39c191453c4a", "value": "02c9d6ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1832a9-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628188, "uuid": "bfa9c27b-5f34-4b91-9837-a59cbbef652a", "comment": "Malware payload (AgentTesla)", "value": "aef2234778281c28c452178055103018", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628188, "uuid": "e01fa1f3-1bb2-4b01-94e5-03b640087614", "comment": "Malware payload (AgentTesla)", "value": "073d6aa1f88221734fb2dd8bc412d75cac0595ea240f7a0bf238e5dd3dc2dca9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628188, "uuid": "a0844894-ba07-481c-85dc-358a12649fdd", "comment": "Malware payload (AgentTesla)", "value": "27e4d78e1b3be64f7b8c41a9c0fc7b34526dd776", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628188, "uuid": "8456bcb2-b771-40b5-9b88-c68d1fdab729", "comment": "Malware payload (AgentTesla)", "value": "d8b0356550781e7747e30173801bd64a509d95c80c606b6b5df13a4c0657d55d9b52d18d401fce0c30f1bfba4ae5a614", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628188, "uuid": "985b8c3b-e7e1-41ac-8517-fcee82f1367b", "value": "AFF4DF203BD8AA58E47F9B761970C55463F2B917C322C64E6EDD908E1E32746C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628188, "uuid": "f3034029-eb33-4293-98a3-4cd3f49bb785", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628188, "uuid": "6242d1c3-09f0-4558-9325-f13b0cac15db", "value": "12288:6MGeDWnfZhWXjtBVw1hhhjnmcwyRawPe9ZyBlHwb0NxraSEiI09/+GOZdr:6TfZhWXjPGhhhjnwGe9ZLANxrlkGOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628188, "uuid": "7fb0920f-7c0b-46f6-9c9e-a0729451d17e", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628188, "uuid": "968f6858-32f1-4f7e-87b3-7ad322fabe6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628188, "uuid": "14c99f7e-be2a-499f-bfe7-9b7694860272", "value": "Ariba.png (132K).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0de93cb-b15d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630205, "uuid": "c9d5ff8b-d762-4fe2-b3cf-1b48256fddae", "comment": "Malware payload (AgentTesla)", "value": "4e00af57797375c3e943111187be6ecb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630205, "uuid": "8cdc688a-19fd-4de8-8f6c-62da589b378d", "comment": "Malware payload (AgentTesla)", "value": "074091e8c34379d0b8f0012aae84bd058e24725376d357a9db272ce5c5ba3103", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630205, "uuid": "6ecf0fc5-1b8f-4a1c-8e9a-da8ece238efc", "comment": "Malware payload (AgentTesla)", "value": "997721506fec3e9a80896e613731a2b4fc082cf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630205, "uuid": "87c03c7a-a3b2-4117-9c13-dbda3851805f", "comment": "Malware payload (AgentTesla)", "value": "a715d14f0988d772bd789a17b7e564bf0d8587aa6c51aa1b1f6513ece198a29a6f8c535bff3b08c54cb5cf95706ecce3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630205, "uuid": "fdb0480c-dbe4-46a7-b288-7ce0e010ac74", "value": "33E4CF2923D85F57E47EA7395034540013F1B41BDB32EA5CBDF664CB6AA2F808636B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630205, "uuid": "8a13163a-c57a-4543-88b5-8ed1a8cb1024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630205, "uuid": "426e0f5e-957d-47fb-b989-82965aa33a37", "value": "12288:9pCoU7+MYfCc6frCZ40oQmX7D0aALX2w5Pq/Ciqrc/7TKZT73xW:9H8+/fChLf74aALmfCzqTKZT7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630205, "uuid": "77df04a4-d672-4cc2-8e29-bcbb71877655", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630205, "uuid": "8c88a5ef-7f74-46a3-87a6-c9572e25c869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630205, "uuid": "909ff189-f73c-4e48-a503-f62991f37f3f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ba8529-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669746, "uuid": "2979a79b-4b4f-4c13-a69c-3427634594df", "comment": "Malware payload (Dridex)", "value": "5ec92702cf7d77197da8a1bbd8c8a6fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669746, "uuid": "cc3ce333-0b24-4bd9-a26f-6ade9c3e5bfc", "comment": "Malware payload (Dridex)", "value": "076d2c2a3901d32e10088ffca9bd15b49f358cd0b4c5615b67df5e66de4df45b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669746, "uuid": "56e9797d-3d0f-47a8-a9ef-d81e30fbd2f7", "comment": "Malware payload (Dridex)", "value": "9fe73c57eb670f472550cfdaf0c525d8abfd6463", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669746, "uuid": "99d23498-b958-4c1a-a788-2048df403322", "comment": "Malware payload (Dridex)", "value": "07cb04e770e9a2663ad6cf97778de4b333c65a188499662fd4d455d9be79252e85bbe73c02d992e99c9ac03a60326d7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669746, "uuid": "882d93a9-6ded-4b91-add3-1ffd1e5d220d", "value": "BCF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669746, "uuid": "92bae36c-b268-4fb3-92af-c19c4b8f6d9f", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669746, "uuid": "283c6f7e-b163-4116-b88e-eb7675e34bba", "value": "3072:Y/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL/7:qbrE1kvcB74DXZ2Mela7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669746, "uuid": "3abd9093-13ef-4021-9047-8f86fa93aa8c", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669746, "uuid": "1a8b9ac4-985e-4f88-ae31-de3f840916f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669746, "uuid": "3321ad9d-2472-4ddf-901c-03489d88c8b6", "value": "5ec92702_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c95f00-b19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620657727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657727, "uuid": "ba6bfd93-96cb-494a-9ffe-bf79356c2750", "comment": "Malware payload (AgentTesla)", "value": "9ff0e93842626382a8cb0d327e2896bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657727, "uuid": "e3387838-85ef-4565-b23b-424502376504", "comment": "Malware payload (AgentTesla)", "value": "07d65bc790d5b81ae2a2512df8d00003098957ba45b7a28cccab335593b565c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657727, "uuid": "c916fd4d-7a6f-4b93-830c-5fcfd8cde490", "comment": "Malware payload (AgentTesla)", "value": "47552deba1a739db2528ccd97572392c2dfbf71c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657727, "uuid": "8dac177d-48a9-45fd-8215-ca9c5db0c8dd", "comment": "Malware payload (AgentTesla)", "value": "65b844382dd516d34c927fee36729dee002bb2e4dcc093a685aad31129739ae226b73c2d38e84c675f35f3e69e18d04b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657727, "uuid": "4f0adb8a-37a0-4d91-aca6-f20a59f65a6d", "value": "33A422067BC4CB05EAB3AF35A5A4CA347B352F859533EEAB785B338C473934198A1D11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657727, "uuid": "59bb3cee-7ecc-434a-9a3e-172716c846ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657727, "uuid": "89dc167a-de7c-45c7-b03c-f4a0f188ae1d", "value": "12288:0HFMw7Y9MA59CyMAn0miosI5lwX67S8LUHdwsdpz3:0H+w09tVuoHj73GdpdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657727, "uuid": "a6956e67-03ea-42fe-a184-7ed9ade23e5f", "value": 490808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657727, "uuid": "c795847a-a0e8-4911-8153-37a61b065dfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657727, "uuid": "47fc10f2-3295-4ae0-aa2b-024924114554", "value": "IMG_060_70_001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf23fdc-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650976, "uuid": "092f704a-5dc8-4f48-b65a-2a31c513f7af", "comment": "Malware payload (AgentTesla)", "value": "6023778067f22660952a2fd6c67a32a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650976, "uuid": "87f0c150-7a11-4978-aa8d-b802a6c84aef", "comment": "Malware payload (AgentTesla)", "value": "07fe8feb4d84f4527446d94b06ac5e7a244d784e27186b1b9738514feae07be3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650976, "uuid": "94490054-9f11-45e0-8be4-b6fb4a100218", "comment": "Malware payload (AgentTesla)", "value": "ed7f1282548dc76db4c45df5f6de7974b1e9f5ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650976, "uuid": "2cd5677a-0763-4b34-bee6-ef4d5b118e51", "comment": "Malware payload (AgentTesla)", "value": "a09d71c71f5919924d018905373a5cf0a9c762ded61076bd746f19650a853370da61688a552852cb5b0f2267c8b6578b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650976, "uuid": "93be713e-548a-41de-902b-9c05a998b889", "value": "CD156ED5B1908C96ED6F06F5AC3A643014F7BE5D54A4C20C5AA9776A3AF3302609FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650976, "uuid": "12a30e4d-3ff1-4452-8c5b-15791fdbf18f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650976, "uuid": "98844a0c-a545-4298-b054-42b69c0a8ced", "value": "12288:dfTa8dmih++O2n/xUc4M+OV5yIiKqsPvhew/gAPk/5vtR:d42lv/xzFV4IzpWtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650976, "uuid": "796dc85b-24ac-4a94-8f22-1489d46d65f2", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650976, "uuid": "b538ca20-0366-4c1b-93fe-cb87f8dc0316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650976, "uuid": "92f5b7f1-2576-4921-8186-66a827303df5", "value": "Urgent Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff8b7a2-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620662738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662738, "uuid": "0d56451a-94ff-4b1a-8f86-b083702bb676", "comment": "Malware payload (RedLineStealer)", "value": "7b1676f98b8853d2b360feb96aff5050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662738, "uuid": "c95d30a3-97a0-4cde-bfca-c94b7b0a0573", "comment": "Malware payload (RedLineStealer)", "value": "085e0075e9f282c27080a7358c4e1a92f93b65abaab91a9fd2122085f32bafd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662738, "uuid": "b708217a-8e66-44f1-8b3e-35927015bb04", "comment": "Malware payload (RedLineStealer)", "value": "3fceb5172c80a9699a959e8dfbb357eea819e007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662738, "uuid": "7b387dc5-b614-4aa6-85f0-6f2d3a1d2220", "comment": "Malware payload (RedLineStealer)", "value": "21eb4b1fbd573eeb85d7ad8f7e22ff07edc99cbf9edd2631c36bb3f089d2423b739a8b70e9bebee31f224d3a1cee06f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662738, "uuid": "509f2d37-8daf-419c-b7ae-16745ed4fd8a", "value": "C755293C3BCA9E20C6AC6A7F81D2940483F69CA166CAE35B9DD471F44C62FE15907B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662738, "uuid": "a048171f-aa49-4ee9-acd4-c92a2993c63c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662738, "uuid": "a3a10df2-9301-4058-9a29-391af69e812b", "value": "3072:H+ZV38WYlKlm/72u+8JVG1i6UqlNkOrgA4Hqa1LAKn:CVL2iu+WVGI6zNkNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662738, "uuid": "4070792c-bbb3-4533-9c82-04fca82db7c4", "value": 1333160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662738, "uuid": "0a648b21-9eb6-4438-9fec-cb31e40f64fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662738, "uuid": "d4caa164-fce3-4eeb-a4e7-9c26d80a4fd6", "value": "7B1676F98B8853D2B360FEB96AFF5050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac46e54-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640933, "uuid": "4aa2f386-6893-4973-99ab-e40e3a132f02", "comment": "Malware payload (Dridex)", "value": "394c420508f6febe04983db8abfcbd93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640933, "uuid": "ab6773ee-0bcd-4ede-8a19-e7b1bf06e089", "comment": "Malware payload (Dridex)", "value": "08a1983da6a1066d19e7d782d6d093244f3975c7ab72f94888d374b72261d7c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640933, "uuid": "3038528d-3af8-4d79-971a-785ce52131da", "comment": "Malware payload (Dridex)", "value": "93a6081bb7cdcde044eb003b5e2501fef1de37ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640933, "uuid": "2a288516-1d1d-4949-ad80-2ac12f806883", "comment": "Malware payload (Dridex)", "value": "de5a0911a541d6e9795a4656d7ddb3679ab7d322bcabf3caa6d178580bb9e31b07c4d179fdb579bc3f4aa1823e53880f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640933, "uuid": "79324d55-0524-49e7-bd10-f6e44ee2bfda", "value": "4CF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640933, "uuid": "d5066314-d541-42a8-ab6e-90253f3df37d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640933, "uuid": "4e246ec3-e936-4bba-94d9-73c4a117c0b3", "value": "3072:zWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:z42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640933, "uuid": "3d15b38e-a90c-4036-bb07-6ed42afa0cdc", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640933, "uuid": "bad98299-d6d0-4b1a-967e-8f310da63a74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640933, "uuid": "74c761f6-5943-473f-ba1a-69aab3754671", "value": "394c4205_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27772f58-b19a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620656121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620656121, "uuid": "11130b37-3735-4178-a287-5993e85df5f5", "comment": "Malware payload (NanoCore)", "value": "b49adc7083c066ebe636d386a85c2547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620656121, "uuid": "b0015691-1cbc-4c5d-8eca-64a5cd5ab86d", "comment": "Malware payload (NanoCore)", "value": "08d9411339dad2fe13ff3f4214d8a8d4a54dd3c9cfc9722c9c57d057826efcff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620656121, "uuid": "b1b6ecca-9812-4118-8fac-585ff0364830", "comment": "Malware payload (NanoCore)", "value": "7a5c083c8ca8fa17858baa6a43bb748a71c3131e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620656121, "uuid": "af112406-9f57-4b67-b323-fce02447e617", "comment": "Malware payload (NanoCore)", "value": "e76c22ccb627637b0524e59f38e042855445fc4a76f49a247f66d8102c4685bd545a7a5a2638ffda8694b26da3fa4aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620656121, "uuid": "d30e97e5-213b-4ca2-9a17-f207e051c814", "value": "452502302388ABA4F0BEA77990B145044BF1FA1BD335DA4EFD9850DD7976F4186A2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620656121, "uuid": "107e0662-7f4e-4b82-9184-97f86827a9a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620656121, "uuid": "bb157259-e39c-4308-b8ad-f240455bc1da", "value": "24576:pV4CPCAONeMYq5oh3OuKANcB9a6srGo69lE6B:zPCDNHx5oh3npOauo69p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620656121, "uuid": "9ca09428-0cb0-4590-98fe-480b67df009c", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620656121, "uuid": "f7edae45-c00a-4321-9baf-b7fc5653af14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620656121, "uuid": "36986f95-6ed4-461e-a67a-b5d8e46cf720", "value": "b49adc7083c066ebe636d386a85c2547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ec70d9-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673400, "uuid": "52a4d5e8-5ff7-4370-820d-9cfddce6b41b", "comment": "Malware payload (Dridex)", "value": "36c23c556fb608a1d836dc284048e818", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673400, "uuid": "4dc7a5d5-9e70-4269-81e4-e7c07cb40162", "comment": "Malware payload (Dridex)", "value": "08eb849c24a2aaf6c0218f1d931d2b797a07d7074b0f3770ccd40b5731da33ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673400, "uuid": "2b27518e-f9b5-4edf-8cb4-6900b48e740f", "comment": "Malware payload (Dridex)", "value": "a59b4caf0696b76756133fbbb32a4862f47eb030", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673400, "uuid": "bdc79e2d-5ac0-405f-ba64-e11f8bdfcf53", "comment": "Malware payload (Dridex)", "value": "3f96b2a67fcf18f2e33e767aa95154bb9c11bae572fce680fda9fd4d600feb12cef7954c3f6d4d98c7e97ebc62366a2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673400, "uuid": "aa86a0fd-634e-43a8-bc56-142e86d04b18", "value": "7CF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673400, "uuid": "2af0a6b0-1544-463b-89d4-25f9aa4863c0", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673400, "uuid": "d2f7630a-4a1f-48c8-9ef6-3219a9ff238e", "value": "3072:besl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:f4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673400, "uuid": "d557b12c-0213-40f4-a1b3-de01ec62cab5", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673400, "uuid": "b60f37d8-ce77-4355-b8fe-92b55cb2fd82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673400, "uuid": "5a3b9394-4058-4b87-8c7e-11440197bda0", "value": "36c23c55_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b344792a-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687708, "uuid": "fc7337a6-042d-4e48-aae2-158fd5195d42", "comment": "Malware payload (Dridex)", "value": "ae7feaa31f010d2635db5060fcd3bdc0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687708, "uuid": "3571cc45-15cb-4b46-8077-dab5e47ef35c", "comment": "Malware payload (Dridex)", "value": "08ef7633d1b6a2fbc672f338c9a994a2496d288b1a5955545b1ddc7f262a363d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687708, "uuid": "3eec2268-dc43-475a-bf52-56ef5a51e7ac", "comment": "Malware payload (Dridex)", "value": "dfc4e6e5eabcacc8b07fc81096886fce541a1c71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687708, "uuid": "7680b6ce-4dd0-4e4e-94f1-3c87867e7259", "comment": "Malware payload (Dridex)", "value": "fe0f743b2f622e26d82ff1f2883ec7851b772f50f088b31de8c8a5938bcffeceef417b3bd43599da2ad4dd347ec582b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687708, "uuid": "219f5872-e066-4678-9725-c25e65f51f4c", "value": "17F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687708, "uuid": "7b950273-f8ef-4a33-bef8-d33e87dce18b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687708, "uuid": "6344351f-b077-4d5f-9f1e-4f33013d534b", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687708, "uuid": "3394f136-b75c-45e5-8456-6b99289f1404", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687708, "uuid": "ad0a37dd-4316-4682-9619-106bddeba3c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687708, "uuid": "e0c4042b-099a-419d-87d0-5c652885ef7a", "value": "ae7feaa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c265f3-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624946, "uuid": "83aa075f-ebfd-476c-b4e7-98cd5e0d620e", "comment": "Malware payload (AgentTesla)", "value": "647c6f3eebf5253b5cc8fe71d5d313d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624946, "uuid": "2d229195-fa1f-4024-8065-1145bdb0d648", "comment": "Malware payload (AgentTesla)", "value": "0944a853b75533a9461ca78df2ed3166eaa8b37ec98b4159c33dbaf375ee431f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624946, "uuid": "a51dbbbc-b14b-415e-b5aa-5c231dda0ce5", "comment": "Malware payload (AgentTesla)", "value": "47bae8a218358aaa2a01431f75b073f9d81be1ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624946, "uuid": "db32617f-05f8-4cc0-bfff-a680911ae928", "comment": "Malware payload (AgentTesla)", "value": "d1fcd068bc362cc43c34c658ee14e9d85ed47e83db474afeb8f31ef02f1d6898ada3509feedcabc9f9ff577577d6531d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624946, "uuid": "f034c38d-d08e-483a-a5fe-9562467badb9", "value": "14C42375283B26DD0F761AF13D0475F18449D07336A9D82AE2FF18B1DCABA46C59B0B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624946, "uuid": "e771df69-4d7a-4cbc-9322-d652f1a4180b", "value": "12288:NMULerPufUv0PQnooAB2aKBS72fNj3gdQ99QCNF8DN8aTYX/:aGfUvwoABvKY2fNjQQlCvYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624946, "uuid": "b3c696cf-19be-4301-bd07-adecd01f2f18", "value": 577406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624946, "uuid": "132e2fcb-3aa0-454f-a214-9e616abd9f14", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624946, "uuid": "4f4ea409-1814-4959-b8ea-fb9175ebc76a", "value": "Scan 0730.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31b8f49-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640920, "uuid": "992ee7b6-ebde-4d35-85fd-75e01f3ab680", "comment": "Malware payload (Dridex)", "value": "b6d5d0613121fc8d95e9f5c1a3618236", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640920, "uuid": "d730c7bc-2921-429c-a1f2-8eaa2ea6e20e", "comment": "Malware payload (Dridex)", "value": "0948add43572e3f3eaf0861b9e4a0bca5a88b101ac522dadde027dc6a461e992", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640920, "uuid": "e662efad-a191-4ae9-860b-762c60aebee0", "comment": "Malware payload (Dridex)", "value": "22919b2a4e20743fe2a4da5af15b29992d8528f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640920, "uuid": "f6a26aba-ba4b-469e-88ef-52f22ed0010a", "comment": "Malware payload (Dridex)", "value": "51f5a8ca20e6cd1e13dd20daac3c7651141a108a97fd4ad2bfe489238218f6728a0de77845478117e2448aff4305f3e9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640920, "uuid": "2e1847a5-7906-4682-b9b2-75b02874c3a5", "value": "3CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640920, "uuid": "1467a680-bc93-448e-ad82-c414e5d66cc0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640920, "uuid": "a2096c75-bbad-44a8-9555-412f5494c856", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640920, "uuid": "f0717bbc-9c29-4343-943b-0113ba6f8a44", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640920, "uuid": "64cb6e0a-52ab-4c75-8d95-d7754d0b8bb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640920, "uuid": "e5decc68-732e-47f4-a66f-9770f78795c4", "value": "b6d5d061_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a7f35d-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620673640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673640, "uuid": "089398a6-5948-48e7-8537-8cd66ab16773", "comment": "Malware payload (IcedID)", "value": "75f1565039392ebedcfd1157efc002d2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673640, "uuid": "86c8ad63-9d25-44df-8b14-b813e746eeca", "comment": "Malware payload (IcedID)", "value": "096d78cc7092bb4db5189c9b56245b1cdea76c88e84f01ab3bae1d41056ca693", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673640, "uuid": "ea7f85d0-aaa2-4270-b33b-9d639f6cd4c3", "comment": "Malware payload (IcedID)", "value": "3b39fba555327d6dfc7577a601a03933fe6ee7f4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673640, "uuid": "2c4283a9-d1ca-4dc9-ad7a-476454cb1201", "comment": "Malware payload (IcedID)", "value": "ebd65fb2cc2a53c272c13ed8d0a55d9c648595dadaafaec2a6ec9870b1db8810eacddf5ea7314ccd1d0bc5ee4ea0a6b8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673640, "uuid": "5aea3488-32e1-43a8-902c-262d86a257e5", "value": "54B39C0BCC089AD3C11E92FD6D064CF96E4E5718D8E6AFEF14322F893A161631D4F46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673640, "uuid": "dead8ed8-b160-4956-acc6-cce32b9fff7e", "value": "3072:0f/vKINbjvw548LMb/oqKO8NnS8+60Kcdb:0faAbT648LM7D98Np+E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673640, "uuid": "7356d65c-ba96-46fd-bd53-de89c5a3f279", "value": 117551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673640, "uuid": "0ca4199b-1090-4c74-91b3-5f0bb994c4b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673640, "uuid": "b662cff2-19df-43b9-8ef8-441786567b4c", "value": "Copy-575854953-05102021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673b59ad-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662670, "uuid": "93f391aa-027e-40ee-a1e2-6fbf49194b40", "comment": "Malware payload (Dridex)", "value": "4b9567650d1bdd4062b8a1d35f7bc1a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662670, "uuid": "fa6c1eba-ae92-43e5-8a49-c3df5c5c9ebb", "comment": "Malware payload (Dridex)", "value": "097e7c286d5b377bb9f1b8927654480fc5778d99d59cd9c30d96aa8056403730", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662670, "uuid": "efe1724c-34f1-49f6-8c02-2761d3138315", "comment": "Malware payload (Dridex)", "value": "50a25f80e5b1563ab04a8270fa74723af9a7116b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662670, "uuid": "9e58a93d-e22c-496b-94ea-13d08a0ba88e", "comment": "Malware payload (Dridex)", "value": "dd8fdb722f64df68df68f55912cc381a7e49183a3c5be74ed86580183d61885c033f1c68f300e9cfe5c80d0d7cd01e59", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662670, "uuid": "56e66406-e6c4-4a01-a466-abcf576a0bd9", "value": "F8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662670, "uuid": "901f1395-76db-4d3b-a638-46370af79ebc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662670, "uuid": "a8d62812-af56-4321-8738-38f5e49f6b18", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662670, "uuid": "65c91b4f-e4ae-4a00-8a40-9f960b159cb5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662670, "uuid": "464a5411-b822-4d73-9b9e-7d1b8b8cd583", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662670, "uuid": "aed3b0ed-5377-44b6-8b1d-1054f57c63c0", "value": "4b956765_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dc3f51-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673464, "uuid": "97a3db09-64ab-453f-a660-a3bd894581c5", "comment": "Malware payload (Dridex)", "value": "6e2daf18ea5241492a3983f3e431e245", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673464, "uuid": "7e575386-1f66-4de4-b8c0-5da39110faac", "comment": "Malware payload (Dridex)", "value": "0abb4f484518cb90c56b89accc6435a5c636526e94fea3fea83a605f310261a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673464, "uuid": "55c578bd-846e-4a66-ae1c-281a15ab1dd7", "comment": "Malware payload (Dridex)", "value": "da5a739744e7f1ab22ca43b948fab14b0d49ac07", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673464, "uuid": "f2b03b30-5f73-4d12-815a-9b91d4a960a7", "comment": "Malware payload (Dridex)", "value": "dfb4d9973544d2d28a9b64f1f9e20c21f9944abc641037811d57a68e3221464a8b75047e661155d112b34e281a4d49b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673464, "uuid": "cb65f293-5cc3-4817-96ce-cafcf345b9f4", "value": "ADF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673464, "uuid": "e1ee8c17-e1a3-4c0a-84f9-dcfaa991551b", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673464, "uuid": "61ee1667-792c-4cad-8472-e5b9409ab4a4", "value": "3072:fesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:z4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673464, "uuid": "4f86da51-1cf5-4b1d-8d73-d8049ccfe7d5", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673464, "uuid": "a09493ee-2fc9-4488-ad00-ad0bc0332619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673464, "uuid": "63f6ef72-0364-4e6d-bd44-ca2d3a8b8308", "value": "6e2daf18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b148e87c-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640890, "uuid": "7687a14e-344a-4a16-835b-7070c6124677", "comment": "Malware payload (Dridex)", "value": "db965ba40303577bebccc3823dbeb70a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640890, "uuid": "73e2fdd4-e103-4b1e-a053-165065573b08", "comment": "Malware payload (Dridex)", "value": "0b24e3001582e6bf83d15e7fee65bab7223610a5e807aed3b79528091ddcb3c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640890, "uuid": "b765fff7-9e5c-4656-bb18-9f54b80b44e3", "comment": "Malware payload (Dridex)", "value": "85f29cf060800629b2c0128e2e1a4057df2f3a23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640890, "uuid": "f496abcc-c886-49be-9ec1-c8129af02796", "comment": "Malware payload (Dridex)", "value": "071d8bd8552637ec53b9566330323e79360e93be60f6ab1f25734f0f06bb1a9f6972c45b49c55911fd4f2e2c2a13385d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640890, "uuid": "abe79202-8261-4161-8c81-850d8c8683d6", "value": "E1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640890, "uuid": "78764af6-640f-4e45-9741-f73627749970", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640890, "uuid": "139442ea-01e9-4bcb-9f22-13b4303dca17", "value": "3072:UiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:XeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640890, "uuid": "df9d9db9-a471-435b-8150-91a74c95a7d0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640890, "uuid": "f9c72208-d4c2-47f3-b068-d206bb87a330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640890, "uuid": "1424c55a-7302-4aad-96b5-f62e8f72c7b7", "value": "db965ba4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4ff85c-b12b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620608585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608585, "uuid": "39242911-51e3-4771-8aeb-eed432f6667a", "comment": "Malware payload (Dridex)", "value": "1a8aac90754ddcb99b58946a7cb41bef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608585, "uuid": "7fdcc344-51e1-4d57-9ed1-0f316cc447cc", "comment": "Malware payload (Dridex)", "value": "0b2579c86d4a34e3a82002038401d102ddcb5cede9c92f5e378ec3746cc5196f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608585, "uuid": "a36d0e73-b973-4eb5-824b-b5494cb0f2d5", "comment": "Malware payload (Dridex)", "value": "eee7de652fa56875a2a5208a5c7d9e2f4d0a09cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608585, "uuid": "20954fd7-b123-412f-bb7b-401db1860aa4", "comment": "Malware payload (Dridex)", "value": "6374dc63f3203bf8be1358ac57fc72acb6298ebcdb46df0a8217a3809ce7c9831965ffc94b73ba6183adf2f4a61fa6c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608585, "uuid": "c2fe1b9e-24f8-4147-b8e4-1b7dfd8defbd", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608585, "uuid": "a74ca982-624e-4fc8-8ee5-ef66c03a49ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608585, "uuid": "949eb576-abfc-40da-b072-12080575243c", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608585, "uuid": "3a3ee1b9-b9e2-4618-8968-6471d22163ca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608585, "uuid": "0ba8f9c3-8eef-4e3c-be4d-579d49709cd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608585, "uuid": "62a92908-0710-4af2-a5a2-daa748c8ce48", "value": "1a8aac90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c8582f-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637322, "uuid": "b1ab4aec-ec65-4376-9c3c-3f80363ec0a8", "comment": "Malware payload (Dridex)", "value": "cd189654de1fb20b2c65c62590352e88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637322, "uuid": "1187a13b-071e-4b75-b306-529e5b361bcd", "comment": "Malware payload (Dridex)", "value": "0b31924fcaf782532f1a5509096a6239815f3655b720c2ede399019658e06f0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637322, "uuid": "98cdeaa8-ce3d-4852-ae39-fdce4f4f3dfc", "comment": "Malware payload (Dridex)", "value": "cc365cdfe071bbfa85a00637df51f43b2057c088", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637322, "uuid": "a88219a4-a2cf-483a-a32e-02c2c8f4b634", "comment": "Malware payload (Dridex)", "value": "425be790bd504e6873a80e841b6fc5299c1751a7df0aeec4933c8ab05294ba689d203a4516237c790fc0821ba82fe159", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637322, "uuid": "9d0669f3-a3a2-46fc-a56d-a3a0330d26a5", "value": "0AF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637322, "uuid": "cb935578-26a1-4cff-9d51-3d229dff597f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637322, "uuid": "bf6924f1-0474-4738-ab4f-c6fa10dac0a9", "value": "3072:lIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ec7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637322, "uuid": "39e2016d-98ee-49f0-8f76-d44b49c46af6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637322, "uuid": "92bd91b8-4f42-460b-b8c6-7825de5570f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637322, "uuid": "a608d8bb-33d8-4b6f-a2ed-4ba953723616", "value": "cd189654_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f88fd6-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648142, "uuid": "af1c7cd8-cd7f-48da-83db-8ce53391e729", "comment": "Malware payload (Dridex)", "value": "97ca48203b905139706283016a25c1c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648142, "uuid": "d8ad8d6d-46a2-449f-bcdb-79f9e291abc4", "comment": "Malware payload (Dridex)", "value": "0b7abe45e46099974be1faf3ebf241a7e5672018bf0b918fe97f7c94d3098c69", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648142, "uuid": "16f76529-1e94-4e47-93fd-cec135e8ab7c", "comment": "Malware payload (Dridex)", "value": "4a4aa49f5a587ab41cc1db8a09a088c62b9554ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648142, "uuid": "920642b1-f58a-44ed-ad0d-36d2d5ba79ad", "comment": "Malware payload (Dridex)", "value": "96eed13e359df6ec1cfe2bce173f42f5a6cd7ad368d78e65c05f2ab7feb9f1ab3b99889651f3c66417e8425a6a8a5d59", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648142, "uuid": "e87938fc-258b-498d-aaa5-2763e5d99927", "value": "A5F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648142, "uuid": "6265ced7-bbb1-46bd-8add-fafe923b7d70", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648142, "uuid": "a1de0e05-cecb-4282-b1ba-1486e1bb7586", "value": "3072:qA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648142, "uuid": "a77fe5ed-166e-4f9c-a445-b5a9c5ddc263", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648142, "uuid": "ba04c1ca-25eb-4183-86de-950b1064c7a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648142, "uuid": "87e52f39-9b97-4c46-abfa-474a3898c814", "value": "97ca4820_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed285d1-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658871, "uuid": "d3f69369-d4a4-493f-a576-ba17ff3be783", "comment": "Malware payload (Dridex)", "value": "8ea4299be90fe96338a2e45f98f783de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658871, "uuid": "06c2cafd-6f0c-48e1-a16c-6303e2fe3560", "comment": "Malware payload (Dridex)", "value": "0ba54d5f7dc2d0eeda271fea9e888f38e33b4ced378443e02a340be82540abe5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658871, "uuid": "1985b7cf-24ff-4415-9b7d-7048848a52f1", "comment": "Malware payload (Dridex)", "value": "542d6e82df39e2f9149d83faac799b07cda4f2db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658871, "uuid": "ba4519aa-9153-4157-896a-654704e3f571", "comment": "Malware payload (Dridex)", "value": "479f5695cccd7834766aeef0d01fca62d938e66e82a58e1f84dd202ea3f75dc2322bbfdf4ac1004cb8eaf906a9e9af0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658871, "uuid": "a4bcf0b6-f5b5-4269-9ddb-0e6b6696cb30", "value": "90F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658871, "uuid": "eb154a86-2b3e-4566-924d-76e6a74c032c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658871, "uuid": "6151cab7-e232-42a4-babe-476d55707bc8", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658871, "uuid": "80dc89e5-e563-48ca-a2f9-facd118f02c9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658871, "uuid": "3534ea85-bb47-4326-8307-cbb82f2a22a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658871, "uuid": "c19e7a71-11fd-46c0-97d1-7e01a16a4b27", "value": "8ea4299b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402e00d3-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620629104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629104, "uuid": "8af62e6d-cfcd-4b90-a5c7-629050eabe5b", "comment": "Malware payload (Formbook)", "value": "5f078694a026638f2813db5a778caea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629104, "uuid": "88d2e3e1-feac-4e10-a60e-69d0912c8173", "comment": "Malware payload (Formbook)", "value": "0bb5c3d128d7c78eca860ad07e610fa54fd238907bb09ee21783e15d35874fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629104, "uuid": "2df49eec-7df7-4248-9abf-fd81dba06f00", "comment": "Malware payload (Formbook)", "value": "dd43d353c576779f19c9f0aa5a1551a903f9c7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629104, "uuid": "b0e2ff61-eba7-49de-b528-697fbb37e92c", "comment": "Malware payload (Formbook)", "value": "ec4b46463fbe2f84a23081ac4c7657452cc28732f3cca740a487b31e0bd1fa2cece3750e5d76f062b3ed1fca0c9b6c3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629104, "uuid": "dc4e4fa7-a831-46e0-8a14-8cc166df2985", "value": "A305E0203BD8AA58E5BF47761830C15063F2BA67C723C71E69DD919E1E32746C7A2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629104, "uuid": "9bb72ff4-51fa-4d44-ad07-99fec0fec54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629104, "uuid": "4207da03-e11f-4f66-9a78-36d07d0523c3", "value": "24576:lYYXpPGhhhvsbCZy76iH5K3I0iKyB57C:KYXpSsbCUGio3jvyBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629104, "uuid": "9f88dfd4-4001-4f72-adf0-620d5a14c1f4", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629104, "uuid": "62dc7045-6871-4f96-b227-8a8861b840c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629104, "uuid": "a9cf5155-f83e-4b9b-ad3b-0ea7226233ce", "value": "IMAGE5070686426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e0fd40-b153-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620625575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625575, "uuid": "f2c84a37-c791-46d4-a2c3-6190ec42bb04", "comment": "Malware payload (NanoCore)", "value": "8d92ca832b7f42ea06383073a048687f", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625575, "uuid": "660631c7-3a20-445d-8be6-2ec0f0c497eb", "comment": "Malware payload (NanoCore)", "value": "0c1c8fabcbd174810ce84dea7223c0278a1580fe5f7bf03faf55469414811f78", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625575, "uuid": "01eca416-cd49-4d6c-82bf-39d94b1f5a2e", "comment": "Malware payload (NanoCore)", "value": "e0ad3393648f2bab7d551102a493d0e15defd01a", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625575, "uuid": "ba2b0142-a56c-4531-b9db-652dfb882c64", "comment": "Malware payload (NanoCore)", "value": "ecec522b88213067c3dbd121eac1d3b324146f60cfa3938573e5490635bb803f9d228869855cf69f6165027c3f88878d", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625575, "uuid": "da6cfb37-a79a-4912-9ea9-5660dc119864", "value": "9A653332AB519F01F66F8B349A92E23D6877EC0263ECAD2BB16D720315335707445FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625575, "uuid": "b8491ec8-06c7-43ed-87ba-4f6d16b5d234", "value": "24576:LFuX4g5sHIkk+n58f1qfOkJwMHICGsDrDlVy722JM6WwMfNf7OmArYtMv:e4gieafF5HICGIrpUq2JjWwMfNjOm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625575, "uuid": "51904893-362d-4caa-b5a4-03540e88dfa3", "value": 1412096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625575, "uuid": "1822cc1f-5935-41a6-b8dd-811121e73ba9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625575, "uuid": "f1aace98-c09e-43a1-a121-f85f81738ec0", "value": "ORDER 4553241.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307af97f-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629077, "uuid": "862ff237-e4bb-49c4-947b-e910e25441d7", "comment": "Malware payload (AgentTesla)", "value": "cfa929257d136b1be442514d869eb236", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629077, "uuid": "e706db5d-1b21-49f6-829d-332e459ef976", "comment": "Malware payload (AgentTesla)", "value": "0c29190ca0fb845464f137f3bbb44046ad066b261782665d6315ba2b2652371a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629077, "uuid": "fee52183-cce2-4bd5-b5d0-ed76d592e1ad", "comment": "Malware payload (AgentTesla)", "value": "b8392bbc268b71d3bdd65a7235713a6230c55519", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629077, "uuid": "301ed458-2498-41eb-bf4f-a870bfd66d0d", "comment": "Malware payload (AgentTesla)", "value": "96830991de5b5f12b23aae28f3acfd2b6f781df2b6f0884e8a43c0e8abfabe9cf569ffd416b42644ec25252e4af5b6d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629077, "uuid": "7ec8ee5a-7434-46cd-a7da-7ed87e043f73", "value": "35256D91B2908C9AE86F07F16D36A53021F3BE5D95A4C10C559DB71E2AB334260AFF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629077, "uuid": "f62f672a-d472-4831-b878-790df48e7e05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629077, "uuid": "72162ca7-ce6e-4641-87c8-05f8477ec558", "value": "12288:Zgfs0zPXFtBVw1hhh8RVjHdQf/g1VrUsR4Y2ccz5xl2r4qJamN7B:ZYPXFPGhhhaJdCipmCc1xE4qJamv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629077, "uuid": "70e732c2-c142-4225-858c-71430cb74318", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629077, "uuid": "46e1d9e4-b423-4171-92f3-d26680f8640f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629077, "uuid": "83193f87-d513-4d71-8f3e-a4105da67331", "value": "PO ASKI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab2b2b5-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673440, "uuid": "38d0c4b9-eb4b-4cf2-b723-abbf039b7462", "comment": "Malware payload (Dridex)", "value": "944805bfa7178184c97fcf2a373cf457", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673440, "uuid": "f1a22da6-283e-4d7b-8795-4c0b951094de", "comment": "Malware payload (Dridex)", "value": "0c99211f16fe8b2eabef1bd39be0667f18a75154b2fd9555813af5002f6b2504", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673440, "uuid": "31026fed-9f32-4a42-bbd8-ea2800ec1728", "comment": "Malware payload (Dridex)", "value": "5cdc6a6cfc09c4bc5a51321b9c3103118ed463ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673440, "uuid": "bdb7ee5a-91b0-4555-8d08-83b543e103c8", "comment": "Malware payload (Dridex)", "value": "dd099c0a07e675c2faebb6a1ae650ebe27706a83d2540c68c23429727c5f221ad98480123829309bcd61ba0ac8462d8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673440, "uuid": "b7289378-1995-49e9-ac82-3c023225c590", "value": "46F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673440, "uuid": "c9412693-2912-4e43-bdbe-232d967d0622", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673440, "uuid": "d5908919-a483-4bee-82fe-b082afc98feb", "value": "3072:mesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:o4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673440, "uuid": "8eb46d99-e76a-4371-a53d-0b7801ad6fd8", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673440, "uuid": "1be7bc52-7d31-4fe0-a825-f8ff3272feff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673440, "uuid": "b49c0b56-f6ec-49c6-a5c0-5039e94512e7", "value": "944805bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fc7d55-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673612, "uuid": "f2ce958c-26d7-4b5e-876b-735b027db923", "comment": "Malware payload (Dridex)", "value": "1704b9110a1dc216bd56b6d7984766dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673612, "uuid": "eb8b5aea-3364-4965-8f08-27a5d31aa8bc", "comment": "Malware payload (Dridex)", "value": "0cab09a30beba01d2c45a0d77fa1ef63bc35ec542aa166a0666c12c4bc8170e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673612, "uuid": "c2de8d3b-18d0-4edf-8bb8-6b8d92c8dbe0", "comment": "Malware payload (Dridex)", "value": "fc88e2cec1ca9a4518b0aa47b5e3ce50c3c10afb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673612, "uuid": "768815f1-6f83-47a5-889e-372b34a6c8d2", "comment": "Malware payload (Dridex)", "value": "ffa746c2033983286c223e3de0d0cb7006324885b532cefa0acec3e77add853e829292b99898baf4a5844217870918cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673612, "uuid": "55e00c68-4e68-4072-a63f-496cd5c5a44e", "value": "64F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673612, "uuid": "34a8c81b-6c9a-45dd-8479-196a24f68cc4", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673612, "uuid": "bb35a891-e275-4bf6-8b86-ce0b26cf89a3", "value": "3072:Mesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:W4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673612, "uuid": "55641184-ff2f-401c-a2f4-39e301c0e8a9", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673612, "uuid": "96ef50a2-f47e-47e9-91ae-5b8259b3bff0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673612, "uuid": "be1295e2-034c-41af-bb5e-03f43d30e895", "value": "1704b911_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da0f913-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620630871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630871, "uuid": "c4462b90-9b74-497e-8fc5-f5fc8ccf41ef", "comment": "Malware payload (NanoCore)", "value": "9d9cb0f32a77d7d81296095768d3583e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630871, "uuid": "220d9b02-c8e2-4b4b-8bf4-c3ec25afcc7f", "comment": "Malware payload (NanoCore)", "value": "0cbbdd2c9615f4d2de4e0232ace6b69889a54538444838ac6616a5aa39109c98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630871, "uuid": "e2f7e5f7-5ba1-4e0c-bf4b-5cf5738ffd2e", "comment": "Malware payload (NanoCore)", "value": "8386cdbc85faede7527aa83b4646dff3f9edc910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630871, "uuid": "d8cc08ce-9798-48ed-baea-4325ec3dc3e3", "comment": "Malware payload (NanoCore)", "value": "051934453f8d5d87a49793551a2160ca89a34542d082b8896ea0f229a53acba39382df3920bf2495d0c6f9547a8e989e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630871, "uuid": "e604dc88-6353-44d2-a142-db3ca4eee4a0", "value": "CB458CA5B742EA85D81A0F79C65716F042E5AC23E635F28F2DD8BDD036337EA065F801", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630871, "uuid": "1ab3347c-fed3-43eb-9566-7c3b181bbfaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630871, "uuid": "ba7e62e1-692a-4b3d-a06f-de95fdf5f477", "value": "24576:j0s3e0bj5uLJy3AmKANAlN8ek7CPWUli/v:I+OZlANAv8eb+Ul6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630871, "uuid": "5691e9ef-ed57-48d4-9451-cbfb8ec03890", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630871, "uuid": "52b05cd3-ca12-4a1b-86b7-cf82cc4a838a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630871, "uuid": "e50130a1-afa0-4710-aded-bf5edc20d304", "value": "PO #KV18RE001-A5491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfe426c-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673336, "uuid": "3572aceb-c12f-455d-84f5-76caede7cca8", "comment": "Malware payload (Dridex)", "value": "1a31a70707b2a3f5d7d37b46e7c6ec52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673336, "uuid": "e8451640-8d2c-4408-a64e-8f87c5598d8e", "comment": "Malware payload (Dridex)", "value": "0d451e912a6c68a8116a4df531e98df45447258f6f321bd879130f5e2e0b8fa2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673336, "uuid": "29159b2d-9b13-425d-b7c0-dada185c1440", "comment": "Malware payload (Dridex)", "value": "be88b90421039453dbb994dbc6d1239a85ba9b37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673336, "uuid": "42a540e1-a7f4-4584-b147-b680f83834bf", "comment": "Malware payload (Dridex)", "value": "b860880985acdc416f8b24725f6e6779a64a32c28f08d2a4c074c55c8763e1ce1764e74d51f11091fda1c730d4f1fe32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673336, "uuid": "8b15e135-d99b-4a33-ac15-af52ec41acbf", "value": "CFF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673336, "uuid": "1115ea93-fea4-4389-89b7-b614bfa4609d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673336, "uuid": "22a8fd16-c49e-4bd7-a23d-17d5a087225b", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673336, "uuid": "2bb20152-36af-4fbb-b424-4d25133cc969", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673336, "uuid": "d87340d7-0110-4a52-9dd0-da7038ab8aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673336, "uuid": "539ac0ce-acda-401e-9681-9ea159c1a6da", "value": "1a31a707_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dcc80e-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620687679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687679, "uuid": "65893fd0-30b9-471a-bdb8-a033207f56bb", "comment": "Malware payload", "value": "435f2f5f97f4742c251c4b8c1983fb2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687679, "uuid": "e232a4e1-a263-4e6a-bdd7-fd6c85d80649", "comment": "Malware payload", "value": "0d78df8d6b7e22f6f52a7585f0bcec27b6fcd9daeb02b1ac7a398cb53164d8a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687679, "uuid": "b44a5b9f-47cc-4395-8495-96d44762096a", "comment": "Malware payload", "value": "9a9d3c4ae6ab9e1213d955cb0e525ba29eb5f7eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687679, "uuid": "56ad9824-3866-4816-ae4a-773f10b94adb", "comment": "Malware payload", "value": "b702aaf7d6be147e548a09c53f598a08ecbcff0b11217094f3863239f1e50c2b726780fb420dc602255a5b4a95f2bd8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687679, "uuid": "8d87ea38-2368-4369-8b44-6c6e217d9ef1", "value": "F2F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687679, "uuid": "748c762d-5eda-4137-bffe-7c1a9e243bec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687679, "uuid": "68e6202b-0fda-49d9-b7d4-44bcdf719971", "value": "3072:OIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Xc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687679, "uuid": "b19317f0-d65c-47a3-859f-d6a81513a57c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687679, "uuid": "3d01734e-df47-4033-a468-3ce3a399ad4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687679, "uuid": "ed5fb3d6-2d0d-4113-9535-ca658d4b03dd", "value": "435f2f5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082e5bc1-b17a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620642324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620642324, "uuid": "b968797e-5bfe-4ecd-88c3-5c0ba79e47f1", "comment": "Malware payload (RedLineStealer)", "value": "133e916268d3f97ca4e2751a1c8bcb1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620642324, "uuid": "726c86f0-ae0d-44a2-8b44-b1df0506381f", "comment": "Malware payload (RedLineStealer)", "value": "0d91aa4091d7eab7d3b2e0ba353241a1e74746a5c1a02ff26290874085fb6d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620642324, "uuid": "26171e99-f558-41a3-9918-b57d3a5cf8c9", "comment": "Malware payload (RedLineStealer)", "value": "fcacac94431f772151f206400f255c3b493f14ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620642324, "uuid": "0bb9549e-ce5b-4a8d-8de6-d7e17e3154b2", "comment": "Malware payload (RedLineStealer)", "value": "379c09deb6d0984ee39e5f388d145f76b989d71d52c4c7bfd67e81d156475fdd028fa089cb8db6f6c9a086cac254511e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620642324, "uuid": "67e4790e-8b1f-4ef5-ba0e-65fea8252a79", "value": "0994BE117680D072CC261D794065CB799EAFB8366F229E8BAA8D2779DF307D1B731309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620642324, "uuid": "15910284-4e57-4aa7-9ea0-025bcd18384d", "value": "21eecbc834e52df22aae59eb1273e389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620642324, "uuid": "4b8c28b6-7145-4163-ae82-6f9a90217215", "value": "6144:TZ/y7p5N9WTPblZd7ou9+Tf9x/6ywEHOe9Yvv3xHIuk70GVJjw3M1MXmIUe8u:TZ6l5DglZdMug9xQoYnJIuy0GVJemW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620642324, "uuid": "6dd95f1e-9ff7-4f2e-bb76-0d30f2082512", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620642324, "uuid": "878e23a7-baea-4846-a764-09a45d388e13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620642324, "uuid": "66a798ed-821e-4ef3-9844-78df0e31dc1b", "value": "133E916268D3F97CA4E2751A1C8BCB1A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbadfef-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666223, "uuid": "01b700e9-e66f-4fc8-ae73-d24e43597500", "comment": "Malware payload (Dridex)", "value": "59d31ecfacb63cbf5c3b09d484a6c266", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666223, "uuid": "d997f3e1-4dcc-42d2-a02f-376f66d4a3e5", "comment": "Malware payload (Dridex)", "value": "0da4a61d22caccf838945480b05e6679af3e3407a5dd2069ffea4536ea1b93e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666223, "uuid": "23965920-013a-4282-8c84-12b9d63e152b", "comment": "Malware payload (Dridex)", "value": "d9f7f3f2095a8445dc00a8b07a8910a7c8fa7a15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666223, "uuid": "19b5279f-9fb1-488b-9dc6-b2eb184bfb10", "comment": "Malware payload (Dridex)", "value": "c3b0dc68592723ad1a391d81342d98e7c4041f6244cbf5d8d6f72ec1286afdf563695cd17c846f2434425606f0e846c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666223, "uuid": "abf94dac-1405-4793-bed2-14e9fbfc84f4", "value": "43F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666223, "uuid": "6413fca3-4e3b-4b15-8785-ed09a221659f", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666223, "uuid": "e8c50ffb-c372-4fb6-9add-0d795ab5c6dc", "value": "3072:BuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:B0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666223, "uuid": "f46a87d7-00ec-431d-ae83-aaae11e5c748", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666223, "uuid": "84d5d784-87eb-4586-9403-d9a98b8c21f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666223, "uuid": "bddfdc68-aeda-4d53-b7e0-80f6d8b43251", "value": "59d31ecf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff5ec89-b17e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620644270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644270, "uuid": "15dcc622-38af-4e3f-b951-a3b8f58cf5f6", "comment": "Malware payload (AgentTesla)", "value": "18cb95fcf74cda5475c23011a24a650d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644270, "uuid": "d2063b9c-7ba1-4d5c-b434-44cb2065316f", "comment": "Malware payload (AgentTesla)", "value": "0daf489ca1617986915a80c73dd00c81ba6d72854ddc415c495f5c907b640c7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644270, "uuid": "09714a79-3b74-44c3-bad0-01db6635bcb1", "comment": "Malware payload (AgentTesla)", "value": "9b96ba3d3f5929ea0cadf244571395d9ee4b7969", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644270, "uuid": "2c8f1a7f-39c5-4a1e-a232-0f5a0de3087b", "comment": "Malware payload (AgentTesla)", "value": "0a792b915713d4b149d4a29ef026f8c4b2bd49cd4671c0620fc10749a734395ea54bce716c03750edf868ecb91924793", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644270, "uuid": "1c82e22c-570e-4889-a1a5-1340b9fa6ff9", "value": "A105DF203BD8AA58D5BF97761970C55063F2BA2BC722C74E69CDA04E1E32746C7B2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644270, "uuid": "fb6a0256-3743-493b-ac76-6d1d645fbf52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644270, "uuid": "0d8b36c2-5d6f-4a0f-a2b4-f811799db27e", "value": "24576:d4w7FX2PGhhhPJVYpeM30BWpu8KMP+daV:FFX2UYv3iWeMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644270, "uuid": "98bfd0d6-e556-4fa5-9444-76c84e32ea92", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644270, "uuid": "d346e92b-35bf-49f7-b403-cbc072d22927", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644270, "uuid": "fcf8b60b-de65-407a-8a63-a26a5ea7307a", "value": "urgent request fro quotation CONO GROUP LLC DK983746GT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7486aa2c-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620648089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648089, "uuid": "0762f963-2aa0-4a56-84cd-b17a4bf83e96", "comment": "Malware payload (AgentTesla)", "value": "337840b9bde8f4e316ea0b782db28024", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648089, "uuid": "52bafe80-5ec2-40e6-8d57-5b25ead63dc9", "comment": "Malware payload (AgentTesla)", "value": "0dc38fb20eeb05080b4d37c168b8d5df58ba97c283083cf012cc29ddbc7c51e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648089, "uuid": "6b163932-b3b0-43da-aaae-6edc52f35509", "comment": "Malware payload (AgentTesla)", "value": "cfc0b85392654ff90a7d4c6a2e3b2405a1aea15b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648089, "uuid": "0e399479-3b44-45ec-97af-1b17a0166e56", "comment": "Malware payload (AgentTesla)", "value": "8f2a318413af189df761df472d2bc7654928e93600a7e2fcebb9de7ddf4450176f284013e1b4b3734c90ae18f3d7a855", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648089, "uuid": "118a7632-fa30-4b7d-9650-e20c083e0aac", "value": "A3E4D02C7BE88944E9BE56BC9471412443F9B2161817F75E4EE160FC2CB7B12CF42A9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648089, "uuid": "6c01364d-4ab6-4557-979b-7d325704af8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648089, "uuid": "a0dc352d-e4cd-48d7-8ada-f88aed9c23ae", "value": "12288:XiSRIF+GJ8RM94OGGYPmlpiICM50kI4ax9Vvhs+rcc7:8F+a8RMdPYeCMdI4a9hhfrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648089, "uuid": "2d2771a3-f1ed-4c5e-b9b8-2e64ffc93639", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648089, "uuid": "904c8076-ec9d-440b-8c36-0de9c7f22c88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648089, "uuid": "4b73100f-1b5a-4ca5-b654-21b6032eaabf", "value": "337840b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc520a1-b136-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620613233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613233, "uuid": "84e49a06-7ca4-4bb1-a0e8-c6759ab02ac9", "comment": "Malware payload (Loki)", "value": "2647d573fae68ef407dec78e9c63367a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613233, "uuid": "05e0a28a-c9bf-4296-bde1-0c74f2cd6f35", "comment": "Malware payload (Loki)", "value": "0dcebcbff7b84930e0796b27a4f795480423a122d6d201e45073678832b0961f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613233, "uuid": "9931e942-a1ed-47dc-a1c6-608c42fde8ef", "comment": "Malware payload (Loki)", "value": "a0ce76e9fd8b5b568848f8dc0bcad09e975aee3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613233, "uuid": "662a2d33-0442-4e1d-ab0e-6e12f742d9e7", "comment": "Malware payload (Loki)", "value": "dea4bc094745304d15b24de419f7fb7eabba59021247a2b9bad5f864dd53fca5db39cb22698bf9625ddfd920bb3210bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613233, "uuid": "51f1a606-0fb8-4aac-bfee-20adc2223be1", "value": "6ED412813A451499CD73F6B385D387B243221EBDA832AA173ACC7F53377F645A923612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613233, "uuid": "ce44b269-52d2-49e5-a520-2b07cbe49887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613233, "uuid": "fdcc87c9-7a90-4bb6-8924-e07f9ccba9bb", "value": "12288:FHFMw7Y9MA59CyMAn0D2wx47BDKiuKuQcV1kCi8AORcWAB00+R7dx/:FH+w09tVhwxQuscTa4Rczh+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620613233, "uuid": "57b03529-5d39-4fca-9497-7b35bd90a298", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620613233, "uuid": "ce3e46c6-6f18-49ec-8735-7c11a1031995", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613233, "uuid": "a344fe93-05e4-45a4-9358-307a21357a47", "value": "MV. RISING HIMEJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb9e585-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (StormKitty)", "timestamp": 1620630761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630761, "uuid": "b455c759-65ca-4fcd-9f92-8d61fc3c8839", "comment": "Malware payload (StormKitty)", "value": "34d5eec8776fdd1827dedba6ab3ad83d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630761, "uuid": "05e31a21-41e2-4d1a-9a10-bbf12ee70877", "comment": "Malware payload (StormKitty)", "value": "0de23ae1b8456d391ce231190ced1e799a5dccf4b6ec28206aca2f77ba18da11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630761, "uuid": "96d015e9-5eeb-4576-a19a-c6023728bf08", "comment": "Malware payload (StormKitty)", "value": "84a338f169483ea5a25bd45bd202cff7860de1b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630761, "uuid": "9e73062c-4f6d-49bf-bbde-365b5815e5d9", "comment": "Malware payload (StormKitty)", "value": "f4e65b6b28160e6fcf28fa7a49d40badb9917aaaaacc5ca16a0b67c40ccac3fe9cb1f383be0f8cc515fd63a10a529d7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630761, "uuid": "c297cafa-7380-4ab0-85b0-913e12a63060", "value": "08D2D8C1F28A8128FC631A3414379FC04A6BFF5679F2152D795DBA170BB71829883B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630761, "uuid": "1a3addc4-77cb-43e3-aa8b-729e4030cd4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630761, "uuid": "38e1a43b-9327-4dc6-83a4-a8687cff9edf", "value": "384:7ENxSP6FCiCGZahApTiZpBvgJd31eUeraK/sc/:QNAGZmApOZp9E31e/raKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630761, "uuid": "bfced691-9b18-4ec5-a0e2-328169513d96", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630761, "uuid": "b9c19ce0-0597-48ea-b32e-7e73de660895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630761, "uuid": "f80c274c-7a2a-40e5-b45b-d1bc87de7cd4", "value": "090009907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff92084-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630741, "uuid": "3b36d6f4-dafe-463b-80af-a288a4772196", "comment": "Malware payload (AgentTesla)", "value": "973217ad55309db7540fd3ed55fa4841", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630741, "uuid": "e6f9f991-48b3-4945-8258-bdc71cec4917", "comment": "Malware payload (AgentTesla)", "value": "0e7f5a825caf185386b3c55da06e780e12e290da2756eb644106cf6239f6d60b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630741, "uuid": "d3b0f07d-e73b-40c7-a762-94c85517c291", "comment": "Malware payload (AgentTesla)", "value": "9dfa3e24f83e01255852fed401dea0b5fb40d82f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630741, "uuid": "1ab9be1c-b3a8-4fef-87fa-b10d3c4398d6", "comment": "Malware payload (AgentTesla)", "value": "bd7aec71e4848c1a52f3fd5d71d4875a93aa962359393db5cef096db7203545ecfbe79a24c74e627e4a36c4d048aef98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630741, "uuid": "1704f49c-c21b-48b4-9e30-d7ee4e5c3038", "value": "7CF4CF253398AF95E47EA7391071051017F2BE07D722E98E7DE6A4DE0AB3F408527B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630741, "uuid": "95c14d48-1497-4aed-b376-a9bf6bb15b9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630741, "uuid": "838543ff-ed61-493c-b94e-984cdc4a0939", "value": "12288:Q7U4OSRSB6XCuc0cXyUvUoH35nOg213n4Q7y3A1fPkgM:AU4tSACV0WzxdX213n7SA1fPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630741, "uuid": "2fe9c0e8-90f8-4ad3-8c5c-d8297298902c", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630741, "uuid": "ad6608d2-2178-44e4-9b38-a3f5bb55877f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630741, "uuid": "89b66207-7f3e-4ec9-ab7f-28eed9566291", "value": "Consignment Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f86d1a-b193-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620653138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653138, "uuid": "9192b403-68db-4b5d-89ad-d65bcaa335e5", "comment": "Malware payload (Loki)", "value": "58613d01c8c4d1406033b459e3bd3bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653138, "uuid": "14627bae-ccf1-4de1-a572-34c96e4beb1c", "comment": "Malware payload (Loki)", "value": "0f1d9f17d6380c6318f136f9f951922cffd80ba90fa8748ab88e6fd0b0b19ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653138, "uuid": "4d57528a-70c8-4b30-b0b0-5df4e121447c", "comment": "Malware payload (Loki)", "value": "d96117ca77a480bc3a9e0a60c555d8eeb917d2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653138, "uuid": "091626d1-6e0d-4118-8645-318e36d567cd", "comment": "Malware payload (Loki)", "value": "5e3066d9738cc3ce59872501fe331a9a1cef428ed60613773962dd592243e05a75107cf81186e40e455a27d6b2c42dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653138, "uuid": "de43784e-7514-4c92-ad48-b4a7fb006e06", "value": "BE25AE2AB1B0C877C5221E7C9C576765E93AFE202A69AA8537F43C0C1F397503C552BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653138, "uuid": "36a2e686-9518-4919-865d-9a8f20fd9657", "value": "c0b704fc726f3c9059666efc01e406be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653138, "uuid": "d90bee1c-f290-48d5-9112-b677efca6906", "value": "12288:Dngs0lZlBQqX/N8wK9cG9KHH83RTX3Rp19Gs05qCfT4FYKMMo54cHWIeqkUI3DVY:DgPZrPN8wK+Hc1Rp1Z2fsd7UY3Dl5E3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620653138, "uuid": "802fe2eb-da0b-4a0c-a99f-12ec7ad5c570", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620653138, "uuid": "19863f57-16be-4227-a577-114a8e6adf8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653138, "uuid": "57ebfb41-8100-4f03-af2b-7574fe0ef629", "value": "0F1D9F17D6380C6318F136F9F951922CFFD80BA90FA87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6f42ac-b1b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620668151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668151, "uuid": "d331e30c-149c-4cab-8e29-51db92a88c4e", "comment": "Malware payload (NanoCore)", "value": "c379f390450ca7aafd795b6492b82433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668151, "uuid": "bb72a1f1-d8bd-4bf6-927a-d5e92d082084", "comment": "Malware payload (NanoCore)", "value": "0f4b7751e9f37362fa93b362e43c08631b11ddab97f83b9fa2e393b3429f43f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668151, "uuid": "7c195046-386d-4bac-bcee-b2dc15606a12", "comment": "Malware payload (NanoCore)", "value": "3d914fd9062f5c0655cadc626f540189ac6e6d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668151, "uuid": "668b48ad-71d4-451f-ad48-1b86a470829d", "comment": "Malware payload (NanoCore)", "value": "51d1c22c609c18ec6012a43a2417a8cb68276a1a25bdaedef3403eda1b938cf77336acdae2170550ec74e836e890f653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668151, "uuid": "08cb8aed-9bcf-43ee-9ba8-f39e36a378c5", "value": "F1F4AD23325C576DE27E57B9B034023053F5AF2B9361CA8CBDC9FCAE1836A4D46616D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668151, "uuid": "ca4b0548-3430-4925-9f6e-aaacb54e9fab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668151, "uuid": "03e02b27-38d4-4080-b8ff-995e1a987d35", "value": "12288:rgUqRs7lBWWflHuOFjEDrUdqR7n3bHjAxoK+VKgbP1cF:/tNWDrUdGLHjACdKgbP1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620668151, "uuid": "88532d96-8ad2-4384-a475-5234de5cec2b", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620668151, "uuid": "c8687b86-0fb6-453c-9825-ce2fa0d56383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668151, "uuid": "5a881d06-f729-42af-8ec0-1e8f983fdf7d", "value": "cotizaci\u00f3n.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43eb42c2-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620655309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655309, "uuid": "5683c7e3-9275-49dd-a723-dfb2a548214c", "comment": "Malware payload (AgentTesla)", "value": "f5c307fc6848bbbd4b6a538d0b3fc17e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655309, "uuid": "d385d3c5-6fdf-47eb-b1a2-7b5280b4bfe8", "comment": "Malware payload (AgentTesla)", "value": "0f4eea75504a04671e8d79c9ecfa2accb453b57cad71e4313c6c458912f64eb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655309, "uuid": "14fe6d09-03a6-491a-ab5c-8488d4734cac", "comment": "Malware payload (AgentTesla)", "value": "492a18e90c440ecce4068f9f99e83cc2c3e9d73c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655309, "uuid": "917db153-2c1a-4da1-82c2-0879d45947e4", "comment": "Malware payload (AgentTesla)", "value": "cc2aeae85761e0a2d055ce44a1e78a84eb785c9f5b97bf3d3a99db71756e872f2a67a83a0c023ffc272797e6c208b95f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655309, "uuid": "e31ed487-8219-43c4-8eb3-c535fd204d8c", "value": "AF45079D761076DFC86BCD728A681C64EA9078BB830BE207906715EDEE4D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655309, "uuid": "767a21f9-b5fa-418c-9b36-b2c5b6b8f155", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655309, "uuid": "c4c6da32-06f8-4384-89bb-426f78fb08dd", "value": "12288:3yCR1+0PKpAnRI+hd7uuPrApKBT1eWIQ3uP7sCUaWe7nmKvh7IV3S/sz7+TV0JSn:3ZE9R+zF9ZeP7sCUawKitS/y+TV0J+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655309, "uuid": "7c54d1b9-4b94-44ac-b7a2-763c7a6cff2f", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655309, "uuid": "92c3286a-0750-413d-9b77-fe16085a4f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655309, "uuid": "85b93c92-8e0e-4398-969f-19604dced2ea", "value": "New Enquiry 200567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feac1a8d-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1620651328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651328, "uuid": "81177687-7d9b-4545-abab-16d59983577a", "comment": "Malware payload (NetWire)", "value": "b798bec1dc936137bb6af1ec9b5f9681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651328, "uuid": "609ccb74-6bf0-412e-9bda-22fbe43a1082", "comment": "Malware payload (NetWire)", "value": "0f586edba07a1d07aebadff135b1c6eb9b102074d3d3b276997f1719e366a2c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651328, "uuid": "e88e835a-d8e5-4cbf-981d-c08e2e2ba27b", "comment": "Malware payload (NetWire)", "value": "d72063e9a5a12f4581ed2448d1863d63af8272b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651328, "uuid": "c73318b9-bf9f-4551-bf31-77191eed400d", "comment": "Malware payload (NetWire)", "value": "c9d5bb8498a771798d6e0582d9cffaaf358692880f2bea251882a5bed308ddda1c68b9c4fe6511961424afc1a7ac3f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651328, "uuid": "12a53ef7-efec-4b45-b6f5-34417ad49d92", "value": "EBE45BFC765469F0E35B5C23A3CF0C0782251274A93B691B8B2017BE5A57E273E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651328, "uuid": "dcf09cc3-978b-4ae9-b7d1-dd4e8c197577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651328, "uuid": "6dd8a32f-9ab6-4b7c-965e-96714f8aab8a", "value": "12288:BhojoLLoS60/K7yh0U2ihl/jSUS5hYN/kQ0yLULS+6ZmrVbxCH1d:+oLAkh4zXY9k1LDMH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651328, "uuid": "338034f7-160a-4b2b-8689-97ec95e7b972", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651328, "uuid": "0e6c5cd8-f515-4736-9a09-0a341b45a345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651328, "uuid": "3f017b87-e361-47a2-81a3-31124cd36208", "value": "e-dekont.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df17c45-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620649018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649018, "uuid": "982f94ad-924b-492b-8cf2-280861c276c4", "comment": "Malware payload", "value": "3b1b155b3ee2fa4c9ef1135f62b2b75a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649018, "uuid": "cea17053-7234-46e0-93cb-a3b86cf12d10", "comment": "Malware payload", "value": "102059d462e5ab3d9f87400b27636b9ee8c012fd8f3313880301b7728b348f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649018, "uuid": "a1db4b74-e50f-42d0-9146-d77d03b378ac", "comment": "Malware payload", "value": "fda3b456894053a88a63dc66e6be83723f7036c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649018, "uuid": "cf29278a-fc67-4418-b1be-fee6e3fdfa8d", "comment": "Malware payload", "value": "2bee38c5c2ac7ef4e99a1086efecc42be7705ca22ee1648691e492c2ee0a35cf54f300f266cb0351b51bc7bc493423b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649018, "uuid": "572bb113-6e1c-42f0-9f17-5736b6a0cc72", "value": "F685CDD21E8C0331F690093EFDA24056A75453435B891A96E73C279B29377CBDFEA0A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649018, "uuid": "96bce85b-144c-4f83-a654-7a506370b870", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649018, "uuid": "035df859-0bf8-4221-82cc-6da2524a77d4", "value": "24576:pafyt6NN1jx5Nibd1DXwXJfTitDU+cAuKzT4cZI1vYlWsu7gqom2VwrD3Zq+u7:pey43Ni7wXJ7SjGyTVZIlDjkWE+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649018, "uuid": "5a08b670-a8d4-42d6-acbb-d4058603da71", "value": 1865633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649018, "uuid": "1da0c06c-f26b-4428-a9db-a52c72a2e80d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649018, "uuid": "4d34e206-bb2d-4a9d-bd21-39002b7de334", "value": "QUOTATION FOR SPARE PARTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c62eed-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669773, "uuid": "e6c31154-1088-4b12-af2e-32dfcfe97a69", "comment": "Malware payload (Dridex)", "value": "1f9005e02aa2318495ed7e9135d4a2b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669773, "uuid": "7a0963fe-9c6e-4c84-a5cf-c91bb44511f6", "comment": "Malware payload (Dridex)", "value": "10696993a9798b182d0b78996c62cdd7f1551780c4ae5ed66a19628f953ab90f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669773, "uuid": "50d2a1f7-4569-4e4c-9611-b95ebef5801e", "comment": "Malware payload (Dridex)", "value": "1beb927b70037ede70a070bc63d7644947950d17", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669773, "uuid": "017b5508-23f7-4015-b4dc-f449ebde91b2", "comment": "Malware payload (Dridex)", "value": "2b50f7fef83a9d298024b6405146cba622486ecef85db4501806bc85c230d6731e14b5eb5d0189e3e9e1d8a3a54fc76a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669773, "uuid": "9cd0a8d3-ed4a-45ac-96ee-d8973e5a6061", "value": "FFF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669773, "uuid": "f81698e9-5165-46f4-ab15-077d90f084fc", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669773, "uuid": "5b59b81c-e2d6-4828-96a4-3ab60dadf4b2", "value": "3072:cesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:G4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669773, "uuid": "fa96cb50-b431-4e8f-9fc8-15dc28a923e0", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669773, "uuid": "55bcbfa4-0414-4763-adaf-16a2d84d16bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669773, "uuid": "496dc9b3-851d-4365-8548-43b560284f31", "value": "1f9005e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb17340-b186-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620647647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647647, "uuid": "07d62ea2-e2c0-4984-8c5b-ac0aa260acc3", "comment": "Malware payload", "value": "85419e44c40a6a2086b6dbbf956ca8ab", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647647, "uuid": "0329a3c8-cbe0-4baa-b136-c1043ab1fddd", "comment": "Malware payload", "value": "108dda5b9afaecf4be542d01d04c2de722845330401053bc7e9468a880083196", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647647, "uuid": "3fbfb88f-1c20-4a4d-a053-9ae185dc9e85", "comment": "Malware payload", "value": "3f08255d8994d711fe29941523aae6e923084314", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647647, "uuid": "70e4a5a0-bd02-4dbc-9f15-00027f6b914f", "comment": "Malware payload", "value": "675b8ce5f7ff90e5564c6e9af08863e26b7c00a1cf5df75d32b729537e0717ddf521253476bbe2d959ec8fdcf3ee62f3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647647, "uuid": "7984d940-d768-4b79-aaa1-73f9a44444f2", "value": "E371B53927786442CE06A1F2C1BAFFD50AD5F22605CF4BD2B25CEAF00B0F3156A6D481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647647, "uuid": "d5f0d88e-4c8e-426c-8179-3e406b06c3f0", "value": "48:zOfgp6EQdCH2ThvNvWSojpc0s8qwvxJZnlcBRChf2TFphjmn4CI/dkIP3HthVwQk:zOCbQCH2dvErjpc0t+X7GwC+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620647647, "uuid": "8b8e9e6d-a8c3-4352-9c3f-703a64ec1286", "value": 3623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620647647, "uuid": "cc1767ef-6501-4c11-9cf6-76fd9dbf1834", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647647, "uuid": "817be2f6-1947-484b-9eb4-2f8ea3e7b1cc", "value": "Q5280RLP20V.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7400c662-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620669563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669563, "uuid": "6f23c9fe-944b-4473-8317-52adc638a207", "comment": "Malware payload", "value": "50d5282b75a4e9f55e452c8c829d59d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669563, "uuid": "8737c3b9-2dfa-4a7f-99ed-e09049e88d45", "comment": "Malware payload", "value": "10bc6c8728ffc7e1bac31801d0ee650484b4a2c1971eafe071fe7a92dc214473", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669563, "uuid": "5358a932-1437-4a4b-a4df-a08f4d9e6ee1", "comment": "Malware payload", "value": "10bca20b0249586e99cfc2ff1bdf50eb2393eaf7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669563, "uuid": "311abfae-9bf1-40e6-959a-7bbd3162393d", "comment": "Malware payload", "value": "4aab1374df6ae55d9c0041412e41aa47930705a53212c98094a8ab2aadc7aa1ea2cd3f13d6c2d3fa4f1c0ca2626c4743", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669563, "uuid": "e7a5c849-6f12-4a7c-82bb-f07b076deda3", "value": "E094237EF8146BE6D93F8DB3ABF098038561735A414D65ABC50EF92C0E87C1E25984E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669563, "uuid": "90a4335a-e246-4147-8a6a-36a0247c7093", "value": "6144:pmyjSWJ5vr/E0LKctrhLsLx0ATWmddIBxWfGNxOU4msopYHD28zzC2t4xRyvUgCi:UyjjEMLteTjEPAopgD28XZeDKhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669563, "uuid": "0547d74a-4231-49c4-aedd-eb838cc11adb", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669563, "uuid": "0be71b78-89cf-4961-8e75-c311ee27e526", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669563, "uuid": "c62ec449-0c32-4048-9eb0-f51582317b07", "value": "SecuriteInfo.com.Trojan.GenericKDZ.75026.17156.31622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ebb965-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649026, "uuid": "161cb018-d6b8-4506-b656-d814a7b27eb3", "comment": "Malware payload (AgentTesla)", "value": "3e084da41d0c30636c62535f002fa714", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649026, "uuid": "7acf3c98-800f-4608-a989-d11b0c0e56ae", "comment": "Malware payload (AgentTesla)", "value": "10c26029ec5203fa97c5ceca6ad788067e1c5f7650502e494e6223b2a20ee996", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649026, "uuid": "eb88cbc9-cea2-4fe0-9f90-62fec5251991", "comment": "Malware payload (AgentTesla)", "value": "7be4a161eab8a8984b04219a32f4f6c16a3a8f8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649026, "uuid": "858ef49c-b7e2-48b4-854c-b0e89ecfe941", "comment": "Malware payload (AgentTesla)", "value": "65345b86cb123db02c200f039e146c3c4ec42d748a219b95982788416d8b2287080a529d06ea38c1f60800692bbebd56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649026, "uuid": "4bdd81f4-f08f-4699-86e2-7c0ea432e8c6", "value": "1CF4D02037D8AA98E57F87751960C55423F2BA17C732CB4E69DD908E1E32786C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649026, "uuid": "fe282192-fc7e-467a-ac03-c8d7421e486b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649026, "uuid": "6e25d75c-c128-4672-9aca-f27d0d0808b4", "value": "12288:5IOsYElFPXXtBVw1hhhkJAt8DIEN5DplzOBKVa8+/LMUw3alPFX0of8GBu:5ElFPXXPGhhh6AWIA5DpZFVab/Ljw3ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649026, "uuid": "b7e7ff05-c6ee-4226-b918-7bf162b2febd", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649026, "uuid": "784169ca-54ac-4567-aae4-28835ef24783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649026, "uuid": "cf2319c9-44e7-45ca-a3d6-c7cb8d1fd30d", "value": "from-iso_SPECIFICATION 80004.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa6d42d-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673448, "uuid": "4c5174cd-f3ee-4966-a74b-0f3ddd662c11", "comment": "Malware payload (Dridex)", "value": "99a23bf19104ec852e81b12fef66fc48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673448, "uuid": "ecaf137e-fcf2-404a-b666-ea89b3963e68", "comment": "Malware payload (Dridex)", "value": "10c5aee3f1571b8e8c401e238091e32b25dbfca8515264fe389879ec7198ee5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673448, "uuid": "26208650-195b-479a-ae92-43b629df10ae", "comment": "Malware payload (Dridex)", "value": "e410c4ab4736ec8917b03b7bfb6149e685345625", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673448, "uuid": "36115fe8-8c49-4070-a3fa-d35cd8534e5b", "comment": "Malware payload (Dridex)", "value": "79d5319472e2fd7e4383b1a3d5c98163b96d87ac92051e9f4fbba6232f9aeee3f47547b08e20d3fbaac3b24a81a230dc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673448, "uuid": "d4bac5d4-c2e5-42b6-ab15-5a35783336ea", "value": "4AF3D0906A97DF0ED9C13CFD6A96A879B163468D811FDAB8D0CE84CEA4775B30327113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673448, "uuid": "c5292f10-4919-4e65-9858-84af9df1f383", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673448, "uuid": "6b6925c5-5ecc-45f7-b991-2cb5ccabd274", "value": "3072:Xesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmm:b4+VZQpt5hyPsa1ekiEtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673448, "uuid": "8ca6ea14-9ec4-4bde-bdaa-4483a41d7686", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673448, "uuid": "3d06eb43-199f-483c-b492-72204139d47f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673448, "uuid": "69304e33-d4a0-4fab-9dfb-85db75d4ef06", "value": "99a23bf1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe391e6-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630687, "uuid": "6a8497ff-9cf0-4de5-b7e9-f0ee87aa2665", "comment": "Malware payload (AgentTesla)", "value": "4ba21747b170d5f8bdc4b9603abc82e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630687, "uuid": "4827ffec-1915-4b9f-8975-cae8c92e17b0", "comment": "Malware payload (AgentTesla)", "value": "11804568f7e476d6ec1879eaab52174115a058be08b2e7dafb78dcc08c281cb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630687, "uuid": "0f447b3d-9f6b-474c-b7b6-8c20b92ad0b2", "comment": "Malware payload (AgentTesla)", "value": "07c9a3d2602d3a9c548c1fb3f8861fcd9c69654b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630687, "uuid": "a53ce356-d8be-4d24-8a8f-e35890dd8305", "comment": "Malware payload (AgentTesla)", "value": "969077f1f2435b3112b73a033a41836edd8379235cacf3d43773e64665eca9d244374491fdc898d961d0f7acc54d2a96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630687, "uuid": "0b7aba5f-5d25-4e8d-93f3-c0d95e980ded", "value": "44E4DF253398AF55F47EEB355435100163F2B40BC732DA4DBDF258DA5AB2F808A26B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630687, "uuid": "0dec54ef-0bb5-48f3-afc8-e16626df9aa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630687, "uuid": "a7e6b958-5012-4ac3-8ccc-d46f7afb93a4", "value": "12288:Bm7iQM9YGiJYY9o9oObQYEYpObuUTBACg3Sh9aw:8iQwFd9DQDgObuMJgSh9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630687, "uuid": "b98bf04a-1e46-4da1-98a5-90669880e22b", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630687, "uuid": "19b1cd49-536d-4189-9c3f-6f680a36617d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630687, "uuid": "fd9ad054-512c-4105-84fd-69b060b6d360", "value": "PO-002755809-NO#PRT101 Order pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dec33ce-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620644723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644723, "uuid": "64fbab9e-093d-4dbd-9274-2ba295646a3b", "comment": "Malware payload (Loki)", "value": "4960bcc42a7d24fa6e725f1eda3d4617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644723, "uuid": "215f1d28-b6bb-49e3-b6ec-98b468d80491", "comment": "Malware payload (Loki)", "value": "119515dce3e47142f5dbc2ced6d7ef92458e1f9d4d104141e9c068413db1552c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644723, "uuid": "6fcba6b4-912f-4357-bcb9-2bf690db7f14", "comment": "Malware payload (Loki)", "value": "6904471d80184a76bebfd7dff5c5d5b546b7cbdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644723, "uuid": "68bd2339-a82c-4129-9bd5-e5eb81266e67", "comment": "Malware payload (Loki)", "value": "94e90a7ec641a475ac60963be2566d56925231bce732d4a23d57f52b65622f38d2664d0900a4358e81ca778334d546ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644723, "uuid": "c0063ccb-37cf-493b-a994-4c07f440544d", "value": "4AE4271B3ED4C94CF1E94A7D45FC01227FA7E886080EAFDA49D773AD18E2612F521A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644723, "uuid": "ca702c13-18de-4aa0-9e2a-463bf10407a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644723, "uuid": "1746a0ef-2609-4289-92c4-e63d89963de4", "value": "12288:c35RFEDDDMDDMDDMMUhEb+PDVdEohaP9Zn8PfwZ0WW1/aeUOv4x:BDDDMDDMDDMB++P/oP9Zn8PL/aQAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644723, "uuid": "91c4b6d0-8daa-4f68-93ed-9a9ca6d026c1", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644723, "uuid": "48ba74f8-2ef6-40ff-8886-95a2a0c25af6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644723, "uuid": "24f1f047-efeb-4c3e-9040-927cede535e6", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7835298-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669757, "uuid": "79ef6ef3-584c-4175-b536-22c1b72cbac2", "comment": "Malware payload (Dridex)", "value": "699e01ccc6cf4dbe1fd8af1af57c003d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669757, "uuid": "e26c0280-da40-4087-9733-30a7bb761159", "comment": "Malware payload (Dridex)", "value": "11af438497c2d5f4a93a64e0a0c62ae26cdff513470922bf2d55b00068c6b5b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669757, "uuid": "937d4fc6-255c-4111-a383-538a1ba07fd9", "comment": "Malware payload (Dridex)", "value": "8e252324fe60f4ebe5c2be23adce0dd92574f7b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669757, "uuid": "91be4197-24ac-40db-ba76-218420be0907", "comment": "Malware payload (Dridex)", "value": "ef4d6ccb7892309687397cc8f493a6804afb4ebfe67c8f813bc66314ff30a6ff2c5a2d2359adbe2f20513e54daf5a3ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669757, "uuid": "7b198042-4135-43db-8d67-f708dbe5c5b5", "value": "86F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669757, "uuid": "6d6ab280-10dd-4608-b344-58f7ebe9fded", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669757, "uuid": "05e84259-55eb-45ec-8baf-0b1b9641a24d", "value": "3072:W/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:sbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669757, "uuid": "d669b497-bd0b-424b-a529-b2455e78ae0a", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669757, "uuid": "9f781fa4-4995-49f9-8bbc-cbc237183281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669757, "uuid": "97753f68-5a38-435d-a35b-a61c412d061f", "value": "699e01cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40947571-b168-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620634688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634688, "uuid": "58708e26-4048-4186-be65-f290931addb6", "comment": "Malware payload", "value": "22cb24a51394e3ab9b161cd2f6de234f", "object_relation": "md5", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634688, "uuid": "6556e569-65a7-46a9-8d3e-b377058f4d04", "comment": "Malware payload", "value": "11b29200f0696041dd607d0664f1ebf5dba2e2538666db663b3077d77f883195", "object_relation": "sha256", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634688, "uuid": "65310b2d-0abf-48fd-95c1-e75225661063", "comment": "Malware payload", "value": "c6dd7c4299e02e6b9772f0d748325677604f5e7f", "object_relation": "sha1", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634688, "uuid": "2815ec5d-76d8-43e3-b32d-d6663bafb966", "comment": "Malware payload", "value": "cb4eb5a4cc4e17d398d5c100d4bd7478abd0f9360b5ff66f54033c7df152600c0f0a51cdece8bd002fbf1c2d495ba51a", "object_relation": "sha3-384", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634688, "uuid": "056db990-1a52-4e6a-b4f9-67fb0963a67f", "value": "D816223382E44194E5A4883AC637FDD175F3136B8E81E8B9A9F794C316368E1F613A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634688, "uuid": "1c3a62bc-ccff-4850-bc2a-419325b6f244", "value": "12ef08d46939885d42e19d9a3e1d79e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634688, "uuid": "76a1d314-fe54-40ad-a8f1-9cc5ba2c9bf4", "value": "98304:2+wj+gp6J2b9NvjCKjh2Ffb3XjcjVX+3pu/5i:Zwjfp60zveKjcFf0j1+3oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620634688, "uuid": "274f13c9-0d17-4187-9eb6-97f5d0d8c814", "value": 4073592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620634688, "uuid": "ce8670a2-f7d8-4663-8b76-38536333192a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634688, "uuid": "0168b149-37e5-4695-be72-5d5df095aee4", "value": "11b29200f0696041dd607d0664f1ebf5dba2e2538666db663b3077d77f883195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6391423d-b18f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620651497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651497, "uuid": "0eb84f49-41a2-42cd-85f1-3b33fc888337", "comment": "Malware payload (Loki)", "value": "2bf2ac44b9e17c08f355c77f84721a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651497, "uuid": "bb273059-a398-454f-8cf3-27944f620566", "comment": "Malware payload (Loki)", "value": "11d3dcfce3823300d4648489fa3d998c57f056163cb4b87e5843be2172a61c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651497, "uuid": "c91ac531-5ce8-4c0f-bbea-dd3c091467a7", "comment": "Malware payload (Loki)", "value": "4fce4e3b0a94d1157c9dd9f1d450ce289c522571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651497, "uuid": "b56e0386-37ec-4b9a-8dd5-2d627821dc09", "comment": "Malware payload (Loki)", "value": "9a7d6504c43531d5bf8c7e5f760a11d0e450ff0b4ff62e95f94fc4cf27e996966aff177582c4ceda03d307663f4969df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651497, "uuid": "ee01dd62-9b13-4577-a33e-61e60b63a584", "value": "07E3022539A0DAFBF5F602711D7EAB2FEB8ED69120D217434B681F853D53493202E9D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651497, "uuid": "712e0031-39ff-4d7a-a7cb-8101b81b86fd", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651497, "uuid": "cab1d426-ea40-4828-b82d-9b227df99170", "value": "3072:Lf1BDZ0kVB67Duw9AMc+bgBYGD0eHFSd3whFfHE6022Ra47v5vSFtwbx1/q30:L9X0GgZGD04OwhFft022lvYtwq30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651497, "uuid": "66571c30-b9b3-4c31-b2b4-33967f97d215", "value": 152547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651497, "uuid": "30a53081-82fb-4bbd-a8a8-f7881bec0039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651497, "uuid": "0376303c-08da-4d4d-ada4-c2f0eb738a9d", "value": "dumbo3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fe9d5f-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620666210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666210, "uuid": "38ad1c63-0f8b-43a3-9542-da2465d6b976", "comment": "Malware payload", "value": "31ee02113c9b1a48c692de7cf1dbef48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666210, "uuid": "23961556-40dc-422a-a109-2acd5eb75e8b", "comment": "Malware payload", "value": "11fc6451a6357f7367e8c1d4c2ae535940e1181502c2b5188c1df6f5f903480d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666210, "uuid": "7f8f9cd0-433f-421e-8b39-2e819b4f65a3", "comment": "Malware payload", "value": "0e94baa017d7213a4523f6721580a58f01f5ab51", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666210, "uuid": "553a369f-6b12-4df0-8db8-de1ec8fd6911", "comment": "Malware payload", "value": "f472f29e0c5d645c5db4f580c94f31be07e53e896d66ae092d839955918b3d58db5778779393b3edb0c5e391e25946d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666210, "uuid": "e33e2124-2947-4e2e-86a8-0dd3bd324526", "value": "01630243D7093F76D04D5498560F059DD8D2260FDF901AD86EEA94828B41728FFAF8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666210, "uuid": "1d551dbe-4ec6-4d99-b2ac-0a33f7cb876b", "value": "1536:uVJhF/Yp5jkd/4CtdSsceNQJKZ/652nof0CKP6Gk1fy:uThF/QkZ4Ct7QJKZiKdCE6dK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666210, "uuid": "892857f9-700b-4a98-8ed9-72c73f85e772", "value": 73200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666210, "uuid": "cc2e1021-f61e-4d5f-80b7-2a9550a743b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666210, "uuid": "2fc67553-e1e4-44a3-a94d-bb9f21c675b9", "value": "31ee0211_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f262e405-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666339, "uuid": "22ac064f-b3d7-486d-a772-7da174fc8914", "comment": "Malware payload (Dridex)", "value": "0b4e6d1a60b61c3607554115ccbdf93b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666339, "uuid": "57bb5f4b-16c0-4602-a6a2-71eaa5b4fddf", "comment": "Malware payload (Dridex)", "value": "1277bea00c01796981b4bea0c07cdcd2d03c4c155f123c60619f594ef64a4d84", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666339, "uuid": "98a19264-dd3d-4e06-a067-2c9f1a8ab788", "comment": "Malware payload (Dridex)", "value": "2a0869872da8dad6c2796f98122a22d11b69d98d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666339, "uuid": "266e9dfe-db28-4d77-8a5c-8f73c45f52a1", "comment": "Malware payload (Dridex)", "value": "393bef187783afeb15aa45a829e9cad4fb017b00f7b0edbd23b98fb7c351dff4f2d2fec72adf83f6a7a744ff38c70bcb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666339, "uuid": "db6d6cce-1fb3-4c97-a36c-5de9bc8228f7", "value": "9EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666339, "uuid": "dc017793-d020-40d2-b983-e389fd32eabd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666339, "uuid": "5737865a-d1a0-4455-95ee-ed4e35ae0af4", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666339, "uuid": "c3ba65ed-f401-49f8-a355-16c17603ac70", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666339, "uuid": "81a3215c-0ce4-4f39-b507-a620862a2473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666339, "uuid": "cda200c3-5f6f-4d5f-b79a-cb1276fe6c8b", "value": "0b4e6d1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956fe1f4-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650722, "uuid": "fb546d83-7256-44e2-871d-4cd3aeb5393f", "comment": "Malware payload (AgentTesla)", "value": "32a340f6ef91a228b6422372821a2ada", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650722, "uuid": "a14627e6-1321-4f64-9e01-46718ba3c8f8", "comment": "Malware payload (AgentTesla)", "value": "13675c7709efcd13c8334d547539a2c1c7f2e78e3cf9dee498c236d869493378", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650722, "uuid": "03d3d738-724f-4a14-a97f-6ef6cb1917c4", "comment": "Malware payload (AgentTesla)", "value": "e662da1e42385bab7fe9db1dad45685ec8472177", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650722, "uuid": "8123fe88-a0f5-4d24-9da2-1e84ead9c798", "comment": "Malware payload (AgentTesla)", "value": "a2cbddffb4ef38435e61bd838c4c3479410d235e28aa7b04d6dc7e177887d2639cc569b8e6d5676cb48b41360e3650af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650722, "uuid": "7b07d46d-b667-4f77-bcea-a3c1bd081af9", "value": "9BD4DF7DCAA88D43F69D927C41D05105F3FAD2BBA523EB049FC190B41F5AAB19A025F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650722, "uuid": "47b227ec-0634-42ba-a745-8cf25048b157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650722, "uuid": "690e2b18-015e-43e6-89dc-c0872e818cde", "value": "12288:LByaw0SEzouHbKqX3GdB4C1o0C888mfZRYwFpl:MaGwTH12dBj1oHRY8pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650722, "uuid": "351131e0-bba0-49ca-84a7-9aeb53b9e0ff", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650722, "uuid": "659892d4-b138-4853-86b6-ee9531582ec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650722, "uuid": "d62849c6-2649-4748-aa08-c02b8068126f", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a6a2f8-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620677008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677008, "uuid": "06dfe182-4ac5-40ec-b9b4-2d3aa1bc48e3", "comment": "Malware payload (Dridex)", "value": "d3a03cbe4a1fc0f759f2541e899abba1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677008, "uuid": "b5ffa16a-fa68-4a1f-8162-d4e700a5c53e", "comment": "Malware payload (Dridex)", "value": "13aaba0a96115e25730602a39b9b1104f9f43721b291a1de1bb8f8109b9df0ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677008, "uuid": "b00cdaa7-b853-402e-bb39-1a3d7dd845cb", "comment": "Malware payload (Dridex)", "value": "1b02aa1eeb251626b86668c1ddc2c134a1dc9bfa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677008, "uuid": "3ff89e90-005a-4fc7-ade0-9c6309e38964", "comment": "Malware payload (Dridex)", "value": "5aad75393502f3db8e9c703fadec9887de92664ebc7f548b61ef6901230cdb3e8e12aca05c75b06de08c510fd38be4e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677008, "uuid": "e05c20ef-4aca-41a5-992d-9b7e6ec15008", "value": "E7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677008, "uuid": "770f7131-d905-44c0-ba6a-74576f9bf79f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677008, "uuid": "e693c3b2-3543-42cc-a281-df31875bd7bf", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620677008, "uuid": "9e428830-6e31-49c5-acc4-ef0b09ac6365", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620677008, "uuid": "b7293101-938e-432f-a772-922c7dd796d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677008, "uuid": "d30bb005-f9c9-48da-9b4b-1c743d9d9956", "value": "d3a03cbe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4f9b24-b15d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620630174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630174, "uuid": "507e2a8f-8403-4555-a38f-02a3a525e950", "comment": "Malware payload (Dridex)", "value": "03511866b5a3136652feba3accafe889", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630174, "uuid": "a315d70d-d5c0-4d81-8abe-c41a08245644", "comment": "Malware payload (Dridex)", "value": "13d370eece42be89e2bdc99decc12fd142e43f57b8d191b6743f6a25374f1b9f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630174, "uuid": "6765938b-50f4-4107-a8ce-87c7ac92be8d", "comment": "Malware payload (Dridex)", "value": "76c4ab7cfd57043236131e456a3fd0cb05bcf796", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630174, "uuid": "e710ec37-b308-4089-9b58-4f9e2ad51b7a", "comment": "Malware payload (Dridex)", "value": "76f2539c7a2a82a5a117be4dab2bc152c4ee559e00299efa65e0913bfdf09c2a45eae295daefe6f69d6feda9bac5f2f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630174, "uuid": "697d9229-fcf2-4312-a594-32fb03c74ae5", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630174, "uuid": "474077da-6f49-4bf7-a29f-7c37ae8b4de3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630174, "uuid": "7b2e7e53-db66-46ba-904a-5dd4b8ebc3a1", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630174, "uuid": "cfebda3c-622c-4b7f-a575-2ef2698ca4f1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630174, "uuid": "30bbe9a4-c08e-4898-b2c4-7c2e5792198f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630174, "uuid": "bee85d7b-6602-438c-a123-c42873cf9a1f", "value": "03511866_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf9ab96-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620676989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676989, "uuid": "311c9599-893e-4191-b2c5-27048d9981bf", "comment": "Malware payload", "value": "985a5b3e7abbcf8d1092fe229128f0ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676989, "uuid": "5aaa8e6c-1b9d-4c20-9993-44f922abb5c5", "comment": "Malware payload", "value": "140231b843d442a388029b2e601ad11da4df9c7d6a7bffb488f2fbeb05d5c9c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676989, "uuid": "09506f10-9252-47e5-b6f5-cae4b8fbb95e", "comment": "Malware payload", "value": "b8a2d1334803cc9200f99b14ba64d68dc4e88cfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676989, "uuid": "ad608166-5b57-4565-9222-7552121860e2", "comment": "Malware payload", "value": "fe62ace3130fe76fd463dd4b6421dca3ad59b3d51d461240d94e81d9727342aa172000fcb3f397197f604487032b784e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676989, "uuid": "e162bec1-c0da-42ac-9a98-1dc6c278b43c", "value": "F6C423C570C5A56DEB609261735DFC2673F68FA9082B242C803CFF5AF6EE58A12E5431", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676989, "uuid": "21f1f06c-ea79-439c-8285-c31f6aeb4cdf", "value": "12288:+KP8FKY0kAd/sEAKoEtMwAP/LbUG+8d81qybZhQpipjunibR/rp53UJlTDR:VP870IENoMMwAPDb+8d81PhQpJiF/rpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676989, "uuid": "6ddb06fd-8480-4350-b5b3-5f2103fcf3b1", "value": 583933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676989, "uuid": "f3d8afc6-4c45-453f-9ac8-1ce590ab3104", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676989, "uuid": "7f04cc25-a20c-4d67-9444-706c96d886ec", "value": "985a5b3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7fcc2b-b178-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620641630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620641630, "uuid": "fb635723-f987-4b8b-a72b-5a341fb25690", "comment": "Malware payload (Dridex)", "value": "5bdaa97b2365bfe09d0864a0400a54ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STAND ALONE MUSIC LTD", "colour": "#1714E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620641630, "uuid": "cc0aab62-6967-4655-9714-c3b474263d2c", "comment": "Malware payload (Dridex)", "value": "14252b9918f9edbbba0c3cec6c6749e3beb00f13b8c8bd6fb587afb69c405c29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STAND ALONE MUSIC LTD", "colour": "#1714E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620641630, "uuid": "5140bae7-c5e4-4723-9114-422f1fa7f895", "comment": "Malware payload (Dridex)", "value": "c79f0ff722346ab7729ce68b83e5973066d58442", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STAND ALONE MUSIC LTD", "colour": "#1714E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620641630, "uuid": "cc18cbeb-12a9-4a07-8c0b-975c13409007", "comment": "Malware payload (Dridex)", "value": "33d864af6a2a7ed813911b72c3614de3e0a85a21323a14756ddf8d27eb1e024e0cff6b600e9535977ff4f3f91ca74e97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STAND ALONE MUSIC LTD", "colour": "#1714E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620641630, "uuid": "9c8b8db1-20c6-43d9-8a2c-1288523337f9", "value": "ADF3C004D167E6D6C51A583222EA3B3F96314150D748F889EC93C2BED19FBB77077A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620641630, "uuid": "69df8871-a4b4-49a3-9777-bb8cdeb64b08", "value": "d698cf3ac4a1645130f9b93e6882a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620641630, "uuid": "462081b6-efe1-40e3-8571-48a5dc8520f6", "value": "3072:nbG/TPp+AgPbdXnx6ZBfPG6+Xo4Y63F35oJq3Kco08AQazELZn+1qPrx6/idRAH:aERMVPG6+Y63HoG1QawL40Prx6KzAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620641630, "uuid": "277c9b6a-7893-4915-b77d-7902b6c5829c", "value": 171464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620641630, "uuid": "b6a19f52-75b0-4f11-93f0-40a07d3f6aa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620641630, "uuid": "651a67e4-e39d-4142-ad53-c08ffa4ed0b5", "value": "14252b9918f9edbbba0c3cec6c6749e3beb00f13b8c8bd6fb587afb69c405c29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33efc6a0-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620644545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644545, "uuid": "e4867b1d-7734-45ea-ae16-030a42ee1d22", "comment": "Malware payload (SnakeKeylogger)", "value": "b06423a5b10ba2d7fd3e152f8df514d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644545, "uuid": "c220eefa-531f-450a-b2ab-d6acc6647728", "comment": "Malware payload (SnakeKeylogger)", "value": "142d7c2323be35fc25ec6fea135cc81552ee1e8a252345c9e0421c21e365ccbd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644545, "uuid": "1c3d8574-2bd6-48e7-8598-012d056fb429", "comment": "Malware payload (SnakeKeylogger)", "value": "bfc76aabf31f9a1927fb9dcfac42431618a2acb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644545, "uuid": "614541c3-0f5d-4b99-b073-09704453eea1", "comment": "Malware payload (SnakeKeylogger)", "value": "aae609b3c7e5fc5cde1d0f8c3e6fd59d6c8aaefb76024cff16ed9d8a54083453e685e5eb82dbd31a8a60c51862fc665b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644545, "uuid": "3dc72863-a08a-444b-9e94-e9a0b28a41c1", "value": "CAC423CC46E86388D1F779FCF97C019B1D1B80F06A04E67E2D2E2A801AD65F6918B1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644545, "uuid": "bc05314e-2a8f-4cf0-9299-c0ffcfe47e18", "value": "12288:/h2ktVIZbht6yI8mrUvjJBAs9yXCnLZMTmXIPJ1v2Rg:/Ykgbj6yUU9BAXydMTzPH6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644545, "uuid": "9f249387-007d-4d7f-8ac3-f3c8b4fc4bf4", "value": 548569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644545, "uuid": "df9b9a11-f539-4ae4-bd6e-3e6883ef9133", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644545, "uuid": "bbd3a4cf-5bf5-40ba-bc6f-515e30a81d07", "value": "b06423a5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d3afd6-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680512, "uuid": "19582a76-0e07-457e-b13a-ccc815c354e0", "comment": "Malware payload (Dridex)", "value": "c22503589544a20a43bb2689e38ace4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680512, "uuid": "30132a4c-a047-46ba-92ca-c11f7283fb13", "comment": "Malware payload (Dridex)", "value": "14f518e3c5bde4c94b11060329cb0abadaf5bed40d890629ad2f3d195e715f3c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680512, "uuid": "1ba514f3-488f-4f15-a1fe-ee5da58608f5", "comment": "Malware payload (Dridex)", "value": "728d6630db4c3da6dcbc7118b2e2a2ea6b16eac8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680512, "uuid": "5c56b6c7-4450-462c-960f-ea121cca9dcb", "comment": "Malware payload (Dridex)", "value": "400587d1e60955a52902677b27cf10ab9e9ae72f091f3b38346658c90d70e8e045a23969ee537a8dcabb140ff42641d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680512, "uuid": "128f14dd-c077-477b-94b0-eb4028849a80", "value": "C6F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680512, "uuid": "d619eb93-42ff-4a10-b237-99f6a13f521e", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680512, "uuid": "06bce674-21e0-4d20-ace8-1acf9b3cb868", "value": "3072:yuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:y0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680512, "uuid": "26566c27-55ea-42a0-9cc5-9dde2bf28f4a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680512, "uuid": "8b8cd0ff-8be7-4b7a-b9a6-337a9a4c89ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680512, "uuid": "0c2f2b5e-9466-4397-816b-11179e9efef2", "value": "c2250358_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711af81e-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkSide)", "timestamp": 1620637346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637346, "uuid": "20019e2e-a1c9-495e-9544-f309922fd955", "comment": "Malware payload (DarkSide)", "value": "f587adbd83ff3f4d2985453cd45c7ab1", "object_relation": "md5", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637346, "uuid": "aba1743e-cf84-4ade-beee-67d3f029e79f", "comment": "Malware payload (DarkSide)", "value": "156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673", "object_relation": "sha256", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637346, "uuid": "759e4c85-071b-49f5-bb7b-74f60220d1cb", "comment": "Malware payload (DarkSide)", "value": "2715340f82426f840cf7e460f53a36fc3aad52aa", "object_relation": "sha1", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637346, "uuid": "73f5624e-6688-4ab5-9eef-e06b2612ac11", "comment": "Malware payload (DarkSide)", "value": "e71183dd382d0eb38638307dbbd7cfc04d860de9eec76f036fc1f5ddd1450c074b5ca2d851ddfc9d2f40c1375a479b2f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637346, "uuid": "ce7e6a00-cd09-4133-805b-0e0c5d068226", "value": "3E432A046225A123E0AB91FD6B5D2261B7BF4E742C2FB90742741F1534B466FBF0DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637346, "uuid": "2b4e180f-bab9-4ebb-b92a-8d6119d67020", "value": "6c8408bb5d7d5a5b75b9314f94e68763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637346, "uuid": "ec8f3dd5-cef0-472c-9205-6a7dd18a5a41", "value": "768:u2v9Ij6f3J8OT1PMK30DbQDH2doyomHRL83M4/NShWxEs0l29SFd2Xyj09rLd:fmET1PMK3qbpHY3M4wWmXgSFTSrLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637346, "uuid": "33faa26f-b811-4471-8554-c54885438608", "value": 55810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637346, "uuid": "a3d6d7d5-d98a-40e1-8bbe-4423e5d477f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637346, "uuid": "d5716d02-496e-4aed-9827-83da826b9a51", "value": "f587adbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceead3d9-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673581, "uuid": "58acff50-0566-4ec2-a163-0a3b5af6bb4d", "comment": "Malware payload (Dridex)", "value": "214a254bff34cbef56b04a5f9049f7b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673581, "uuid": "60016146-2968-4970-89d6-5c29a58ecb61", "comment": "Malware payload (Dridex)", "value": "15da024ee0877da3520c3b4b636760ab7cda428e02e8cf1a3bfcf35d90073a50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673581, "uuid": "5b2ce045-bdfa-47da-9338-4a5eb4273620", "comment": "Malware payload (Dridex)", "value": "c9eb2b28988056a0c7f2c02f99919eaa8f252cdc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673581, "uuid": "4f8cecbd-52bd-482c-812e-5a23fa6c4fea", "comment": "Malware payload (Dridex)", "value": "8365e58775f4fb87ebe0abd179bd684af375fab4a74f543fbdadf9aac64beecf40e59f0fb7346f83e8f086d1bb666043", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673581, "uuid": "d61b1dc1-7660-4a6d-a243-dc157c2cc2d9", "value": "CDF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673581, "uuid": "60a2b741-70df-4779-a337-11ac14688f64", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673581, "uuid": "56f7261e-d819-4819-a822-f439302a2027", "value": "3072:+esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:w4+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673581, "uuid": "21f0c845-7916-4731-849e-3d638a321588", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673581, "uuid": "a8bc16e8-6726-4c7c-983f-8c33f59eecd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673581, "uuid": "65edfb04-e442-4067-b9eb-d90f28ed60ec", "value": "214a254b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8698b19-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676980, "uuid": "99eed7de-8e4a-4ce4-9b05-2f49c79c77c6", "comment": "Malware payload (Dridex)", "value": "63997b6e804bc17985487ea095b05978", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676980, "uuid": "200caff0-4c52-41cd-9ef3-373cd334821f", "comment": "Malware payload (Dridex)", "value": "1631b92a0c6967f2f66ec58dff502b5682662682d44a915de6570f2463289132", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676980, "uuid": "824e942c-c36f-44e5-8aa9-4b7670e9ef2f", "comment": "Malware payload (Dridex)", "value": "4c3ba223841e8da54b27aa0564aaa14c5afdf543", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676980, "uuid": "b3e089ba-2cf9-4f28-b618-f5984dd3153f", "comment": "Malware payload (Dridex)", "value": "32db0bd9e3a048260c1a04316ee1479848aca959903f734c04f01052a9359fec25bc0832f61f8c16bab59b86df3c594e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676980, "uuid": "c46354ab-3882-40ad-ad62-569bd2349311", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676980, "uuid": "d8c7a23b-e659-4b62-bd58-5765736e0d39", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676980, "uuid": "202cb0c3-29c4-435b-a0b7-9951565ada81", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676980, "uuid": "3d093b37-c336-4709-9550-0300e18b6d1d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676980, "uuid": "a9f2b0a2-4d0f-4c8b-a984-c660c8b2d542", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676980, "uuid": "3d91432f-924c-49db-8ed4-18947ed00664", "value": "63997b6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc7ded9-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673469, "uuid": "60405cc3-1abb-4bb0-b307-a1f702f0db74", "comment": "Malware payload (Dridex)", "value": "01f5439a8019f1c368250771363ed7c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673469, "uuid": "f120de60-51d6-4775-8412-521c0cf31dd7", "comment": "Malware payload (Dridex)", "value": "1644ade5138c995fdf9be3f6488b3e6a40d4a4e1d63e8f36f7c161e18274d9d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673469, "uuid": "ec325a8e-944d-41c2-85bc-7485defd0412", "comment": "Malware payload (Dridex)", "value": "6aaa2ba661c5b4c4d27482085412ff102b576bb8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673469, "uuid": "b50cc478-7d7a-4306-9d91-a5412b429bee", "comment": "Malware payload (Dridex)", "value": "93571b9e22ce158f1fda1fd92a40599b80eb6a23cf78dedd02bccb82c182fc184e9be7802ae426dc18b144b0d05eb387", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673469, "uuid": "f867012b-63e8-46c8-8c7a-b7f2fe257ae7", "value": "B3F3D0906A97DF0ED9C13CFD6A96A879B163468D811FDAB8D0CE84CEA4775B30327113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673469, "uuid": "79872626-edbd-49bf-92eb-d151e9404b93", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673469, "uuid": "f72e722f-1a0c-47ce-9a6b-367fc6a17587", "value": "3072:+esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmm:w4+VZQpt5hyPsa1ekiEtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673469, "uuid": "cef04985-803a-46d0-8387-72f57950bc6f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673469, "uuid": "ec326379-37e9-40e2-a285-3c3c918c6d02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673469, "uuid": "deaa973b-83cc-42ad-ab13-00397584df8f", "value": "01f5439a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4e37d8-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673312, "uuid": "ca614444-bd73-4624-bcb1-3ee83303d338", "comment": "Malware payload (Dridex)", "value": "fd30dcaa16258526dddc5af1313a25c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673312, "uuid": "c6bfa0c9-943f-4291-9656-bcce274d6505", "comment": "Malware payload (Dridex)", "value": "16c3394877560e840078ce917387f4775f3ab069fdc4625a088ffa35d63a1cfe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673312, "uuid": "8b89971b-cc2a-4668-8ed6-1c5a8feb071d", "comment": "Malware payload (Dridex)", "value": "51395770056272a3ab4c7ed4d12ad0fa4480b84c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673312, "uuid": "635821b1-fc3b-4dd8-ab6e-4f46809bfe7b", "comment": "Malware payload (Dridex)", "value": "0f59c7141a6fa7559ab3ce67b05c2f2f04a46d7407f28cc1baeb99f62557837e817588a15872508b0efd2d44c3e07afb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673312, "uuid": "6cefe7bb-1b65-4896-a4f9-991ba6cceb0f", "value": "AEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673312, "uuid": "29084bb8-cb88-4eb5-b85c-e85a50d4ef95", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673312, "uuid": "dba24b3c-a4a5-433b-b423-8ca33e71e1ad", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673312, "uuid": "05220c4b-37a8-4496-b2a0-6ab6d4f0154e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673312, "uuid": "f96a8c49-584f-4c5a-b451-23383d5d8986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673312, "uuid": "7e12c38f-0004-4036-9929-6ed07edb2cc7", "value": "fd30dcaa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcbaf66-b1b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666738, "uuid": "840c3471-2dc0-4e6b-a69d-2e8e4a5c531a", "comment": "Malware payload (Dridex)", "value": "f07a3afac91da07c8a219930c852ca6d", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666738, "uuid": "17161d4d-0f28-4046-a61e-21bd6f5d414a", "comment": "Malware payload (Dridex)", "value": "16f4c242270f79698e9e6aa26b928383c3cda6f9d0050a2f4fe76a4894ae0d81", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666738, "uuid": "88afe60e-e5b2-4bd2-a356-c5b432c6012e", "comment": "Malware payload (Dridex)", "value": "46b268ed412a37b509212bb0188ee1d24e56a583", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666738, "uuid": "e28d3f9b-b677-4483-8436-f96055753f7e", "comment": "Malware payload (Dridex)", "value": "206ea0d134ee90471a11bdad2ba50f0e53f357dce1298717f8dd87fefbfe1af96ae0ce892282640ea61bc9bf0e0839ee", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666738, "uuid": "ce94f947-3b2c-46ff-a3ae-686df76e55c5", "value": "1006332A975C17E9D8320A7E5DF59EC0891F7A73CD5028A7F93D4C99060A2470F4EFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666738, "uuid": "304e4186-f607-429e-9351-5fdc29550d20", "value": "49152:RDOmt2yXesBPPW8TGN06KJKPoD68cwCSIQ/8IXDQJkGmbK+tut8JWmXq5de6D3Oe:DBXeSW8tJVLZ8IikcbaX6VDlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666738, "uuid": "f2f1eeb4-84ac-4a13-9904-b2a38b4a2fcb", "value": 3670595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666738, "uuid": "f7e21fd7-e16e-4407-95a0-fa970e0b2a12", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666738, "uuid": "b9eab32f-6362-4311-895e-e9c781d4d73b", "value": "scan of invoice 6585050.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac77b3b7-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676959, "uuid": "94eba4db-6e66-4d17-941e-bbed5bd542ad", "comment": "Malware payload (Dridex)", "value": "3ca5376b5710435553300e9254b35ca2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676959, "uuid": "1b769572-14d9-4937-92b7-d757f56afa8b", "comment": "Malware payload (Dridex)", "value": "1726a92666b469c7698bc8556164befc0adb1e71dcff36770e789a407c08e18d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676959, "uuid": "8024137a-5932-434e-a6a0-3eb839adc10c", "comment": "Malware payload (Dridex)", "value": "3377f50965664f2c799e058f952c1a6867f66eef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676959, "uuid": "ed55a545-1be8-4987-99d0-45bd6abc7199", "comment": "Malware payload (Dridex)", "value": "c1c6335e410f9822223a421343b34777208320c133355249e211155fc54be8393b08a7bfcf8da7897832111cf9b01ce2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676959, "uuid": "33d2a64d-7c96-4011-8a97-3ec1ad744426", "value": "C6F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676959, "uuid": "38a74fb1-c30a-42f8-8cfe-69f53e6df7c3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676959, "uuid": "b759585d-a2b0-49a1-a9af-fc09df7fd9ae", "value": "3072:ZWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Z42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676959, "uuid": "fa255e0c-7581-4314-b775-38fdd2fb0992", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676959, "uuid": "2f92c06f-5f30-4290-a57f-e367f007c87c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676959, "uuid": "81f11488-5211-4da9-828c-e1147d797c53", "value": "3ca5376b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfefe9c-b16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1620636321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636321, "uuid": "c7e15387-a747-4dfc-a03b-8e5d49c65e74", "comment": "Malware payload (NetWire)", "value": "65367593dd25c69bb2e1e3026f2553bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636321, "uuid": "d312e33e-5d99-41fa-9d22-347ae1faed80", "comment": "Malware payload (NetWire)", "value": "174abb1d310ed4d66212452b8fa479ba77b8a83ba848a6bb748d68c99c16b04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636321, "uuid": "2636f1df-16d3-4968-ac8a-f6504dcf0614", "comment": "Malware payload (NetWire)", "value": "c0c27e7a17e23460ebdbc48891fb1aa0c1d5e7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636321, "uuid": "0cb24ede-898b-4c0e-b61f-94df16f51c82", "comment": "Malware payload (NetWire)", "value": "bd7cb28c0e6b5fbbc5dac221b2a4f31268fa1b5843fde307600755fab40b4c310b4424a278837a355e35b39fd19ea883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636321, "uuid": "e557521f-b74b-4f61-a590-9ac3a3e6ae57", "value": "25D4BF06A2549AFAF167E6B609A67D3485A4D9B02F2F4CC3E3C36D1E9536AD13334307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636321, "uuid": "1d4b9bf0-e75b-4c1e-b02e-fd62189b866d", "value": "97e2c12caa019c315f32545fbee08713", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636321, "uuid": "4282bd47-d85b-4173-842b-a388a6ab2a8a", "value": "12288:ISbkTbogZzP7B9RAzSXa2y7bBXjGLjL2SPuixPvr+AIzJgRTx:IZbogtPlHAzSXa2y7blD6pk65x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620636321, "uuid": "a227e4b5-62d3-49cb-a889-24a886da624d", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620636321, "uuid": "e7ec4d71-820d-4c01-b674-a2226967ec52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636321, "uuid": "79535f54-d932-4c59-a6ca-2aa26c7f5d01", "value": "draftdocumentsofladingdocumentsMay11052021Sca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8606e9-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666194, "uuid": "94de32e0-2821-440f-b0d5-3c3d65608456", "comment": "Malware payload (Dridex)", "value": "4496c2563b10493a27af9ecedb45b761", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666194, "uuid": "d3c5346b-b727-4ed8-812d-9269e45f9246", "comment": "Malware payload (Dridex)", "value": "177bf29a716e892b39f1c7c13ab31290dcfe68c0941e4670b97230feb8e07b80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666194, "uuid": "381d0d08-ab28-459c-8355-5420eb7be8e2", "comment": "Malware payload (Dridex)", "value": "24ddbd4d1f6cafc690cd4a2243a5269bc023ca7c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666194, "uuid": "44885230-ce1a-4e9f-9d86-1f934b005a82", "comment": "Malware payload (Dridex)", "value": "7f3c0c81e87eb315e52a48efc4aa8bac2f272890a2026263f4fd761eb2ef78029adaa1dc924147089690396bc3c1de7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666194, "uuid": "7bfe217d-9dcd-463a-9191-0e44dedc8754", "value": "ADF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666194, "uuid": "77cd6ca8-aa21-45c8-b19e-2775fed7be04", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666194, "uuid": "6d65c858-be0f-41ed-8f42-1da5d6d2c861", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666194, "uuid": "a0a4d3d6-f132-4368-b125-4bc9caac9c72", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666194, "uuid": "6499bab6-2490-400b-ac69-c07980ba32e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666194, "uuid": "1d1358d4-e71d-4183-a8fd-b284cebdff04", "value": "4496c256_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a743a2a-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669816, "uuid": "c2b92a81-05d9-478f-bf72-5f1701695f91", "comment": "Malware payload (Dridex)", "value": "50045dd82d8996326fe7d55cc144fd05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669816, "uuid": "44c113ec-de1c-4825-b23e-30766abab200", "comment": "Malware payload (Dridex)", "value": "17be0d4c6aec3ebb7439f041caa47d90ae8d436c66f4df6ba713d5b04a215cfa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669816, "uuid": "dc9c6574-5fee-4c6e-8caf-1bb842fc9870", "comment": "Malware payload (Dridex)", "value": "9dd51cc053554b5f1b0ea7d2759d6a2d68ac63e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669816, "uuid": "572874c4-9713-4291-86dd-34f3fa2cfa49", "comment": "Malware payload (Dridex)", "value": "12acdfdbf081ba0bd7f347c023fc69d34060d836c231e20d4c31ba19a52dc871e067747a24529b2df5fb7c169140c78a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669816, "uuid": "a44e6013-0def-4f57-903f-127627060797", "value": "B0F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669816, "uuid": "6ab573f1-1e2d-48f6-87bb-c872d5469fde", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669816, "uuid": "4202850d-58fd-4e79-a030-6c04ecf5192f", "value": "3072:r/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL0D:ZbrE1kvcB74DXZ2MelVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669816, "uuid": "9191da5a-8a85-4c77-85ba-67af09d123b5", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669816, "uuid": "8c631e85-a9da-41ce-9312-640ce2320de9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669816, "uuid": "dad14eb9-68c4-47a5-a01c-e1ab21fb6a9d", "value": "50045dd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b36657c-b137-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620613687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613687, "uuid": "d243bb3c-9889-47e6-8679-b64eeea4375a", "comment": "Malware payload", "value": "4ec36e580f6ea32cda1d678d436304de", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613687, "uuid": "a9645d61-f7b5-48e9-9981-48357f5ac2cf", "comment": "Malware payload", "value": "17da4a362492ae15a57ffb52a3b462355975dc187fef6b11422585823798e2a7", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613687, "uuid": "1b99b376-39c9-4e98-8eef-3194e9cc97c7", "comment": "Malware payload", "value": "3d4d26b9eb473ad33afa009d67fbabd97f80d497", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613687, "uuid": "d6e1fcb4-b49c-4c36-a625-4f81c5792e11", "comment": "Malware payload", "value": "fd3bee0389363f2bbf72397fbddaaa071f9e4685e100a381638542d932735d77e8cb85e86394260d9b88087327649b87", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613687, "uuid": "4a688687-e7ca-42b1-b80f-c8f23d6e1131", "value": "8A514C7821BE94768CE821A1731669FE531520606DD1FB94F7E6C0DA6F3858A10BF3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613687, "uuid": "3646254e-f5d6-486c-a7b2-86ff5bb470b2", "value": "96:74iD+48+ZUVUC2GH/UlkH/YVUC2GH/UHBGoAoH/UVUC2GH/UKH/U8sUjH/UdH/AR:NU+ZUVUC2GH/UiH/YVUC2GH/UH5AoH/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620613687, "uuid": "3de523b8-e4a2-46db-8b47-753cee82dd47", "value": 3100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620613687, "uuid": "8798d2a6-ec1b-45fc-b982-5b4df3e133e0", "value": "text/x-c", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613687, "uuid": "5b13ec20-d095-438d-88e4-b849660a3dfa", "value": "S4UwfzPV.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288e9027-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684040, "uuid": "3c6734ef-26c7-46dc-8436-f3e3ddfefc6a", "comment": "Malware payload (Dridex)", "value": "8a4404e7270dde7f2b8eb938a5889022", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684040, "uuid": "dd90c2fa-31c3-4f1a-88da-41db6358f671", "comment": "Malware payload (Dridex)", "value": "17ecaec1874b0fd5d9a2415044fc2368d0355e64805ceb9749db4c92c41187b8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684040, "uuid": "18adf768-5a73-4c55-8b62-9a4f9ee18fa8", "comment": "Malware payload (Dridex)", "value": "222fcea0d49f3462494063e940b58269f2682a54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684040, "uuid": "25cc0379-a8dc-4a1f-bfba-92e9ee5b265c", "comment": "Malware payload (Dridex)", "value": "b5fd02e9d42a02b9f00cca30eb11eb35204a9342b083b2fc708430d2393af2cf374b3080b5d2629484f28059b80df83a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684040, "uuid": "e70afcc7-bad1-497f-9ea7-8b1c33a0c745", "value": "40F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684040, "uuid": "50f07e66-8172-4d2e-ae4d-940d4dd7fd4b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684040, "uuid": "3cb5c21c-3c60-4bf9-8d14-5a852df1d3d5", "value": "3072:xA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:x3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684040, "uuid": "c12a4131-4f56-43f8-bab2-06d800bb44cc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684040, "uuid": "449c8525-0ada-42a3-9a11-0e92987acd9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684040, "uuid": "77d44678-2dc7-47d8-9d9f-05bb90e48c2d", "value": "8a4404e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3dddbb-b1a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662490, "uuid": "98a331ad-cd7e-41e3-942d-856ea5ff9bd1", "comment": "Malware payload (Dridex)", "value": "014bf5326933d18bbfc70904d0deb7cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662490, "uuid": "7c0400ad-d850-44a5-9650-18194d771701", "comment": "Malware payload (Dridex)", "value": "17fa4117d2518f50a752daa214ad91f3db61b1767f444f5f98aff68ffc198e94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662490, "uuid": "f5bfd118-e7e8-47f1-8bfc-ad6cdc9da650", "comment": "Malware payload (Dridex)", "value": "f335b8865e60ea0f0a8e5068324a20f36ed5c155", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662490, "uuid": "88eff88f-3d59-4105-9729-1671c41019f4", "comment": "Malware payload (Dridex)", "value": "7048025b918e306f74f518af3f63c790760e78d37e2b1f7d3ce955897b63d6fdb3296881d4042213c9362172fb74ca71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662490, "uuid": "ea61b7af-f24c-43c9-991b-eed81f880341", "value": "15F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662490, "uuid": "bad4dbb4-72d1-4058-9164-ef746bb52e82", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662490, "uuid": "a50202f9-dbb7-4423-b1bd-b72c921930bc", "value": "3072:qIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662490, "uuid": "575fffb9-c15f-4884-98b6-2f3bd2815302", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662490, "uuid": "a792da7a-e28d-4334-a8d8-235ae89706bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662490, "uuid": "257f7a3a-17b8-44e6-a0d0-4d45b59c1ddf", "value": "014bf532_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11886a47-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1620630743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630743, "uuid": "cfb54fd4-2967-41b3-9a5e-b89dcd3bfabc", "comment": "Malware payload (Smoke Loader)", "value": "1ec121f8346019ea6983e09c0e95988b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630743, "uuid": "9d3e00d8-c9df-4b7b-a401-a4c0fc05b495", "comment": "Malware payload (Smoke Loader)", "value": "18cd059c6141fcff83f1a715a3599a35e18ee0e41500844ae9691f62df264d6e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630743, "uuid": "76cdd5e6-64d2-4c1a-aa64-ed0a2ce3f561", "comment": "Malware payload (Smoke Loader)", "value": "e5ae4098dd36b9ffbfde1330fb677cc819ffe0ea", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630743, "uuid": "355bdedb-007e-4d4c-8b42-86c1795d9688", "comment": "Malware payload (Smoke Loader)", "value": "e87df21efe6538115175620a3b8a6f41821f2a3d1a914982dd8b00037009ef8c8746ee32e2eae1bbc981bab2bc2ee305", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630743, "uuid": "8048a0c9-7ef2-4132-bd69-4146509b1cad", "value": "89D4AD2533999F49E8FFB7F50470500057F178079B25E64DBDF2A48A1AA2BC08A27B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630743, "uuid": "203781be-cb21-4f88-9f92-981c1eabb738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630743, "uuid": "ea02d4f1-d129-46ba-8040-5f22b0fd2388", "value": "12288:Mp7fMmbjeBw4Y+OIKh37ekaUEKR9FgIKNdpHaag:2fnsOI0SkaDKRTdKztaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630743, "uuid": "d892387f-912a-44bb-b770-5a9e96298114", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630743, "uuid": "25076fdc-c744-43ee-b60d-3fa3d4cd1d78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630743, "uuid": "cfe44319-3c43-4709-aceb-89356d8f8586", "value": "PO# MOR-19BC1-055 & Design Images_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3773f9f7-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630807, "uuid": "cdce13f8-1451-4901-9ed6-bd343f7e3284", "comment": "Malware payload (AgentTesla)", "value": "15a8463a49f227a5f3f039f82d95263a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630807, "uuid": "3c84e1a2-2c9f-4ae6-8903-0317b091e876", "comment": "Malware payload (AgentTesla)", "value": "18cd8b9021652af59e12ef288f2e7d8127dc3a65e9a6c793fff85a046dfbf307", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630807, "uuid": "0cc27039-3dbc-4364-8dfa-850868fde69d", "comment": "Malware payload (AgentTesla)", "value": "d50d48066dfca7e7aad759d116031dd567a42ba6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630807, "uuid": "f06c540d-ec7c-4dd8-9f28-71096dc3246f", "comment": "Malware payload (AgentTesla)", "value": "ec255dc1c30f53afceec06b2dff037d84490cf8ea6e06ecceb6c8584c5432483b89cf2b00c2ce88f1894add6ef71968a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630807, "uuid": "9327caf1-4a57-4a35-a879-7980ccfa23af", "value": "251516802666A19DD0613BBDA13134E003B8EE27F9E94DD7429C7B22FDFF9111FA1925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630807, "uuid": "e504d2a4-e6b6-4c8c-9362-9d6e0a6c8651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630807, "uuid": "2e3ac51d-a151-4fd3-b4fa-e9782717eeea", "value": "12288:ObKxeayECYVyC6o0PgV39Qxz5lVpfqmkpqnuPmiYrGHJbsC+hea2:IIeazk46z5lVlDkp4oAhea2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630807, "uuid": "a0a088f6-f094-447a-b401-10fdf49de7db", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630807, "uuid": "034ef24e-5353-4149-9518-129a3c31c159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630807, "uuid": "78896bc9-602c-4ae9-99a6-095872644590", "value": "Industrial Bank Details.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a505290f-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673511, "uuid": "5d0afb14-f0fa-4943-a155-7484b714888a", "comment": "Malware payload (Dridex)", "value": "13704a5ddf08071d8e554c6deac6860d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673511, "uuid": "50dd0b41-f7e7-484f-aeee-211a16c7df58", "comment": "Malware payload (Dridex)", "value": "190ab127a55ec2601a87e3db8210f96732b87c9e83c9cd3e770c991810af6e2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673511, "uuid": "7932aacc-8eb0-40eb-8a05-f9abb0f1a093", "comment": "Malware payload (Dridex)", "value": "ea54603be24cc74fb7dedb0d3f346b27c2bf2fb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673511, "uuid": "5b92a101-aecb-4990-b537-23677880b342", "comment": "Malware payload (Dridex)", "value": "a494eff147b294a32007da5e47931abec60c8366aad22dc64b1543682ac8eb471543bb26c006d873e935158f086e04d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673511, "uuid": "8fda7028-c34c-4a7a-ae73-afbad0859d35", "value": "32F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673511, "uuid": "5d693716-62ed-4e3a-8c9a-d9590fc5e350", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673511, "uuid": "46ce5708-cb3f-459d-92c0-89c2e7a6233a", "value": "3072:Gesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:I4+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673511, "uuid": "a1e9b4de-e561-40e8-b074-11ef5c2f781f", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673511, "uuid": "da12d5c8-7983-46f0-afd2-f69fd79e4663", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673511, "uuid": "a63e5591-ac93-44dc-ae87-89d96aab42df", "value": "13704a5d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305d2dbf-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651840, "uuid": "d136296e-66a3-4b43-9358-994d21e5c11c", "comment": "Malware payload (Dridex)", "value": "780f4490f21a1beb0eeedac679177ed7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651840, "uuid": "fd828707-b2a5-4def-9abb-2be5e0629ff1", "comment": "Malware payload (Dridex)", "value": "194493c46f4ee77ce435bce2c00e9833cab9b7218323e9c62fce0679ed634357", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651840, "uuid": "1795e229-2c6d-4776-becc-660a986f5219", "comment": "Malware payload (Dridex)", "value": "35f8735189607535bb492f62a64bcfc9ae4a0c23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651840, "uuid": "ed3075b4-90a7-433d-9323-ef933efc1ab2", "comment": "Malware payload (Dridex)", "value": "f18051d3ae47097f16be01790c70459d371ce13bc253fc01e7b3d228aed1c14d04ace6aed115be9d843c5abee26c0aca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651840, "uuid": "bf64436f-5e33-43fd-9d17-8e36a1efffc3", "value": "FDF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651840, "uuid": "8f2ffb1d-3c84-4b60-981e-91e70cbbceb1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651840, "uuid": "44eb6a30-7870-4b36-bc70-3d3b6ea76506", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651840, "uuid": "d1933b6b-d4ae-4a0b-b3f0-33e06914d55c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651840, "uuid": "f21f3765-5a79-4d09-b6b6-2863b78bc0df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651840, "uuid": "9391cac3-0e30-438f-84ac-b232d5997ae7", "value": "780f4490_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a5c6f1-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620669086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669086, "uuid": "2b99a750-e2e0-4279-8716-b46fc993e8e3", "comment": "Malware payload (AveMariaRAT)", "value": "d3990c6d34f19e97857f9d304202b5c3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669086, "uuid": "56b4d095-74aa-47b8-8eb3-6f34f4f053c3", "comment": "Malware payload (AveMariaRAT)", "value": "1967e0a5da88244c0b9ce1c35f7df573c1004947ea5b39f94cd45176ea940894", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669086, "uuid": "1b8febe2-2887-465c-aa5f-bf5ddd98490f", "comment": "Malware payload (AveMariaRAT)", "value": "d3de7e7b07dd0c215969d2df7c808eff14191018", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669086, "uuid": "9be9931e-f260-4b0f-9d4a-f5058e02519e", "comment": "Malware payload (AveMariaRAT)", "value": "cd2754ee5490f2699c1ac2e7bb8fcdb29e2ce7ddc4223cdbd4a4489b0711e48ec6825a489138486247c73ef2b9716e0c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669086, "uuid": "752b72ed-d2cd-4b23-81bf-539109d2d7ff", "value": "BBC4DF25335C9BA4E17E973AC0B0110493F3F817E775EA8DBEA950DC7962F418662B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669086, "uuid": "c4a8c30b-098c-4297-a4ca-6187df832eca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669086, "uuid": "742fba8d-335f-471a-8763-1205675f52dc", "value": "12288:ghjVy15+iliSEiif0EgCr1Ov0ryGU4vw2LF58dbw:sjVy/+mqHfCiObWvX58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669086, "uuid": "c1fc1757-9da5-4860-9ed2-373d459bc965", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669086, "uuid": "0e98ad2a-13ed-4ac7-8c34-c80fd57f3579", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669086, "uuid": "387c88f5-8c96-4d94-a954-5bcff64a209e", "value": "PO.98504_samples.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb01ba6-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620648081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648081, "uuid": "3b65b789-e196-40b0-aae4-bdf53a66abdd", "comment": "Malware payload (AgentTesla)", "value": "aa04cdccd7edd4d96998ea6473f8cf54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648081, "uuid": "016a21a7-4148-438f-82d1-e4261c3508c9", "comment": "Malware payload (AgentTesla)", "value": "199cef071e6146b1024c6d1a51b99bbbe19fc04105eeb1a90ca97bc18fc411a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648081, "uuid": "95942717-c3aa-4dad-82a1-8125d42e38d7", "comment": "Malware payload (AgentTesla)", "value": "99be8c80b33fa6da2aff2b8eb4ed7e58a42ca788", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648081, "uuid": "c1280785-7d14-4b29-8513-75a3d1f429d5", "comment": "Malware payload (AgentTesla)", "value": "d21f525367279d74aaa240027706f4b50a129c39414caaee7a62aba2ea280b74d15c3f366931348b10a971ebf80e0ec6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648081, "uuid": "2279d204-295f-45b1-a4e7-e9354a09d515", "value": "9525CF117F81D818F09F5337C9AAC16483F1BE129652D71EB9E8361F3932752EA01B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648081, "uuid": "f7f85a4c-b895-445d-8aca-67d539fb572d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648081, "uuid": "b3d8cd92-d9ce-40de-a63f-57635b4e707c", "value": "24576:LIX4tUWr7KJkhhhy4J3o1okSO6uTsekqqNFzj1un:MvWrG14V7oTFkqAjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648081, "uuid": "e563eaaa-237d-495c-a512-eee40531ac41", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648081, "uuid": "186f57ff-3cb5-4052-9660-b7b11ef6fcc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648081, "uuid": "df9428bd-624c-4476-aa70-71d8b9255758", "value": "aa04cdcc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475998e4-b195-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620654027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654027, "uuid": "491ca4a1-df69-43d6-b08d-200755a0fa18", "comment": "Malware payload (RedLineStealer)", "value": "5b3104da61bb59a54a1245727b4503aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654027, "uuid": "fe9fbb75-512b-43b8-befd-3fe0b4255f76", "comment": "Malware payload (RedLineStealer)", "value": "19e8e0b137eada5a7e4fe1f41231f5864bea6d99bb158ff0d7f245a4eff9dcf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654027, "uuid": "9e5a3c42-d44b-4c86-b7a8-91f016b5a57a", "comment": "Malware payload (RedLineStealer)", "value": "3c1c3403f4872012700c9d00f58bc54726a59eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654027, "uuid": "92aa3945-4c97-4e05-9db7-dfc63750c0aa", "comment": "Malware payload (RedLineStealer)", "value": "bd612980872c2c677a12c40657a598ff61930c3a1ea978991096f62708866d1a8dd26b509484dd24015f48e83eca2294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654027, "uuid": "4b9a3695-f45c-41eb-9535-34eb9541cfcf", "value": "C8C32B3C3BC9AE21C5ACAA7B81D2500487F6ACE51743F31B9DD072F498B2BE55907A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654027, "uuid": "f4e042d1-6af5-4ecc-b34b-bb262b1baf3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654027, "uuid": "9f3e12b0-23b6-47ed-a147-328f08aa16fb", "value": "3072:SeiMV38WYlKlm/72u+8JVG1i6wVNXvw0km/q+LLLLmDe7LTUeDLeTxeTvG6LLVTY:pbVL2iu+WVGI6IFvBkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620654027, "uuid": "89e0b064-ebae-4b94-8737-a0377efcde7f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620654027, "uuid": "5a5ff178-5c21-4508-81ff-11a545f77ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654027, "uuid": "3f1b9789-e953-4e30-a39a-2586da8a387c", "value": "5B3104DA61BB59A54A1245727B4503AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de8a86a-b12b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620608591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608591, "uuid": "15aebe2c-9d96-4f28-8d0c-22445e41308f", "comment": "Malware payload (Dridex)", "value": "c855d3b7211c2ce46fd78cd2e36a00f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608591, "uuid": "995590fa-8172-496b-b844-cfe96a3a4296", "comment": "Malware payload (Dridex)", "value": "1a02353bb6f1bef5da591fdaf36665f36e2410358514518d735a6ebc1e24fe11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608591, "uuid": "734f42b6-9e0c-4534-b98b-f52733fd1a26", "comment": "Malware payload (Dridex)", "value": "148b7348a27c90547b0e276a35fb5593867e699f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608591, "uuid": "8c00419d-1590-470c-9432-10ace47deb41", "comment": "Malware payload (Dridex)", "value": "5827efa629f57f6e2853e473ba6460ce3ea38105ba94788f9f72b616028309675b6cb4281be7ff58e04cc1e0d1b3d16a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608591, "uuid": "1bf04ba2-d377-442b-8e41-13388ccabf41", "value": "22F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608591, "uuid": "fd48be6b-e0d4-4cab-81bc-adbef21767e8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608591, "uuid": "49a564aa-7b5c-4d20-af39-b0577e2b922e", "value": "3072:+lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:+lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608591, "uuid": "240c3b1a-8375-401e-b51f-d33245906f78", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608591, "uuid": "826094a9-6e09-489f-a082-c51f87171ff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608591, "uuid": "54a8e47b-9309-4048-aafa-6b4d77bb2f09", "value": "c855d3b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d87db8-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687733, "uuid": "3279a0c5-3c86-4e69-b2cb-1d01d6be27c1", "comment": "Malware payload (Dridex)", "value": "39f535cc5aa0535a903e04ce48071619", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687733, "uuid": "ec384fa4-5817-4760-8349-742c9bda965b", "comment": "Malware payload (Dridex)", "value": "1aa154145f24c52dccba7f360bb23e78af04fd3472fbac89fd79fbe999ca8671", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687733, "uuid": "6154dcdc-678d-46e8-9af2-7bbbdda543c0", "comment": "Malware payload (Dridex)", "value": "ce893588194063f6b329a859e97370ae614e1489", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687733, "uuid": "9f2077e0-a0f4-4e43-9289-1b2cbbc890be", "comment": "Malware payload (Dridex)", "value": "ea26c4fe36b64606f540f5e9c80f4d848c375315d5edd1aaedc79a8ab8f05b68cbb60dbfd135afd66b77f9ad421d72af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687733, "uuid": "6cdebb8f-f980-464a-ab6e-83630eb6362e", "value": "85F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687733, "uuid": "52f6ad43-bb40-49f9-a292-cf463bf82320", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687733, "uuid": "b35d5fe5-6470-4fe6-a725-0b76efb8f301", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687733, "uuid": "75b71045-c66f-4a88-bfe4-d1b1ccd2b349", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687733, "uuid": "aeb1263e-b29b-46c4-89d6-e96441cdb8ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687733, "uuid": "9319cf87-a0cd-412e-949a-2a38064c62e2", "value": "39f535cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326962d8-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620662581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662581, "uuid": "c43c2d39-162e-46c2-b7ee-6b36d5dcb70c", "comment": "Malware payload", "value": "cdb941f70cc0049542716b8810471484", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662581, "uuid": "173de7bc-8fbd-409a-8b20-0d18b30aa9e3", "comment": "Malware payload", "value": "1aec49fa6adb7e02d9cec2747265869c4e69dc4bebd01ee664f84b3e03fa8afe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662581, "uuid": "8d33cf0d-3295-447b-a2e3-2f1fbe55f5e0", "comment": "Malware payload", "value": "167e8e2e225923e30dde8c908204ae1bca428486", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662581, "uuid": "2e623ec3-6898-4cff-bf61-7bb9fc2a5b1d", "comment": "Malware payload", "value": "204dd6717cf40c815fd35b1843eb433964b261a53f19d7191d86d61d5ead5bac76ff9292d5a942348505f1adf7e35882", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662581, "uuid": "c69351c6-eede-4907-80dd-1b82b532a8fb", "value": "274302DADE633F67C64256334904AC45673159B611587BAC4FE0FE2EC81CA2DF4A208F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662581, "uuid": "b47ad626-8386-4e9e-bf4a-98b20492aab7", "value": "1536:u+tslm9YFtuph93rYtm3YCaxAwlaUHR+Gzaq85NA:u+OUlphJimofKwQUHr2qSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662581, "uuid": "d78992ba-5b68-4eff-9aa0-54f4443745ad", "value": 55256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662581, "uuid": "283e7522-c08a-4c42-a790-752477d4beb6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662581, "uuid": "2ae7d84f-074a-49c1-8c4f-332d51822b70", "value": "cdb941f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82476661-b192-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620652837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652837, "uuid": "d5d658c6-2429-4e8d-84d5-55a8d41d10b7", "comment": "Malware payload (STRRAT)", "value": "36dcd262d70e5127c413253598ebdd87", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652837, "uuid": "d35c9c8e-b50d-484d-a67f-f6ac0fa2c9eb", "comment": "Malware payload (STRRAT)", "value": "1b27fd330da9cc668f6d2e823523cf676e8c5020b0975f68d0d6125d17c03792", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652837, "uuid": "beb86778-f97f-4c29-8953-8b9a54774f32", "comment": "Malware payload (STRRAT)", "value": "2ad94aa5e8366c843f9451e774d48350a6f9c432", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652837, "uuid": "85bdd994-65a5-4a53-bd28-f1b1f1533c08", "comment": "Malware payload (STRRAT)", "value": "94857fc000257aa54e34a9baeea05e653318d38fb1850d4a4207e73bdf65ef3a8c51d25c985189d1a585455fc3f633f3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652837, "uuid": "b4a121fa-1ce3-4b2e-82c4-feef603fcf7f", "value": "DAA3E00B3DDAD1AAD01384B34560D633A61D42D8E05AA09F12FC198A1E73D6E976F9CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652837, "uuid": "d4d517a5-226c-4dee-8765-580fff78b0e2", "value": "1536:bwbASPEGINKcz+VkwPRihEUs3F+4r3E2BJVme3j2QCbExNH+bLIhdys80W29+mCW:bXKczWZEE13F+4LE0IfQg8+bshdyl1JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652837, "uuid": "6ec1a4fd-7f8c-4378-8ce8-023dbda129f2", "value": 104115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652837, "uuid": "efcb6fb4-05a1-4b5a-9274-570003695b26", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652837, "uuid": "881c0cd4-ef95-48b8-abc1-2d22c6205a72", "value": "F14 PO pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9f1d3f-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651913, "uuid": "d9175ef5-08e1-4d0e-8079-5b8eed8bd607", "comment": "Malware payload (Dridex)", "value": "41f3ec364bae9c7dfdff569d23b978e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651913, "uuid": "c51e26ab-94b6-47dc-9a91-59f3326e8aef", "comment": "Malware payload (Dridex)", "value": "1b2d9b55273312699f6cddffccf1dbbd40905273f9ad4cfb25ee817df3943122", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651913, "uuid": "978597dc-f54e-4cfa-9852-6e54dc697ce5", "comment": "Malware payload (Dridex)", "value": "0c96d23be18c42b71671ed070d28262ab9f34a51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651913, "uuid": "fdbbe6e0-02f6-4f77-94fb-9e644d7b5439", "comment": "Malware payload (Dridex)", "value": "64d4d5228074880bf4b5f8b937ceb08175de52ff822ab3c6c0691d9ed96b6213ac2a48a616c2a711b5935970688dc1c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651913, "uuid": "cc8af466-d93f-4fa4-a6cd-0a64a187c632", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651913, "uuid": "deeb2249-f43c-45f8-b1ff-803da1d3fcf4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651913, "uuid": "0cc166dd-545b-480a-acce-30e3c159f50a", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651913, "uuid": "5d9b68ce-0663-4d58-bfaa-34ebe6cc1fb6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651913, "uuid": "116267ea-e818-4114-baff-e7783d1206e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651913, "uuid": "81316aa4-750a-435d-864b-d1bc9305a92c", "value": "41f3ec36_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9987d25-b19c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620657225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657225, "uuid": "88f04ec3-904a-4302-96f4-1bb5d88b2766", "comment": "Malware payload (AgentTesla)", "value": "e760913a1d3c11e3897361faf601dd29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657225, "uuid": "88e14aac-554d-4c2e-98fc-ebe58743cead", "comment": "Malware payload (AgentTesla)", "value": "1b3e68f87ccab05ea2dc871d3e8aeccd2d059fe7ad6ec31df61041ad3a1ed123", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657225, "uuid": "cddfd04e-9d52-4627-9788-68bb28977663", "comment": "Malware payload (AgentTesla)", "value": "67fce6d76179517d39d4743c6dae781ad75d0a92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657225, "uuid": "ad4bbf73-088c-41c4-b038-f192e933028e", "comment": "Malware payload (AgentTesla)", "value": "de7401e9e9abc9f70803505a718037e5f0120735880e9549cb18d33a36efc0b390d2abbcceed30ddc014044b267516f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657225, "uuid": "86e65158-557f-4694-a2f8-8f5f81e6c8fe", "value": "8F15AEA06AC8A644D46F47F60D62C75033BFBE1EC666C60E799BF18D0D61B438A63713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657225, "uuid": "7a257a58-4bca-4021-b7ad-664947c17c8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657225, "uuid": "57c73e93-00ba-4dee-9324-cdea084cadea", "value": "12288:Owb1W6SXVtBVw1hhhmH46vRfRllrNU7cbifOLnvypLoT6mHcO2flf+xi:OQSXVPGhhhMlvxR/rvF68Tx8O2flf+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657225, "uuid": "274b04ec-4d46-4f4b-b56e-99d15465d829", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657225, "uuid": "9c9cf3d1-899e-4230-97fa-50eed89a6819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657225, "uuid": "1d3c6816-e9f6-40a4-bd7c-c10e773444a2", "value": "win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad6a1af-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650731, "uuid": "c14e7124-74ba-4ede-b5e8-2e1ce224b0ce", "comment": "Malware payload (AgentTesla)", "value": "31864a93fbc7ca43a4b9e3ad97cf44c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650731, "uuid": "f60c6079-c5c7-4772-955f-8741eddc9da4", "comment": "Malware payload (AgentTesla)", "value": "1c09d0f4ae3db9533caafc324afad5efa6687ccd3006b27998e53235e06ee2ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650731, "uuid": "5d6ced36-b818-4cd4-b39a-e3bb4c5a64f1", "comment": "Malware payload (AgentTesla)", "value": "3cf5c4d935826aad01fc667291b01a714554b4a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650731, "uuid": "feab5f4c-5918-411c-a910-c5a1fd74846b", "comment": "Malware payload (AgentTesla)", "value": "e30886bc0d88ca3b306d66cb5394b2fc1382fe6a9cb79d7e6639e9df03bef4f1556eae30b9af29c75fb232b4e23de877", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650731, "uuid": "67a8cc27-0775-4971-86eb-fa9c9b76ec1e", "value": "06E4D02C3BE88A05E6BF67BC8475526447F8B1165917F71D4EE020FC2D7B720DA01A9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650731, "uuid": "be01f1f0-ba63-4a8e-be04-bbe175904e1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650731, "uuid": "a68541ca-e812-4092-a9ae-02098566623f", "value": "12288:Rves9Fb3yOCgSMyy9fZqZXBuoehD0Y1+V7MhTPP+B6vCKXi1gIkWpfEk+G:hd1UyAXYYxMxPQ6vtWp8k+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650731, "uuid": "9e4ae686-868b-403b-9454-dc029e2f5121", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650731, "uuid": "6f06df89-2e35-407f-a2e5-450bc5c7f1f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650731, "uuid": "567dbb17-8d5a-48b7-b634-f99b10d8476c", "value": "HL-88352588 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d883504-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628213, "uuid": "d23540a8-4faf-470c-a939-e5ef0103067a", "comment": "Malware payload (AgentTesla)", "value": "eab9dd0c6c9970b12851dc56c8e77ebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlt", "colour": "#CBC271", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628213, "uuid": "dc81a203-27e2-482c-be5a-ca63aa64e52b", "comment": "Malware payload (AgentTesla)", "value": "1c409fee36dda5337ef340dd480d92fbf68da68bee2a28f267def6bbb63755f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlt", "colour": "#CBC271", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628213, "uuid": "2e97d496-8b6e-4e73-ba24-a97ed81c058d", "comment": "Malware payload (AgentTesla)", "value": "0ce87f1116fe287bc9415a051af23c81d27449c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlt", "colour": "#CBC271", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628213, "uuid": "b9e75105-bbfb-426d-955e-8270c685cf80", "comment": "Malware payload (AgentTesla)", "value": "86788d82414cceee0c34b22f70c5b3d4ea0235bd4020fe7fb903aeff3acb4baa63ff7d2547492b72d6ac5662fe2ede7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlt", "colour": "#CBC271", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628213, "uuid": "975acc79-e165-47f0-837c-d6cba672b26c", "value": "CBF41255BA91CC4BC64207B50DA5D7D4271BFC109E77C24B3284F32F6E366B0CA936AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628213, "uuid": "079e73d2-c39d-4eb7-8edd-ed3fdacae879", "value": "12288:yLU1kGQBQ+iU7qJEiCTeqo6w7krCfIasvhpfqKmiQqDl6fXdKTNVGQoUYSdCK0xU:yLU1GQ+ifN0WvfIdfqKmdGIfX8LG/+qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628213, "uuid": "681a7f9b-b3e3-47bc-b785-907caba82155", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628213, "uuid": "3d6ae65a-9440-41ed-932d-b0a765b5ddf6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628213, "uuid": "250ce2d0-111f-4b50-942e-d8e73fec8cb2", "value": "SOA May.xlt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62cbe54-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673567, "uuid": "b8f14296-0444-4ce0-8cc8-8ae0fb3d12a6", "comment": "Malware payload (Dridex)", "value": "40e811e131abfe8de5fbf8f436d3ccf4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673567, "uuid": "9bad5cbe-a7a7-4014-942e-4e7f8e89444b", "comment": "Malware payload (Dridex)", "value": "1c4f1039bfc3908e174e38d4c4cefc7311305b491c52fe06395b28cd59d98f14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673567, "uuid": "3244a35c-9aeb-4ca4-aea6-e2c80509f3f5", "comment": "Malware payload (Dridex)", "value": "e4c034064d52a62d7b2c9b67bcc0ffb89ad27ca9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673567, "uuid": "e5777763-9657-4f38-b97c-67e6ac1d581d", "comment": "Malware payload (Dridex)", "value": "52e89e1a5aa7e84ed786a2fa72123537e03debfe4404ee12363b1ec36b9de2cb9e874547b7152e5d950f698e24d94fa7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673567, "uuid": "bfa5fae2-288f-447b-87a2-53e6b71d7417", "value": "C3F3D0906A9BDF0ED9C13CF96AD2A879B173458C811FD9B4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673567, "uuid": "93894505-484b-475d-8bc4-7d7da53f3c8d", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673567, "uuid": "ebcab3ab-1516-4fbb-8fe5-68d765630f49", "value": "3072:Lesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:v4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673567, "uuid": "c6659027-7a6d-47f2-8243-8792891d9a15", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673567, "uuid": "4fcf57ca-0c44-49fa-8a59-2069e0ed9dd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673567, "uuid": "c2124283-f09a-45fe-bd79-edf8a0517d7d", "value": "40e811e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f809db12-b1a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662483, "uuid": "def0f72c-c986-4b36-829d-33d6e38fb2a0", "comment": "Malware payload (Dridex)", "value": "2502e7a7e4fc8f6607cb84b1097fff12", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662483, "uuid": "932df7e1-af49-4497-88bc-4ac1a0192f43", "comment": "Malware payload (Dridex)", "value": "1c5bb564c8abd3c0be881c143d0cc2c62fb22351846da2c276ac13acadd08184", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662483, "uuid": "0a7742c4-4100-466b-86c8-921be00efad4", "comment": "Malware payload (Dridex)", "value": "c7eae1ec477e2eeb29bdba15052f786deef2b684", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662483, "uuid": "8601ae96-3e44-49be-82ae-4ba9517db2ed", "comment": "Malware payload (Dridex)", "value": "765a500bcb0fa9e89f36925ebccccec853bb3aec847de333b9470e248dd05ef797860bef78b34aa0c0d73effe588f6a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662483, "uuid": "d6aeb71d-06a3-44d4-9931-c65dc1c0a2e6", "value": "90F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662483, "uuid": "89d4df97-8290-4193-963d-a23f39103280", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662483, "uuid": "46dc394f-244a-404f-811c-5bfef7bc778b", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662483, "uuid": "1dd3781d-ffa9-4df9-9021-cec54be5e52e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662483, "uuid": "c71f621e-35c4-4d42-901a-8159a0bcc5f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662483, "uuid": "0acf8436-367b-4ace-a7e3-00b4665cf1f2", "value": "2502e7a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd8b926-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637314, "uuid": "21b4c032-b07f-4a91-bcb7-b7f9168a95a1", "comment": "Malware payload (Dridex)", "value": "55b212f74c73013f33d9ff365581e423", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637314, "uuid": "3c21f866-3ee9-4bb6-a692-fbc775d5c783", "comment": "Malware payload (Dridex)", "value": "1c947282fe0f03ab07c0d9e3a3bea11e9cfa0b9b756ed4f2adc1ea6d46851d52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637314, "uuid": "c4ca928c-31b0-4f22-8278-0f41f74b7010", "comment": "Malware payload (Dridex)", "value": "91eed73e16f340add801933db75b3f4000c2a22d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637314, "uuid": "397cef1f-82cd-4c39-b715-31e6899e7966", "comment": "Malware payload (Dridex)", "value": "a88a7e253eb8ab013a211c2047a2954f4a5c5ba0e19f0d0a093bb63a39facf4b838161cc8147c5715197b3bebcf0835c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637314, "uuid": "b8cc4757-f023-4eda-a8b9-0bac44feafad", "value": "E9F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637314, "uuid": "978203ce-9010-445c-a16d-ac7a5d0e1068", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637314, "uuid": "6f76d981-2aaa-47c6-8da5-e158ee9248ea", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637314, "uuid": "b6232a9f-6f0e-4654-b6da-0c242fca6d9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637314, "uuid": "fefdd486-0b58-449b-b6f6-3720740d0968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637314, "uuid": "824ca169-65ff-4368-a2be-129694c1279e", "value": "55b212f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3195718-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620658959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658959, "uuid": "2a2a95e4-8796-4ee5-80a1-6fae06b42887", "comment": "Malware payload", "value": "6c12ea90325ceb07e566ebd3d2da3901", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658959, "uuid": "68e72172-4aac-4f47-aecc-bd1e8284aaef", "comment": "Malware payload", "value": "1cd7833c7f9acb6db9d49a88fedbefd9888eb89b47c9137eff5b32ff9fb56b79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658959, "uuid": "b734a3e9-feb7-4ead-b114-76b191de010c", "comment": "Malware payload", "value": "c18521c804bccaf951a7e56dacb31a2da0e87e68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658959, "uuid": "0ceec520-6f91-4aff-a479-03ecd48698c7", "comment": "Malware payload", "value": "4020c54ec4fcc1ca70116af3737a4da0fcd1c3134d2f15433ed7cd6f193aa1f5c80173f809f418ccde855ab6958cfcd6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658959, "uuid": "b0bc55e1-6a73-400c-a7df-019291e8ec4f", "value": "63F423E3C1EC379F7FAF4174BDBCA424AA903D158B242C86525768E725BD332058A5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658959, "uuid": "07a0d478-e749-423e-b4ad-189a458702bf", "value": "12288:fCnqYUpUdaE99g6RPi6TBDE/Le2epMUmyzj4t2SRu+x0QW4QtTJA7BfZePogs:HpUda4gSYLeXmyn4vu+JUtTKPss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658959, "uuid": "d4b74743-caab-4669-86fc-f3c0c12c99a3", "value": 766892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658959, "uuid": "38e0a789-3bf4-4e48-b544-3d013e2f48f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658959, "uuid": "3416ca8b-8ada-4135-8980-653ad82f38bd", "value": "6c12ea90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c8f515-b1b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666370, "uuid": "b22eeeb1-6b82-4188-b7f9-e3bfa2c45703", "comment": "Malware payload (Dridex)", "value": "7bcdee6458925272a411e8cfe2efacfe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666370, "uuid": "3204d28f-101a-4e76-902b-3da1379da3f4", "comment": "Malware payload (Dridex)", "value": "1d08b2d391a3f99b472a69165f10202b202690d2f74eeb39657d1f0f3be0f6f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666370, "uuid": "f0d52067-9b14-47bb-a2c2-de1a6f3b20df", "comment": "Malware payload (Dridex)", "value": "ff897836eaba9b63b21c10f7a20d22b89d23eb25", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666370, "uuid": "75e06a13-fe26-47d0-9b7a-79b8ad870608", "comment": "Malware payload (Dridex)", "value": "f4091b1402fac697575382294841c61f9f990a504c49561a7c0842b92d27d0fe03b92d07b1099c3b60933ae4531f7b13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666370, "uuid": "29c28e47-abeb-49c8-9481-ceebc53c3a86", "value": "E3F3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666370, "uuid": "c731c075-b8f8-419c-850c-9ac025f73706", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666370, "uuid": "0ab3083d-eba5-40c6-a728-d26c0903ce3f", "value": "3072:UuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:U0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666370, "uuid": "adff2ac5-9c0a-4ace-9575-5b688b93682e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666370, "uuid": "6ebcc5b8-06d1-4f6c-83d1-f1d3182a0c24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666370, "uuid": "dee243a5-aff9-49b4-8098-fc3f452aad91", "value": "7bcdee64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eeb896d-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649019, "uuid": "2b08aef6-26b3-49a8-a86d-bc6c457fdc30", "comment": "Malware payload (AgentTesla)", "value": "2651ccf9dcdd193b36d1010f95ef4919", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649019, "uuid": "016d879d-9702-44f1-85e7-50f0de6c73ea", "comment": "Malware payload (AgentTesla)", "value": "1d0a89290af594786cd23fdff266e835372cab6f15eb8f7faa3bc03f1b370056", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649019, "uuid": "f3827013-b600-4120-bb87-16495bba653e", "comment": "Malware payload (AgentTesla)", "value": "bd5d52a72f563a1b015ead78ff83cef940218943", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649019, "uuid": "48f4b318-b691-4b17-979b-283f30ab9fa1", "comment": "Malware payload (AgentTesla)", "value": "a1a3a5acfa8802b5def27d64799f938cd8dab8754a070671fd8c80ec472d034f38daf1ee625dd07f4f9acc42ce80b7e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649019, "uuid": "d642ec0a-a43f-4fc2-a9db-0effdc2ca5d2", "value": "7305CF603AD4EA18E5BF07378870859093FBFD07C623C26D68E9718E5EB2B599271353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649019, "uuid": "6fe5889e-ce88-4f6b-8d2c-8588dc2f8da4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649019, "uuid": "f4172f01-0475-4722-ae5c-bc2a21f1272a", "value": "12288:5DQuwvsWfhBVw9hhhydiS7nPss+53LFAu7U6UD/vKwQFD10+QAZMgBvXAb:n6b2hhhvS7Psse35pA1Q8+bZRBvXAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649019, "uuid": "2efb4733-f68d-45a6-8ea8-2737ab00ef03", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649019, "uuid": "583c71c6-1459-428e-9cbd-f234ec5eb75e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649019, "uuid": "f98be5f7-0b86-4e91-8e2f-dc30bb64a416", "value": "DHL_awb110073982083PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288d1778-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651827, "uuid": "c5e61d47-8ce3-4af4-a9fd-7e2fac97402e", "comment": "Malware payload (AgentTesla)", "value": "f44445dc40c5703a62fa963858f449a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651827, "uuid": "1ffd7b24-ced6-48d4-82fb-d1b8c8049b0a", "comment": "Malware payload (AgentTesla)", "value": "1d203be4dc4e2e312fbb0e6e7521f63bc62ed20fff24bb8ebe5887f8c7ba31e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651827, "uuid": "25a3e664-9d42-469d-8cfc-444f9985f124", "comment": "Malware payload (AgentTesla)", "value": "b285a63bdb4e444ab7264b5d612edec576f5d400", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651827, "uuid": "7a5b8ac3-86a3-4d98-8478-4a40423ba5ca", "comment": "Malware payload (AgentTesla)", "value": "a48d7e1752d1f5e4c4c15a44a9b917cb71fceb7dc0b66fb7a0a7a50abb376de1e3a2920dd4d7045f2885379733b9222b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651827, "uuid": "49db73f8-1daa-4c53-a05f-47b875363c16", "value": "D4F48C21B2D04473D17E1E389F5BB2F4582DBF5029E4247A6BF4BD489F396813C2929E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651827, "uuid": "0c950e40-427f-42a7-8998-a35ec9cf3376", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651827, "uuid": "71f861da-62ba-4303-b5ea-1a56cbbd937a", "value": "12288:crnWDrl98a7LUacm7sbiD97T5QM4Pr4rzU/Oy/x:crWnZnUivR71B48rzUD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651827, "uuid": "ff5ae16e-5505-430b-9ee7-4da5e896ee74", "value": 730240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651827, "uuid": "7bfa2279-ac71-4773-b00a-56c1a75f9e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651827, "uuid": "137f8ba5-6669-4800-806a-6761c53f6e2f", "value": "f44445dc40c5703a62fa963858f449a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afa0374-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620637282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637282, "uuid": "a3bdf828-bada-4590-b692-78922613c335", "comment": "Malware payload (AgentTesla)", "value": "d091532e65e2995b48170832e7590b4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637282, "uuid": "dbc75926-689e-45ce-a3e6-c7042abdf5dd", "comment": "Malware payload (AgentTesla)", "value": "1dfd0e94efad34fc4f7c476791ee34fefd358a968fe53c5e84e2dc025be7e439", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637282, "uuid": "33fc3633-e590-43e5-960d-86439ef0a51d", "comment": "Malware payload (AgentTesla)", "value": "b4f21809b2c0dd3ed24b5078f10645def58a0098", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637282, "uuid": "0e429319-e505-4464-ad1b-4dc748aa0147", "comment": "Malware payload (AgentTesla)", "value": "de7d5b7fb810b9f531c3ffe7e63a0a10fa01ce6c4253e97b743bcb4b5c5331c274111733302bb846c69f88e1cf0fd15c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637282, "uuid": "740fd79c-7f59-4900-8cb1-da8b5b59cca3", "value": "0453D06FE051BC71C0F7BCBD8344D0CE514DA948905E3E1B6384ED8D59862A672EE3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637282, "uuid": "261423eb-0bc6-4127-bc3f-a2febfc453f6", "value": "1536:wVuXOQOTO19mChPUH6I/YrShnDkYMx1cl+mcC0:wAJWHMxM+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637282, "uuid": "357f17d9-984e-4337-8336-c2b006d7ce5e", "value": 62023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637282, "uuid": "ea997533-4366-4979-a6f6-66dff6db4f54", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637282, "uuid": "b2f143aa-e810-401c-8b2e-2c0030ed867d", "value": "d091532e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df058421-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680480, "uuid": "1634d003-71be-4569-8506-c5b0943fcadd", "comment": "Malware payload (Dridex)", "value": "e73df49576454b7493b258c7cef0db66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680480, "uuid": "e54f12a8-4152-4e79-beb4-253872ef2581", "comment": "Malware payload (Dridex)", "value": "1ece42da90b827180784d3ab06ca6d9836bd4471394da21270cd8dd1fcdb81ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680480, "uuid": "c8a8aab4-8762-4d91-bdca-03e36869cc8c", "comment": "Malware payload (Dridex)", "value": "4217f8df81e93b8b2389b4d6feab3dd2f0f18a02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680480, "uuid": "4a3dbd9c-e142-4a0e-a555-13fdc4046aea", "comment": "Malware payload (Dridex)", "value": "d1d840198e096c35005569b2864fd3d87216fd4360a282d61771bc8aa026fba5b163583c4250ee7e3d722a80820ad701", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680480, "uuid": "6ddcde9d-6321-4dcb-b9cc-abd45d14bf50", "value": "00F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680480, "uuid": "de6af023-4025-40ea-b3f4-e59357c2d673", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680480, "uuid": "053c802b-959e-4d4e-b1da-2037797baeba", "value": "3072:EiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:HeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680480, "uuid": "1fc2478d-2a32-453a-ad47-d95f41c61f00", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680480, "uuid": "178f9740-2f56-4ff2-8ad0-09dbfd9c4d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680480, "uuid": "ca0ab8a2-8c2e-4646-91bc-3c5ca086f825", "value": "e73df495_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ac413e-b1a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620661407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661407, "uuid": "cc49f1cc-da7a-4e57-a58c-48ed1c4071dd", "comment": "Malware payload", "value": "b8a5d644bbe659e619ac0dde076960d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661407, "uuid": "5add579f-3f3a-4d53-bd62-ba214622ffa8", "comment": "Malware payload", "value": "1ed65f0a0c90e54e57fd37a9abf4aecd383dbf79b62016bd4f59e092b3b24606", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661407, "uuid": "41155ee7-57b3-4ab3-9f94-687eb4d03897", "comment": "Malware payload", "value": "77700989ee5b3ef04e0469a7a4d13c90b074f6aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661407, "uuid": "fba8247d-506e-483e-abcd-8da4f502bed0", "comment": "Malware payload", "value": "2587e629341c90614c59e96d9a8c95fe04be324d17fa2fd5c74e96fd385675e373941edcb32a0d0787566c2841156cae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620661407, "uuid": "14392688-84bd-40ab-9e31-3c38d28fe431", "value": "738338209B6A9B94DCCA7D770355CAB1E3314F81070377EBFEACB60D2B58951482526F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620661407, "uuid": "90761338-c826-48c4-ae51-475e27ccf378", "value": "1536:FoGWq3ssgu1bTDkNnhipFnY5IE2vYjsRA+jC:GGWq3sI3DMInY54vYjsRA+jC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620661407, "uuid": "272975ff-4c37-419f-9751-ec1e96dc0a3b", "value": 80865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620661407, "uuid": "11e42dfe-3b31-4222-9742-c1a481e66e2a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620661407, "uuid": "bbf91e58-5ac4-4a37-8954-5bea93c17d1b", "value": "instrument indenture-05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7730cfb5-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648094, "uuid": "5db61464-e63e-4077-b3df-c24a550edf94", "comment": "Malware payload (Dridex)", "value": "acb0b958a802236a69c20e79265bfd54", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648094, "uuid": "6015d8c2-9b61-4540-b929-b661b7d6a148", "comment": "Malware payload (Dridex)", "value": "1ed9273b096cc3d4c9e53977d929444b8c07f3ad548975a4a9cdf373aeee5478", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648094, "uuid": "a564d1b7-a238-4769-9a16-a1b5d42458f0", "comment": "Malware payload (Dridex)", "value": "3295f7b06cf3cb3ab77ed1c84f3df708b894ec1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648094, "uuid": "4bdc199b-cf24-4c59-8c7f-7f5880aedeec", "comment": "Malware payload (Dridex)", "value": "9fb8f558909daf3a35681dc3fdb819d85669e104d149facde6569b0d9a0e241b785bc18818ec63533c5098852dab8c24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648094, "uuid": "af0dd4d4-da2a-4696-ab76-d3cd3016a082", "value": "45F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648094, "uuid": "b7e285cb-6940-452d-8768-c49871da2cd7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648094, "uuid": "8f558fe4-63a3-4fa8-bec6-92d3c864db7f", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648094, "uuid": "248b9c33-b10e-4252-979e-dd1c6d78cc6f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648094, "uuid": "bffb4e84-0a22-4519-a6a8-74d0f6a5ab11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648094, "uuid": "b0ccd177-0dbe-4ed5-a415-28995671f6e0", "value": "acb0b958_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177cf96c-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620630753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630753, "uuid": "6c0708be-11ff-48a8-83e0-68a06a957177", "comment": "Malware payload", "value": "288459baa158dc06bda7e812c394a2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630753, "uuid": "d60d13c5-57f8-403a-9265-eb0c65f06a8b", "comment": "Malware payload", "value": "1f247163023db8b4c9ab82b36befc81bbbd58483bc6d00fafcac9a3a34c9a97d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630753, "uuid": "d8fe96fb-c15b-4658-9c8f-bdc508b4dcf7", "comment": "Malware payload", "value": "a261c8fa26e822c5234326cedee858445b639b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630753, "uuid": "0398a7cb-e508-4b23-ad84-f3a0e42e4d0f", "comment": "Malware payload", "value": "93681694b9d4c6e46e8a8abc4d1506d0500165d2defcda6cb3a15340ffe87821d70f30efcfbc1e3b1335aa7285ab796f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630753, "uuid": "69eb3916-e57e-4861-a96b-c4c81ade62a7", "value": "D00523462274162CE06B3FF7B0EA8A578BE76E10903ECA06FD7DB184977728D4920375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630753, "uuid": "d5556771-f74c-4d23-a002-1636f94ba653", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630753, "uuid": "70e4121f-3c38-4948-b938-0d0135ffadbb", "value": "12288:WHFMw7Y9MA59CyMAn0JorHlIRxd5LI4pzvFljMvw0uhAosClFZZbqA1WQTas:WH+w09tVVFM5U4pzNljMvwqoVR2GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630753, "uuid": "902d17ba-255b-4527-95ed-9cb579bfc567", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630753, "uuid": "eb4a53ba-5076-4151-9e55-ff46f0163cb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630753, "uuid": "30e62e79-7938-46cd-983d-a1e5b6641ba7", "value": "Zhowjkwat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c7573e-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620652041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652041, "uuid": "fcded649-b8b6-46c5-b714-f74fe5f242f0", "comment": "Malware payload (Dridex)", "value": "fd802e438144d7ea3718b56a1938cb3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652041, "uuid": "8c1f4de1-9a37-47c4-a0bf-e4adc69bb03c", "comment": "Malware payload (Dridex)", "value": "1f6c3adc5e099e0f802f409e6c9f24969b13bf65ec1879bd4973272c844db52b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652041, "uuid": "e72b841f-5cb7-40c4-ac3e-72820a404c86", "comment": "Malware payload (Dridex)", "value": "57d37cf70cbecfe48734a5b75b8eb1b67bba63aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652041, "uuid": "be006fab-1f8c-431d-9527-0208bca1d8ef", "comment": "Malware payload (Dridex)", "value": "014e7ed6623da5ee61ef18859ba03a3726dd1380928aa12bf4cca038f195617764c6d62204eac95b4ef839d88aa35825", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652041, "uuid": "ee92a2a6-7092-4af7-a6f1-e93703664acf", "value": "9BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652041, "uuid": "8527d046-7abf-4926-9982-353b825c769a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652041, "uuid": "ba6fec66-d09e-4cbd-b392-f3809504f02b", "value": "3072:xiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:CeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652041, "uuid": "8cb304d2-35cc-4e58-b88b-c5dcc4e2d261", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652041, "uuid": "378c678e-0237-43ac-a48e-26e73ad89e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652041, "uuid": "917d7bc6-df7d-43b1-b732-f2c38cc2797c", "value": "fd802e43_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60435dbb-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673396, "uuid": "6668dde6-161b-469e-a729-32ab1f989293", "comment": "Malware payload (Dridex)", "value": "d8ac8430f0a92c7b51a7729fc858ce52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673396, "uuid": "134ef89d-6797-4fee-970c-2786102fcd40", "comment": "Malware payload (Dridex)", "value": "1fc11adce99603ac60a5d3f48d5aaa16841c08bf33fc17293094faacd501dfc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673396, "uuid": "160f1b6c-3f35-4d70-916e-2bf1ef5334d3", "comment": "Malware payload (Dridex)", "value": "73d265f27e0864570d3a60946e5cc30827ff29cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673396, "uuid": "aa149c48-fe85-483a-9e29-ff864a1087f3", "comment": "Malware payload (Dridex)", "value": "6ae1e04df29eaf99cee28715e8f8ab43b16ea4b3d04fe7e96d85b776f021c17631997542b92378296426398d00d45b88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673396, "uuid": "2c52bdfb-0312-4697-a876-f11bf4c511df", "value": "58F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673396, "uuid": "55139361-ee99-4f42-8002-507d8a1d2d13", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673396, "uuid": "88bfdbab-36ae-4257-bb38-e3acf0193d95", "value": "3072:8esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:m4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673396, "uuid": "72318438-ef90-4bdc-8aef-4f6f1ba181aa", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673396, "uuid": "0af04341-b009-4639-ad18-bed5bc569ef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673396, "uuid": "027f7fe1-e0d4-4baa-88d7-abf0c83a1d94", "value": "d8ac8430_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dafa8ab-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620669553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669553, "uuid": "1c2db5fc-84bc-4b0c-882f-70c4a500d9c5", "comment": "Malware payload (SnakeKeylogger)", "value": "49fc90c6abbe70021eaac6d8dd41c7dd", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669553, "uuid": "8dc53ea8-5194-4e16-be45-004adf0f5a3e", "comment": "Malware payload (SnakeKeylogger)", "value": "20953019087963bd55f735a4296337bb5f93e1ff5501cdb88c6705c5c414fa5f", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669553, "uuid": "76da8b53-594d-4801-a1c4-95c80d70681d", "comment": "Malware payload (SnakeKeylogger)", "value": "ed0758da792bbeb416ec43795a96960eefe39f5d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669553, "uuid": "28648010-1db7-492f-8843-8b3a11716a33", "comment": "Malware payload (SnakeKeylogger)", "value": "7861238d9ba8cdbe1c204ceca9f567e55bd7946807f395070f8e7a048978b6ae6e8e06247b504ea89c6450f8b5843e37", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669553, "uuid": "ae6b144f-9a06-4ccf-b5eb-257aedd8d693", "value": "879412086BC4C702C9B36E75A4E0CA3477213F44D427DF5B799FB25A877630869A8D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669553, "uuid": "42ff745d-a303-4c5c-9c30-7a50f5cf21ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669553, "uuid": "8eaea071-92c6-4d4b-a012-3c9f9f42341e", "value": "12288:yYHFMw7Y9MA59CyMAn02Jfdfpzwo2bwWHdJmFC:yYH+w09tVHc6WHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669553, "uuid": "1ab175e7-e4d3-4d08-b8ea-5cc5310a6e6d", "value": 444216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669553, "uuid": "6c558817-5b48-4d06-9a0e-8d887a09054f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669553, "uuid": "f1a54037-6a3f-494e-b366-2605ea3a36b7", "value": "SecuriteInfo.com.Trojan.GenericKD.36873970.29336.3260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a149fa-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644494, "uuid": "52d4a6a3-e03e-4e41-8bd2-e83ebfee5023", "comment": "Malware payload (Dridex)", "value": "7d45b89e1ee2ddd18da9440e5d243573", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644494, "uuid": "982f4192-1c38-4e49-84e4-0a7856c44440", "comment": "Malware payload (Dridex)", "value": "20a1c5385ea0a0d17d861774d4e4b9e6f255663d73d59cdb2f74ba902ef454f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644494, "uuid": "58b94fbd-04da-4a14-a132-b742140f84db", "comment": "Malware payload (Dridex)", "value": "eff2ee7cbe90dc074fa2ac0b3bb92f33f10495a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644494, "uuid": "e4cde009-f1d2-4d1e-a317-ceae393866ab", "comment": "Malware payload (Dridex)", "value": "04a0fa0a0476ab77ddb59c0295463be6b7cffa79bfdf0d34a8d62ac289ce1d92a2a24da694823f3f7c92b0ca4febe7ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644494, "uuid": "26d80442-7f31-4f9e-aee9-16f462a3ac55", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644494, "uuid": "62c58edf-1c2f-45e2-8dad-84434a505efa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644494, "uuid": "f442a2ac-2767-4433-803c-477aabc982e9", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644494, "uuid": "70236913-f871-4e87-8bb3-5d7be895931c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644494, "uuid": "0e017aec-6aaf-4214-89ad-7866baa23564", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644494, "uuid": "2e7e2969-5ee8-4fb3-8ddc-ec13f41d7622", "value": "7d45b89e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13db36ab-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669832, "uuid": "fed35d65-e141-432f-8b01-a882bd57253b", "comment": "Malware payload (Dridex)", "value": "f93bb0bc25c58146bc0fed33ab00b90d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669832, "uuid": "3eda562e-6c11-489e-9caf-5dabf3838acf", "comment": "Malware payload (Dridex)", "value": "20b74a3c3d1fdc96243ad49b0205bda85f67e1b1f1c1c94fbb03b961d0fa250e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669832, "uuid": "16438097-81bd-4d26-8ca6-babf2d35ec1e", "comment": "Malware payload (Dridex)", "value": "6f5a26d0019a0c76842bfeab0ef1c1f5a8bf069c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669832, "uuid": "ed43d5d4-22ec-4d6d-995f-ebe1f23a4281", "comment": "Malware payload (Dridex)", "value": "3a1f3489afb85f97fd477cfc1fb310f169e05a5338ae1fe2850981a251a4f98be0fc43e47260e6f71283b1faa3312801", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669832, "uuid": "14051f99-b7d5-4c0d-b589-c7e59e55950c", "value": "D9F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669832, "uuid": "5d55cce7-f53a-4550-a4c0-a55a05727e57", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669832, "uuid": "468ffc73-6008-4e42-af1a-787e097d42b3", "value": "3072:4/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:KbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669832, "uuid": "49ef217e-5c1d-4442-84e7-7c3d273d69a0", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669832, "uuid": "40a22748-68ab-4ac1-8b56-faed6869b779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669832, "uuid": "dbae904e-29e4-4c43-a5f6-5ce341728cf3", "value": "f93bb0bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9a8d90-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649012, "uuid": "33bcad81-e7ad-4850-9663-754720d6f059", "comment": "Malware payload (AgentTesla)", "value": "27772b8bf9077d9e958e5b133a62cddc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649012, "uuid": "abd8a7d9-c526-4e03-b7f0-6ccf4dac4f93", "comment": "Malware payload (AgentTesla)", "value": "20c4c25a7ca808bcf92858f5fa653a7d50cd2f14d125bddcf8420641d95b8254", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649012, "uuid": "d8fc908e-4a05-4cc9-be28-df5d58f9b459", "comment": "Malware payload (AgentTesla)", "value": "8f5bc981f520232217114ecb08bdd75545ac75cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649012, "uuid": "48d0de0e-91c1-4087-85f1-c359da0a4b4f", "comment": "Malware payload (AgentTesla)", "value": "256c31f8f599b87296f5a3989bee8848c587b1f0e97f03d4cc9f6bd5472fcff4763b554eaf650b32ec7ca5e2a86eb04e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649012, "uuid": "8f17a137-3f68-4b38-8ff2-e586936b96a6", "value": "6FF4CF213298AF55E47E67365171051023F2BE07D732E64D7DF6B8CE4AB2F818626B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649012, "uuid": "398798d2-6182-45d9-b1ca-0e77d8606c7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649012, "uuid": "5fb63b76-3629-4f2d-a187-ae56a00c4386", "value": "12288:X7O5kSt8IFA+2CFZf/mu7btn4gklK3cJrHoky4zmyfRaWZM:rOZt8e2CFZnmUbZdksWzRaWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649012, "uuid": "baead910-63da-462d-a323-6084170c6658", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649012, "uuid": "5d6beaf3-c603-4960-8c54-bf100153d004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649012, "uuid": "f95fdc97-294c-439a-bc0a-4b35851d6f2b", "value": "Updated Order list -804333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea86a40-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662682, "uuid": "5ddfde28-05c9-4ba9-afd8-68282e16a0a0", "comment": "Malware payload (Dridex)", "value": "75e7f939e099b42e38dbfa369a37db3c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662682, "uuid": "5e70adf2-3f09-4106-9628-ecb97da8f921", "comment": "Malware payload (Dridex)", "value": "21198d924b0972db2725dc62f95abe80f41b142ddb119c0b7d7f542a8876e326", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662682, "uuid": "778cd771-0a3e-4ef7-a379-b51f3a7d0320", "comment": "Malware payload (Dridex)", "value": "ee9f5f597ce14c7f2d9b64d8f67f6539feb04fe3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662682, "uuid": "6fdc5eae-d693-4600-a75a-0ec43ff7c942", "comment": "Malware payload (Dridex)", "value": "8e4090b9332f24aa6dc9c10756ecf748f058deebf93544735d6dabb3625b6389264067dd12f03b85bf4defd21e46be06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662682, "uuid": "935d034d-413e-414c-b655-bb591e19598a", "value": "C8F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662682, "uuid": "b7e01325-4299-468a-ab60-5813c4720b60", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662682, "uuid": "6ee35958-da69-4758-8851-2e9adf93aa0b", "value": "3072:juFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:j0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662682, "uuid": "1fd75009-c7f6-4b95-be51-619d53556a2b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662682, "uuid": "d03825d0-cdc1-481c-854f-8cc2cafbf3b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662682, "uuid": "27df62bd-f8ee-4f37-949b-b9fa5be6aac6", "value": "75e7f939_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196ee196-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662539, "uuid": "a2c3e1c2-b5d8-49a8-99a2-60f9c5309088", "comment": "Malware payload (Dridex)", "value": "f47c6834b3a13f9726d38be6ec916836", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662539, "uuid": "22268198-3951-4772-b5ac-0ce0cba0f175", "comment": "Malware payload (Dridex)", "value": "213d9bc25251ccf0c75e1d57af9c3af11646ebfa45e239ac75faf171093be235", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662539, "uuid": "9e90f02c-7865-4d90-839c-31a8aaf7d3a7", "comment": "Malware payload (Dridex)", "value": "e444ff30eecfcf40cb35db84fcc49bc5fbefd73b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662539, "uuid": "307bd954-9518-4bd1-8b48-8838558dea6a", "comment": "Malware payload (Dridex)", "value": "dcb1f0b5efc027b10abeec6bac556594aae3d8eb2d67c6cb119cb4b0eabf599f65f5a4fcd2c4d48f958d71331580e4a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662539, "uuid": "205a4200-101d-4b60-abf6-67169a9ac8d5", "value": "E6F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662539, "uuid": "08847bcc-b7ef-4097-89e8-a0ec2b371e5a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662539, "uuid": "aa424bfe-5734-49b3-8424-4c7f05d22383", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662539, "uuid": "1967b12f-e173-4009-949d-e0c62dbb8f5b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662539, "uuid": "1d7d2a17-9325-4046-bfdf-7f1aa792ecdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662539, "uuid": "a9ef0f4a-6b9e-42b0-97c6-b2bc082a59bd", "value": "f47c6834_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20c0dbb-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666312, "uuid": "0f3f0d36-5ad9-4b0a-a3c3-3ac20217c081", "comment": "Malware payload (Dridex)", "value": "a688de2ae8c1a6893c3fba8e34197db9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666312, "uuid": "12cb2110-8a53-490a-bb2e-58a3cd2c059e", "comment": "Malware payload (Dridex)", "value": "21987fb111d7d0b95deab05978e94acb7ddef9d18171d9d654082110f59e47cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666312, "uuid": "46e38cc3-55c7-4ef2-ac75-ae4a956997b6", "comment": "Malware payload (Dridex)", "value": "b6f83b736505bee6746a4abfaf281735e29568b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666312, "uuid": "22e7b846-8ade-4496-a363-ae8943c04e7a", "comment": "Malware payload (Dridex)", "value": "ac3cccd714c3c7cf99e6b02360e3d696eab1b9acf77be9469993994798ae3206c6d7d01ca6d0df6443e085552db95894", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666312, "uuid": "eebad12f-20e8-4c4a-bc5a-8dd3b5ce802c", "value": "F2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666312, "uuid": "e0a58c96-600c-47cb-ae9c-2041c733dba8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666312, "uuid": "da41dd1c-9b1e-4064-8ec5-9dfc234ff290", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666312, "uuid": "2fc057c4-be32-4ddd-ae7f-e87bce6715ba", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666312, "uuid": "b082e8be-8dbf-4770-9f3e-855011111e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666312, "uuid": "b35ce895-1e82-45cf-97fa-330090158a2b", "value": "a688de2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab1d24f-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669870, "uuid": "de80bb68-d972-4f51-90aa-9e2769ebac1c", "comment": "Malware payload (Dridex)", "value": "54eefb0b44398a51ff8e6f168833302a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669870, "uuid": "19d7c219-53a7-4013-8da3-3efade994d41", "comment": "Malware payload (Dridex)", "value": "21fa7496a6a21acef7b5566fa432eab415776f157b5782cf01a648f61f49d509", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669870, "uuid": "e4224bb2-e69d-4aec-afe8-45d422eae03d", "comment": "Malware payload (Dridex)", "value": "abb7de4bded6fdb54ac681d8c9f2b0caccb97d49", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669870, "uuid": "cdee28c7-7c52-4e11-b17d-76256d8c1b29", "comment": "Malware payload (Dridex)", "value": "73079095f3f13bc7c02200eba3e48b919b9e8cd942acd86ca39f58697aa87b33a00ba05aab3788c7959968583cbefd2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669870, "uuid": "69f40439-148e-4416-9c03-7242fe1add01", "value": "BDF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669870, "uuid": "2dd78fa0-43be-4fcb-9daf-c45bb81ba0b5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669870, "uuid": "bed23921-4d8a-428c-828f-b4eb3fcadde4", "value": "3072:llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669870, "uuid": "48ce53ee-3cb3-49d2-b513-7147e3c1178e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669870, "uuid": "ab9a4d40-de5d-4610-a382-3318b8d5f643", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669870, "uuid": "2fa31e66-ce83-4a25-9157-e1c5a3d0662e", "value": "54eefb0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f57240-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649023, "uuid": "ef3023b5-b8e0-47cd-a33c-86f1f2cd59ea", "comment": "Malware payload (AgentTesla)", "value": "77ce5f800e179f43d37c27f0a022caa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649023, "uuid": "94eb4062-d4f2-479c-bab2-4e22c15db738", "comment": "Malware payload (AgentTesla)", "value": "22514af6bd3bbbeeb70c8838ca6861b0f208416a32966f86764dd7f0f3aea527", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649023, "uuid": "a126766d-a070-4212-a351-7891bdbeda2c", "comment": "Malware payload (AgentTesla)", "value": "20c0a2a1a999e9ded5ed51e90af1044cb13f468b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649023, "uuid": "7e33e9fd-d6d0-4d41-8fc4-ab58bef75da5", "comment": "Malware payload (AgentTesla)", "value": "a723bb69ffdd193cd04a3948ee54eb969092ee76ec0000cb983d7039bcdcd2dea7551e227bdf6398cb8bbe20fd436ff9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649023, "uuid": "53526739-327b-4d3c-a224-755afd6f1263", "value": "8FF4CF203BD8AA58E57F57761970C14423F2BA67C732C65E6ADDA08E1E32742C7B2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649023, "uuid": "f509eb5c-d049-4681-812f-fcf52c1f6aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649023, "uuid": "c7d162d3-f9ed-4169-a686-ec9fd8eb316d", "value": "12288:ycquWAzXjtBVw1hhhxknOeJyFIsbKTKcfquZpeYMV/Kbsz:ykzXjPGhhhxIOeJwIs0KKMxSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649023, "uuid": "cbcd5b51-8d73-4440-add2-1194e0d78a99", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649023, "uuid": "d84f7d1f-6bbb-4031-b5b1-8b6f95794ac3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649023, "uuid": "ee0b7cea-a0e5-4a3d-9432-c5c911dcf0be", "value": "DHL DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb24ab28-b147-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620620720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620720, "uuid": "1f2af627-13ce-4cf3-abf6-bc998debf3ed", "comment": "Malware payload (Loki)", "value": "34e6e08ff1be4852ae5c6609e9437729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620720, "uuid": "419e5ce7-ddab-4fd7-81b0-3528738da5c3", "comment": "Malware payload (Loki)", "value": "22cef9857c4e946992e4592d93a280b336af2c27e574a9e29fccd0ef377251c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620720, "uuid": "c58d747a-fc2d-4490-94aa-8c4da9c03682", "comment": "Malware payload (Loki)", "value": "df642a4bae79e3f923d8535e9069a673c2fddf0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620720, "uuid": "9fc3f6dc-d8d7-4cec-9832-d4c2224e7778", "comment": "Malware payload (Loki)", "value": "54e8bbba62e26f8a9aa4613418b914b82875da6b6e709d609037b643600aa0daaeda1d41d44e635759f92ea9ba74442b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620720, "uuid": "60fa1e3e-f0ec-409a-b062-63796c83de37", "value": "27641B061258C01AC678027A4CAB75E0B5C9FE4CD7A0AAAD3D4479F9177EDEC7C2E21D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620720, "uuid": "2076fe30-846d-49e8-86e8-1fd5e2a56167", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620720, "uuid": "a8ce17fa-7d4b-4259-9f55-f700609a6c4f", "value": "3072:sf1BDZ0kVB67Duw9AMc2Aumu4bhr0KBWAfLSME8FF1LthF+Jf9YdMBMaSBWIG8:s9X0GuAumu6hJBfjHE8j5tOBR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620620720, "uuid": "da86a390-72ee-4fbe-9f6e-6cd5a95082d0", "value": 320425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620620720, "uuid": "60e26177-26bd-41c5-9b27-cfde1481c5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620720, "uuid": "71ba0f21-be3d-48c2-9183-869f90f45664", "value": "OHRIDSKA BANKAMO3414523-Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad48545-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673574, "uuid": "2b6f208e-0f91-4adc-b861-4e83f4b55e9a", "comment": "Malware payload (Dridex)", "value": "3bc8e9701641de7fc6f2e6a9df291dba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673574, "uuid": "2c2952f5-4e6c-4a49-98c0-50e0467f75e0", "comment": "Malware payload (Dridex)", "value": "22eeaa35f79bce18a1867454ad926c76b77421bbff29558c13d044d02eb647df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673574, "uuid": "6dbdc859-9230-4ce7-bf88-816fae69dffd", "comment": "Malware payload (Dridex)", "value": "aaed3e4e96c2ff0a64e18e48820e714ee312a3e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673574, "uuid": "088bbdd5-9f51-4145-b2e0-ef73b66a03b2", "comment": "Malware payload (Dridex)", "value": "d232a11640086743cc10b18a64128f567cb6673c60c194f2389b2dd215171a0f6f0fb6613f02565fb129d84295b049c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673574, "uuid": "469ba576-295f-42f1-b01a-e7aee63ea946", "value": "C8F3D0906A9BDF0ED9C13CF96AD6A879B073458C811FDAB4D0DE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673574, "uuid": "fc6223d4-a224-444a-a0c1-b986f36f1c21", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673574, "uuid": "05a2fe74-877a-4094-9727-2a5d47a5c520", "value": "3072:4esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLKK:S4+VZQpt5hyPsa1ekiEtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673574, "uuid": "05c874d2-82d4-446e-8b18-0a19af5cb95a", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673574, "uuid": "32f1b74a-66b1-45eb-b1d8-53524988e94b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673574, "uuid": "9704f4d9-152b-4a0e-87f9-b4991a617e8a", "value": "3bc8e970_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728fed1c-b1d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620680728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680728, "uuid": "97877d01-f658-48a0-92f0-2bc20e2e8181", "comment": "Malware payload (NanoCore)", "value": "9c17cbceaea8446354627e22ac834e0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680728, "uuid": "9923add3-edd2-460d-b139-233a9c5f6d81", "comment": "Malware payload (NanoCore)", "value": "23199fb6953dca99e854da899b245eab8a7be7664d93bb66d1620f002c7da548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680728, "uuid": "6c79dff0-1e0c-4dba-a81a-e484674afe23", "comment": "Malware payload (NanoCore)", "value": "44541bf4ffc7837300017fef5f62493d5330ed67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680728, "uuid": "71a2a446-980c-4f17-9a4b-51601876f744", "comment": "Malware payload (NanoCore)", "value": "78d80afc02e2c014c7f6eb7ba637670e812c52b581cf79bbd4ad96a5bfbe867a5a860bbfeaa2c1df5dd4338eba63f481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680728, "uuid": "3ab557a6-8d5c-44b7-be1b-682fefe007d1", "value": "B2351212BAD788B2D57329315A2677116D3E7C302F28CB5FB3E08D6DDE354416224BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680728, "uuid": "5eed0e0e-27dd-4b71-ad89-a7de8313ecba", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680728, "uuid": "3acce96c-d303-4704-a327-c761d23b5932", "value": "24576:BAOcZpJmH5btrC4D8AC0HqP0vB0+V4y3VNOAAzIYDm8OsiADi8aRD:bpZ44/DvB0w4gVNZ4q8PiA+j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680728, "uuid": "f2a72f57-7279-4696-a2db-0ffd8e2fd385", "value": 1129051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680728, "uuid": "44f87de7-efb0-4eda-b59e-d0aa9dfa6244", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680728, "uuid": "fabe3d7c-7966-485f-8e72-9a50fa6c905d", "value": "9C17CBCEAEA8446354627E22AC834E0C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b280e9a-b186-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620647644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647644, "uuid": "029b939d-eccf-4654-bfac-9b3673efedbb", "comment": "Malware payload (AgentTesla)", "value": "f7b2949015bcefc25880f841491d8203", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647644, "uuid": "5e10c5e0-3ade-4ca5-97f9-b8453ead7162", "comment": "Malware payload (AgentTesla)", "value": "231e06bed8d065a1574e99e59862086b69f61b6fbdaf943b1fc23f4752dbcd64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647644, "uuid": "fa699bfc-7ee8-45bc-a02b-78c94bcd53ce", "comment": "Malware payload (AgentTesla)", "value": "8da75504c878df3727f04421c23eab33000e50e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647644, "uuid": "009c7737-efab-4ea3-a5fb-6ff6aad0cc10", "comment": "Malware payload (AgentTesla)", "value": "b3070ec9289bb508378d5585968a7de76fe52b61591ad56aff1e9381b1e0ce0c58299dd99a964f8c88afbf8d162bc81b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647644, "uuid": "e1ac6e2e-339d-42df-9898-76eb80591173", "value": "4B710834AD7805D2CF1796A20A71FCA803E5F157C6C79998F18EF8C50B3B71A8766502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647644, "uuid": "b798be78-ac35-458b-8092-d26db4462644", "value": "96:xB5WY5LrTaDUU+xEPFJwFuOWrI4QKBay+6sWmLNWr:v5WIrTgN7PouQCaywWmLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620647644, "uuid": "c5536a34-ea63-4b89-ac33-1127931db844", "value": 3754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620647644, "uuid": "989e5cbb-f41f-46f6-9b35-a4079e37d49a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647644, "uuid": "7a03b4ef-ce80-4cee-b5f3-ffc21b58973f", "value": "PO 4302003683.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b603f72-b1a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620659697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659697, "uuid": "4acc3bc9-f70c-4910-86eb-6f950b091bfe", "comment": "Malware payload (IcedID)", "value": "a89a3cdac33a36c9f037e010f3dd1115", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659697, "uuid": "bf12dd14-ae07-4c9a-ac0a-f752b1612340", "comment": "Malware payload (IcedID)", "value": "234a873c451f9f45b9bf3ba67903897ba6ad4ea7571f5aec42358fe0ffe7f20e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659697, "uuid": "72a1609e-c6c4-4626-a342-69d16f9ed6dd", "comment": "Malware payload (IcedID)", "value": "626ea2da9d99102357c57138ff0d2386b2b683f4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659697, "uuid": "7886ad61-c826-43e5-9d85-1c32e426aa7b", "comment": "Malware payload (IcedID)", "value": "a9b1971c1a471c0f3ded4bf2b4536b6cd2372fcdc415aa9ac818b70876938e469a5522b0352ba87e896cf0b4922edaf0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659697, "uuid": "5fac3f3b-bc89-4a70-808e-ca25c128b3e9", "value": "C623E118F501DC31D2659B35A8EA01F0A23F07CCEB5196B79D148A4F6EA20E94FA77C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659697, "uuid": "5d9d356b-a349-4255-af6c-39821ac8a742", "value": "768:n0SrasMQ0qhQK5g3sZ5M0jJrSJCISJsJpl4d1ji1m0:n0mMQFhpg3sZ5M0jJroC7sJpqdiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620659697, "uuid": "7e37ec5f-8a5b-41e7-8c8e-04f20ed0b4ec", "value": 47650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620659697, "uuid": "1a02bdec-5046-4e39-a531-d8b004440c01", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659697, "uuid": "fa84046c-35bd-4aa1-b9d0-8a7947a78263", "value": "decree-05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f5a783-b155-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620626773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626773, "uuid": "8a3563d2-85af-4254-a2cb-b3b46052e477", "comment": "Malware payload (Dridex)", "value": "cdf91bf116e181bc18f691b51be3175c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626773, "uuid": "e5e63d2b-7eaf-4be4-8d86-0d4823be3886", "comment": "Malware payload (Dridex)", "value": "2368848837887a04ba1fb67eba2416acf215ff74fcf02b5859dc5deea569a0dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626773, "uuid": "943e0360-ce9b-469c-8649-b0b8fca364ba", "comment": "Malware payload (Dridex)", "value": "a5f7e11c93428173566b2311eb4ccd8bf18963e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626773, "uuid": "d0f63213-cbec-4cc3-83b8-0a8da1482265", "comment": "Malware payload (Dridex)", "value": "de912c31df1f222d19cd9bff0131dbf057fabe58c6a0e788c1bb17a0400b88e5e1345d629a27b764600d76d4a7729a51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626773, "uuid": "f8f20a12-c760-4938-82c9-4c0456412c28", "value": "05F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626773, "uuid": "6e4b06e6-519b-48dd-b98a-323791018193", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626773, "uuid": "e028e11a-5000-42f4-ba55-3625f6e2b8aa", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620626773, "uuid": "72556ae6-c4ff-407a-80a5-14db0d1f2b53", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620626773, "uuid": "d179589f-97f0-4dd6-a35d-ac7fa23c7207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626773, "uuid": "604c0d43-4bf4-4d7b-9ebb-194563b0c8d0", "value": "cdf91bf1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a56f310-b1ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620664232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664232, "uuid": "40bc0259-163c-4f9d-a99d-bafc4d2eab54", "comment": "Malware payload (AgentTesla)", "value": "1352fb73f10b49e6b7f9e9d4f1b851b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664232, "uuid": "cc91c620-78d6-4785-8840-7f04a176ffc0", "comment": "Malware payload (AgentTesla)", "value": "23eca24d96230fd777bc80e88ec427143cf258e6dc6dc5d041a608d9cb0ed3b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664232, "uuid": "2d63e5e0-b906-4c52-9eef-ec47b2133e0e", "comment": "Malware payload (AgentTesla)", "value": "67681cfd90723edf05c7cf20dc5d808335158daa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664232, "uuid": "58fd2c22-6e23-43d3-a80d-1f26779c1968", "comment": "Malware payload (AgentTesla)", "value": "ee03e26c656202951258fe3386dfaaf5f8ef24edd8fe1824d415a7418b753ea59fcf860baaca4d5be869b51a45a153b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664232, "uuid": "89533ab0-375f-4cc2-91f6-a452a36aa742", "value": "9FE4CE2C6AE88A49D5BE57BC8470D17083F8BD065917E75D0EE06CEF3C77321DA02A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664232, "uuid": "94a67531-b275-4abc-adc1-75a3b1fc2491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664232, "uuid": "5f3a9f4d-6e19-4c1b-84a2-c8f39408c0f0", "value": "12288:Hn14AXBx1n0YtUM88i4pU7vJeDhLHH9SYU2B:l710YRBJU7vJerHAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620664232, "uuid": "b87a42bd-bdf5-469d-b199-a066e2adc024", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620664232, "uuid": "8a8c1850-e95c-4e45-ae31-5acae2844316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664232, "uuid": "29f97886-7ef1-4dba-83a7-2d73795184cb", "value": "bUHEiWKmSiu7SVd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed0e47d-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620651892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651892, "uuid": "2aebf00f-c3ee-4c60-82a3-4604b24bb99a", "comment": "Malware payload (Formbook)", "value": "810ae4ef26f40a3b18db460a7763bd8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651892, "uuid": "38f047af-eea6-4a23-bbae-7eacb11d4302", "comment": "Malware payload (Formbook)", "value": "240353935f7cfc588b1d42d262041b9e9dc2f753d8eb27c22853257d32dd0be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651892, "uuid": "3931ec57-5144-4020-8b60-0f5684541a22", "comment": "Malware payload (Formbook)", "value": "7111201ba9b81ec775cef2ea25bf4a769ad68946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651892, "uuid": "92513f3c-b647-43a7-9445-97d3e86bc2e2", "comment": "Malware payload (Formbook)", "value": "2c966ab9e0c0a3f7aec665b9206d1f66783f16f41c97dc25afaaac9f6bcc99daa29a14f611905da99cbeff7209bcac90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651892, "uuid": "d3d2af05-b24f-4844-a64b-c8f507ce3726", "value": "A1F4E02037D8AA58E5BF93751970D14463F2BA13D732C75E2A9DA08E2E72782C772713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651892, "uuid": "3c8079bd-67a0-4a8b-8e7b-1250eb920bda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651892, "uuid": "5b18337a-3b01-4f82-98b0-229992d14ba8", "value": "12288:WWpJPRibjXTtBVw1hhhrVI8IgaaLF+IQGQWir9OlPQn42lNNsHzWjLOGhR5zigE:WBjXTPGhhhBI8IgNPQD9KPQTb2CjCU5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651892, "uuid": "0897cc1c-93cd-47ea-bd1b-5f6ac21c1d01", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651892, "uuid": "ecaed589-e7e4-46d7-b62f-88f4ff83f1d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651892, "uuid": "dca7d9c3-fd6a-4008-937e-13d21bbdc787", "value": "810ae4ef26f40a3b18db460a7763bd8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec329f84-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669765, "uuid": "9ee888b9-2cf1-451e-873d-89df1325e7a7", "comment": "Malware payload (Dridex)", "value": "fde11c7df6ae2892b1138bfa92c55ab8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669765, "uuid": "a46a58a4-223f-49a0-bffb-7d7a2b639189", "comment": "Malware payload (Dridex)", "value": "244e67d5ad0999bf456c2b7b037417dcabc38d60e9460a1d0eb8cfb5de153ba6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669765, "uuid": "15c5a2ef-bd96-4f2e-9362-aa01192e84a3", "comment": "Malware payload (Dridex)", "value": "2a6d62d0bc91fb14848e480b2d7e0bbf07b7550e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669765, "uuid": "dde6ba31-e286-4a24-bb88-a4df22e7511f", "comment": "Malware payload (Dridex)", "value": "bdae0d221df16c4fde30ecb3bcfb3d2323bbb0b450ed4e505b9a27213c9fa2ac1a47aca36b89ece671a35423885a5ae1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669765, "uuid": "e8a2a1da-ea5f-41e3-9956-3878aee3c511", "value": "8EF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669765, "uuid": "0bbe4a6b-0fc9-453d-be25-a38f0ebb79f2", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669765, "uuid": "b590b8c0-71b1-4a23-9c39-9e6a0f5d4184", "value": "3072:f/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:1brE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669765, "uuid": "96477da5-5a02-4279-8789-b85cdb5ccae7", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669765, "uuid": "d3c835a7-e802-415a-962b-6d6d8678b5ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669765, "uuid": "a15a94be-394e-4d44-86f1-1d7b5a001171", "value": "fde11c7d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619ae325-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666096, "uuid": "5a447603-db34-4ba0-a14a-cebd57716829", "comment": "Malware payload (Dridex)", "value": "94c1f9ef00902909c834e98d86b17137", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666096, "uuid": "e19ae9be-d78c-4f6a-b3ee-6a8a9b143325", "comment": "Malware payload (Dridex)", "value": "249d02f11f50dad850ec988ce7e71e39e7ab51c348ab58c3abba369bce7ba4c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666096, "uuid": "03ec21ec-ca59-43a3-8d56-9d9700ee8a24", "comment": "Malware payload (Dridex)", "value": "142f1eeb26c3a8847504319a358743a82e924b84", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666096, "uuid": "170925ca-5947-46bd-b441-e90fd46bfa24", "comment": "Malware payload (Dridex)", "value": "66fed2339976effa6e0639d706d658846f524b6c3ea229f7796d1336a122d2e8ad6b972afc6170ba307d1d137bb3d9a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666096, "uuid": "fc7d4fc3-ac9e-4a76-84ea-ba0a238a801e", "value": "52F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666096, "uuid": "4408b3c2-a631-40ed-8ad2-18c8066a101f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666096, "uuid": "3ff76c4f-2015-4f6a-bb73-36df4c88e67c", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666096, "uuid": "83cc81b7-ca7d-4796-b540-9138e70bfd64", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666096, "uuid": "e331aaae-20cd-4b89-a13a-aa50c2557461", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666096, "uuid": "b2d26d81-74c7-4763-b7d4-9315ede9207e", "value": "94c1f9ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e764f-b12b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620608804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608804, "uuid": "6764a8b0-39b7-4e31-8307-1e34d58f6229", "comment": "Malware payload", "value": "e34bf6aafec5c9ea9c334d3334764868", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608804, "uuid": "198e66df-e317-4bbc-a2db-d2bc24428ace", "comment": "Malware payload", "value": "24a6545d0bef76532ec6c0afe4ca5b92bd391e31cd92661f0fa26d6c974a6267", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608804, "uuid": "aa8acde7-78ec-4af4-a43b-1dc9b7927d84", "comment": "Malware payload", "value": "6e20a4edc576a83090c9fb7e858e0a2e162ee46c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608804, "uuid": "2a60f518-a856-4036-afa2-9852e782cd78", "comment": "Malware payload", "value": "cd32c31e0367bb972f41b4db628857a4fa5a9bff6f346cb452dd282f1f06e51e4964bcbd02868532dd7120904b20e84e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608804, "uuid": "6ebd1fc6-9235-4bed-8cc5-0d3fcb70af9e", "value": "C1E53827CFB149A4C0268F35C413756569332D98435A5A8F0BA0B43F5EF37866A6B33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608804, "uuid": "6ad98d4f-84ec-42dd-adc2-43cf71272554", "value": "c50e4212dc3896984ede5eafaf0ad7e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608804, "uuid": "8f5a6200-4d3d-4baa-9b24-b5eae6dc930f", "value": "49152:/ombm6xMmvKxK8G7GFMUzmWngB7GFMU32H:/bm6ufXGS5aWngBS5mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608804, "uuid": "8a4bde46-ce80-4d81-8258-7d00db2b6132", "value": 3238400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608804, "uuid": "74d64795-3776-41a7-9628-2f2f38bf86e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608804, "uuid": "a2743f5a-9390-4c6a-b5a6-3cccadf273ff", "value": "24a6545d0bef76532ec6c0afe4ca5b92bd391e31cd92661f0fa26d6c974a6267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6370fafa-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648061, "uuid": "ab12f271-cbf9-44c0-a854-67700c636e71", "comment": "Malware payload (Dridex)", "value": "a9d78a712172d7ef9548c6d37a818504", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648061, "uuid": "620679c3-1372-4578-8ec0-9486ae5a7a8d", "comment": "Malware payload (Dridex)", "value": "24b260a44dfbeebe4b5ff4b69e968638702b08f6e463835c68c89647928773bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648061, "uuid": "57b1c792-90fe-4c22-a926-9648d6dfc233", "comment": "Malware payload (Dridex)", "value": "de7437df88f26ce7179a3b39793a1358f8508c85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648061, "uuid": "0cf93d24-b42b-449a-a019-12b84324dc32", "comment": "Malware payload (Dridex)", "value": "2d015ddb5df97813ca032d44c4c3dfd266dfb44e4ece9409b8668f10c37ee007c439dfadd2927596a91414ac03259036", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648061, "uuid": "3173d6ca-a956-4b3b-bf27-0c0fff32d510", "value": "77F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648061, "uuid": "f6d90e40-130c-4008-8a36-4d441d3973f5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648061, "uuid": "9070c67b-4dbd-4979-99cb-8f883b1c96db", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648061, "uuid": "19bd0417-0b5c-446a-9846-2cf13c1db0f1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648061, "uuid": "43f1a44d-f584-4299-ab2d-f20b19ce9cac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648061, "uuid": "dd79530e-299a-4734-bc3c-4ded931ac389", "value": "a9d78a71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1adab5a-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640917, "uuid": "9ad3a032-321b-4c34-9960-a6a3aa2c1664", "comment": "Malware payload (Dridex)", "value": "52d7fdc9b4eaa25c9d0a4989bef9aa93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640917, "uuid": "e6d47318-f147-42ca-8c7a-2bce62566157", "comment": "Malware payload (Dridex)", "value": "24bfdb8591713e10ea6442e6feadef8bac67a5098ba1000e2fc7747e0b59dcb2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640917, "uuid": "f188f508-e203-48be-b970-eebfcfb98db8", "comment": "Malware payload (Dridex)", "value": "31ff0a007562e9848b9b6d06e40e143d27837416", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640917, "uuid": "b9e08469-1b0c-449a-a1c5-8b8f9db2cf7e", "comment": "Malware payload (Dridex)", "value": "9fa5ec01d01d3d62cfd96deb8383f113ba2a609581c7cd4f12ffeb638c6e46ae95e34051b36123d80077951dd673817e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640917, "uuid": "f4428333-acb9-4464-b0b1-298c5ec7113e", "value": "46F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640917, "uuid": "8d1ff7fb-a297-4135-8248-a5b4f1dd2fad", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640917, "uuid": "6604bd9e-30c5-433d-931b-62d258c40ed7", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640917, "uuid": "251c83c4-7711-4ee7-b236-74dda53a2ace", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640917, "uuid": "52363aff-2740-45de-ab7a-c293c73e0973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640917, "uuid": "4bc961c3-c9e5-42b9-b5df-d27dcf29fe68", "value": "52d7fdc9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29936ecf-b1b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620665573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665573, "uuid": "628bc8f9-4597-4eb8-a1a5-1c89e69d5c20", "comment": "Malware payload", "value": "3918a34adf516c05e6a3544c308e8fef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665573, "uuid": "025d80bc-b9fa-410c-b646-0e9c89aac554", "comment": "Malware payload", "value": "24ff716798f665067f2e9d1f99316f57090eb36ea09d559fd2d63cb9960fdb23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665573, "uuid": "b24265d9-ebf9-415e-b780-23a59330a9c2", "comment": "Malware payload", "value": "ebc7f6d0d0c8e6661f80a6c241d66d05cd2e4eef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665573, "uuid": "2fffc8d8-4389-4f4e-b452-83a5fd0fc771", "comment": "Malware payload", "value": "0842419fe19ff1724751e3228c0e0897b110d9f1fad705edc1a05ffd210dd17d4b552bbf1019e63ce952c21a2da69e46", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665573, "uuid": "8c1bd442-90ed-4ee2-a487-028115afa3c3", "value": "0F812132A18708BAFF9E4AB84D87843E235F2B81176006B713A150891DD4DE7F534B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665573, "uuid": "b0a9013e-284e-4f67-b46d-5b4e32f657c6", "value": "fedf9f199dde0fdb7192322e063acd1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665573, "uuid": "289a3405-af13-49e9-add6-076c5743f855", "value": "48:Sken1ASkT3Jd95Ei4TxZRoqC3P3ShdP7fWqCM66dC2om/9rn:Mn1ASkP349ZRoMWUyOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620665573, "uuid": "00d959dc-882e-4574-9ba7-5c8d23e083d6", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620665573, "uuid": "bcf9b66d-2e47-4a97-ae15-4e7a17a0084d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665573, "uuid": "567ff6c7-f96f-470a-b42d-107aab2fc018", "value": "SecuriteInfo.com.Win32.Injector.EPCY.28399.11503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3a4ac6-b1c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673684, "uuid": "730cbd8f-778f-446e-99d0-9eb63f984511", "comment": "Malware payload (Dridex)", "value": "586d643b55175179970ba09f9d8015cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673684, "uuid": "0f5de9c0-b83e-49c4-a564-86806542bf34", "comment": "Malware payload (Dridex)", "value": "256af3cf3bf08bd29e1dbd98ceaedd380c01943b74eec24e99a9bcbd239dce79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673684, "uuid": "35504025-289a-4370-ae8d-108d917bf1a0", "comment": "Malware payload (Dridex)", "value": "c99f851949672dc3fdef51bc1a04fe13446fed80", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673684, "uuid": "83d3ef8f-3319-4962-bc32-9e20fd254173", "comment": "Malware payload (Dridex)", "value": "98fda68d9924858f44f20bcdb509d6c60df6c195e0e899f7d170e08887cf47cc7a9c4412a8e8a886cb191b650c129d55", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673684, "uuid": "d1d30b5a-856c-44ef-ae7d-7ca58781967a", "value": "A3F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673684, "uuid": "ff621416-f48f-48ed-8faa-9be60f9be2cd", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673684, "uuid": "81c639ff-094f-4bd7-931d-82191eea18db", "value": "3072:Iesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:C4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673684, "uuid": "1d4ca66f-7c24-4858-81af-9f7569f54103", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673684, "uuid": "a829a177-a432-422d-807a-a892db89c478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673684, "uuid": "c1ad108d-b63f-4648-ae7f-1babc5f447aa", "value": "586d643b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4188a109-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637266, "uuid": "f6ea6e36-c760-42a4-b2fe-a21a762c0609", "comment": "Malware payload (Dridex)", "value": "441f46ff53f0ecc0244dd0d96c17c6d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637266, "uuid": "ccc52940-daf3-4378-a8b7-77fc6463b688", "comment": "Malware payload (Dridex)", "value": "257364566c8a5761359a181ab92ce7ed582d044561427e2d7a55b35327a5dd12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637266, "uuid": "f22946b1-1120-4088-9a03-b4cee345fbe3", "comment": "Malware payload (Dridex)", "value": "a4341a65deba94e4a6180d8bb869df304316c29e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637266, "uuid": "933f0e52-1306-41f5-ae90-84afd55d585d", "comment": "Malware payload (Dridex)", "value": "4f6379aa69a5268f779bfc0c12dad4b90bb91e122e357bdfe5064823a622ffcf3ac18ed0cbec4ef7c91cb0eeab96f3d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637266, "uuid": "7be3e4ae-ad37-42ee-a508-fc63788a5eeb", "value": "59F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637266, "uuid": "f856886d-c0d6-456c-9d77-460cc909fca9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637266, "uuid": "cbcfe99f-c8e4-46e9-8635-8a9ec0fbde61", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637266, "uuid": "29af621f-c044-426d-907e-72eaf9f49d67", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637266, "uuid": "6ffd0ca3-2f48-48e7-bd7b-13b53d35f166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637266, "uuid": "7aab5318-6b1f-4cdb-a3d2-062c60d7267b", "value": "441f46ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2c161f-b18c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650114, "uuid": "8c305f3c-8b89-43ca-b032-4c4cfabaaa32", "comment": "Malware payload (AgentTesla)", "value": "b3529afd82a7dd4aefe0508c4127102b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650114, "uuid": "b9e18440-ee10-4a91-9ed4-c603c75d2f9e", "comment": "Malware payload (AgentTesla)", "value": "25ce24517eb0b80cda9f9905d55bda52b9d7a038815b6b617ee3b46546bcacd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650114, "uuid": "8e17fd20-7663-4eb3-b88d-835880537456", "comment": "Malware payload (AgentTesla)", "value": "f495a8a2ff9ca349c71ab7ff0da6fe63f220a87f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650114, "uuid": "da9cf261-966b-4ccd-b985-d9f7c2f85962", "comment": "Malware payload (AgentTesla)", "value": "45d194dc8377aebc28be10d1f94de439974778985ef80b6dbae74177a1db2e5aaa876b02fc206bceacb016556d06d61e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650114, "uuid": "4bbf9ee1-dc76-4fe4-a00b-a8cb407173ff", "value": "1405D06036D4BE18F5BF4B3B88B0858097FAFE03C722C66E68D9718E5D71B859621713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650114, "uuid": "a79c913d-3b29-41df-a261-9af124a91bcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650114, "uuid": "0e679333-ce33-46df-b620-c2f49dd7fe5c", "value": "12288:RQNx/deP2RBVw9hhhH9O8pjGzhgJgBNDfb8s0MgwVYOShm6E34NjZ36tXG5ng:ekPM2hhhhGzhgmBNDD8Elt6VNVKtX0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650114, "uuid": "3f35cf64-3ad2-43b4-afa1-41e7aef6fc31", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650114, "uuid": "eaee001d-415f-497b-a5ec-1c3fa9febcfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650114, "uuid": "c043e3f1-4c86-4bf9-afa8-37575cc0573a", "value": "TKT eLECTRONIC Flight Ticket Confirmation VIS XXXXX83939 INVOICE 000Z1298932 TKT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec02232-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673554, "uuid": "1ac86eca-17e0-4a7d-a39b-9ec86c40ca82", "comment": "Malware payload (Dridex)", "value": "f6164d789201bcc402ade0f6135ba9bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673554, "uuid": "8432892d-5d18-4a30-a154-5241219d6d29", "comment": "Malware payload (Dridex)", "value": "25e8915957d89a0f42b00cd5c9bac9bfa055f0eaf2cecce5d81af94e0fce231e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673554, "uuid": "9f9c9166-b6f4-4005-858a-13c7d9e4002b", "comment": "Malware payload (Dridex)", "value": "18160300eba4c1e0ff2097f2ddda8867c826715a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673554, "uuid": "ea151caf-14c3-408c-bed4-335dc8b1b958", "comment": "Malware payload (Dridex)", "value": "44e5022877ab9d7f9b9db9a7ea042ff2899688df0b0474176221f8ece868141a31992db96db85773e923e12496e599bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673554, "uuid": "e861fdd5-858b-4fa8-b0b8-6acf6dc7c4be", "value": "87F3D0906A9BDF0ED9C13CF96A96A879B073458C811FDAB4D0DE84CEA4B75B34327113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673554, "uuid": "d35c2063-825e-4689-a289-14c8485775b8", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673554, "uuid": "c170ef84-9981-4417-8bc8-c47d206798c3", "value": "3072:Sesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLEO:04+VZQpt5hyPsa1ekiEbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673554, "uuid": "e0a985c8-81e2-409e-ada3-4c5af88f00b0", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673554, "uuid": "4e206d14-eeba-4b33-9806-f8b64ad22dbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673554, "uuid": "fdfe0e96-cefa-4c90-89e1-df4227957151", "value": "f6164d78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee269ad7-b18a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649582, "uuid": "23238a6b-755f-4643-8069-27d3fa48000a", "comment": "Malware payload (AgentTesla)", "value": "23f3282f1e4db865e2fe2bbc6e2f4372", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649582, "uuid": "ef951164-32ea-40e0-ba4f-ef0f769b4783", "comment": "Malware payload (AgentTesla)", "value": "25f8bda5569c8920933f5a0fa79081a5b72cac66240476af96d9e7e8d4304190", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649582, "uuid": "489c185c-2b81-4a16-8e00-8110e8fdb90c", "comment": "Malware payload (AgentTesla)", "value": "b23800b699819dba5af1ccff4ee5e14594c18cf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649582, "uuid": "566a575b-0b2d-4aba-b58b-227e23faf1a1", "comment": "Malware payload (AgentTesla)", "value": "d4ae0af272f090c9350300f338f86edc43b36d7eb3c3368a45ccce10a2f05c045ce0f98638a48de6fadbf0d818205034", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649582, "uuid": "1adc0147-406c-4c8a-8764-b7919006240f", "value": "9EE4161B3ED4C94CF4E95A7D45FC10227FA7E886080EAFCA49D773AC18E6612F521A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649582, "uuid": "30f06d4a-1c42-4697-b754-784d3715c380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649582, "uuid": "24eb86f6-de5e-486e-b865-9fa07078a18f", "value": "12288:4xVlqcXTL5y/vJV0TT22JcMQbSTwNZblqA05WU4+NSQ:eDTL5y/hCT22JlcmwvIA2nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649582, "uuid": "7978c761-36fc-4a53-9ca5-3d953ee913fb", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649582, "uuid": "aa405df2-6649-4e77-8448-b64a37260c44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649582, "uuid": "98664822-9a22-4ab9-b481-f7d488212783", "value": "Order (G01-2021).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6892cbe3-b162-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620632178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632178, "uuid": "dfd5ca90-2a2f-423b-9cc2-842572052da5", "comment": "Malware payload", "value": "120cddd3cd0c40f2141a0d64c4e5f89d", "object_relation": "md5", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632178, "uuid": "f1af89ea-ad9e-4a20-9311-17301fbfd5ea", "comment": "Malware payload", "value": "2650e32484013fba1be1ad1f136be0d18d92eacfc1b25bf8b6d4ed7e389bfa4b", "object_relation": "sha256", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632178, "uuid": "f616d5b1-9293-4dff-b1d9-884c45e9dac2", "comment": "Malware payload", "value": "8fc9bbc31b81708af3daea7afd67eaac012aa777", "object_relation": "sha1", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632178, "uuid": "bf6b35a9-5bf4-4f53-94d8-e67c88926232", "comment": "Malware payload", "value": "1c35ebc255ab565ad5df352f9ba30e22f489ae83c8c80a022d5099b2c652aecdbb6c22414396a590152b9165ad3a0604", "object_relation": "sha3-384", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632178, "uuid": "8e595ee3-29ae-42c9-932a-6802241dfc0e", "value": "3C8337205B6A9B90DCC679770355CAB1D3324FD0574373EBBEAC7A0D2B5C981882626F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632178, "uuid": "402d9806-2f35-4f27-89ea-66f24185d3bf", "value": "1536:LPfSXgupr3f3r1bTDkNnhipFnY5IE2vYjsR64L:gTp3DMInY54vYjsR7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632178, "uuid": "c5942865-65cd-48d5-93bf-1367d52c360e", "value": 81259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632178, "uuid": "ca16e0e0-9282-4c58-9d24-ac51c76eadaf", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632178, "uuid": "e972a7e0-58ca-4015-b597-93d23ad05258", "value": "official paper 05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1252d7bf-b18a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620649213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649213, "uuid": "4084805c-e069-452a-b39a-aa457f828eaf", "comment": "Malware payload (Formbook)", "value": "8cfb0dcd49ddd4d5e1388c2667cd5000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649213, "uuid": "a0aeaa56-4ef5-4930-a3b6-090b541da200", "comment": "Malware payload (Formbook)", "value": "268fbfb1b4a153af13d4bdbb409732559eb239927e431ba117f2cfa9d6e5ae8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649213, "uuid": "2348f20e-09a6-48ae-8851-cb52f90d2d0f", "comment": "Malware payload (Formbook)", "value": "9184c5d76bb9406e4ddde9f30289ab3b18b2e732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649213, "uuid": "d898f430-dc34-45f0-ace9-943a171948f8", "comment": "Malware payload (Formbook)", "value": "445cd56186f6f8076e57153ff229b94bfd71c26f8d94276913c614d36da1da844af252035c6b232b472bcced19867c30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649213, "uuid": "73e81bed-63cf-4153-a3c9-3ccf4ed1ec55", "value": "4C057C1DB744BBE6E1594F7A8413459083F0C8239A32F28FEDE039EF5561FA94A6F412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649213, "uuid": "943e6f1e-d6af-4151-8864-5f11ade06f0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649213, "uuid": "c0c1df5f-c88f-4c76-b588-68b7c6447b60", "value": "24576:zyam/ofIkGcMmoqxr3Am57AFzSZiOd4eZ:7ftuY7AFzSZP4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649213, "uuid": "4d17f48c-8300-49fc-981b-6fa760c573e6", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649213, "uuid": "c77c7114-40fd-4f95-90e2-43c961539d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649213, "uuid": "dd216c18-8059-46c8-b967-16c2a8b29a63", "value": "RFQ# PC1746006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca614e3c-b133-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620612156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612156, "uuid": "5d807006-0696-4171-b3a6-f154367e4a73", "comment": "Malware payload (Dridex)", "value": "bad88074e4431e3fbf28d5d8cf268ab4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612156, "uuid": "676dfd11-082a-4a1f-b111-39cb50d50be9", "comment": "Malware payload (Dridex)", "value": "26c80aaca42dff03b902453cfd8196ac1d3ccec8985ad49a1078f66561f559fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612156, "uuid": "9785b807-ca9e-4c56-96ae-10030494a5b6", "comment": "Malware payload (Dridex)", "value": "25a1dac20be32d29ae53164569042a44aa750896", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612156, "uuid": "55de2fe9-b920-4bbb-bf43-a73e907ce1c8", "comment": "Malware payload (Dridex)", "value": "cb2e9303fd80e84753d7610f4b6da55a722fd1567b82e06840190d3aec969cd10f91e98b8eb97438cbb86d0fe31cd917", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612156, "uuid": "c8dea187-1324-4ab9-9731-923d9e981fcc", "value": "E1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612156, "uuid": "fb77500b-41b5-4faa-9c23-9c7bd3bbc864", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612156, "uuid": "c1abc2c0-e1f2-4523-aff0-025cc54c3533", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620612156, "uuid": "7cd03eee-345a-4800-a0fb-0d1492d268ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620612156, "uuid": "567e5623-6160-42e3-91ec-ba53f1ec6c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612156, "uuid": "360bf381-8bb7-4025-85f9-021ad471eb37", "value": "bad88074_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf44fad-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669900, "uuid": "170122d4-2886-4ebc-be9d-369686280600", "comment": "Malware payload (Dridex)", "value": "97c9c53a332eabf538311732b707b14e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669900, "uuid": "25efc96e-cd38-46a4-a56e-8deb2c451c88", "comment": "Malware payload (Dridex)", "value": "2793922ec5d2b66efd67e1bef3f8f4793577be25fae3ef76365e1640fdfb009b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669900, "uuid": "8e2cd29e-9293-4dc4-8d5a-1f27bddd7067", "comment": "Malware payload (Dridex)", "value": "4b157e4994d05d920498ed7599138112e726a9e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669900, "uuid": "c753764c-e307-4739-87d7-8caea7c90ad5", "comment": "Malware payload (Dridex)", "value": "20250efd9f1359628e9d54bed30fab66fc2cf9371374f0b65e30ce4b568ac4f9a1dd1e3afd4729c4c241dcc835fbb480", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669900, "uuid": "14b14f92-d1c7-4d5b-b9aa-e5d025dd751a", "value": "40F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669900, "uuid": "c7a0f6e2-0bdf-4948-af37-4faa63df66e8", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669900, "uuid": "b459d955-2785-44e9-b88c-f71f0f37c951", "value": "3072:X/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:tbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669900, "uuid": "85478083-da74-48b4-8d9a-685bc7ea4e55", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669900, "uuid": "cf3b09b6-b8a2-412f-b933-df33b6d9a88c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669900, "uuid": "8ea514ee-682a-4de5-80ce-2c1c34ba0188", "value": "97c9c53a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd98fac6-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620673660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673660, "uuid": "f1ad28ea-ca5d-4f7b-95bf-68c1dc345e67", "comment": "Malware payload", "value": "9cfd3f6ae259b1d314b5287f321e1231", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673660, "uuid": "82a21d01-53b0-404b-8da9-0048c16b3aa3", "comment": "Malware payload", "value": "27a94895037b978da0d485c6d06bb2ce59555d727a3bb2921f793034e74cc414", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673660, "uuid": "7ac639f3-8b16-4ab2-8d01-95c966604199", "comment": "Malware payload", "value": "546ecd864848374e44f3740e69defd281685f619", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673660, "uuid": "397f9b5b-b7cd-416d-bab8-d87ca67d062f", "comment": "Malware payload", "value": "e5f9279fa2911ebe3ec9bf5b76b4f67526bc8e15a6c2daf97ee619802b5851c98aa570dba35077afa743ba8a15959190", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673660, "uuid": "709c71d3-b68e-4aa6-a123-07028907bfae", "value": "07F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673660, "uuid": "a48b5608-3fc7-41d4-81fd-1552e7480703", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673660, "uuid": "5fcbd3b4-15ac-4c47-b55a-4ca989e29f4e", "value": "3072:Vesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLQF:R4+VZQpt5hyPsa1ekiEDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673660, "uuid": "19f6b26b-93b0-492c-9c24-3cd479287238", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673660, "uuid": "fb51bb25-a07b-4eac-a4aa-9cf6b7843cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673660, "uuid": "74740f53-bb99-49dd-92b8-fb91b574db3a", "value": "9cfd3f6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9978f340-b163-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620632689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632689, "uuid": "6dfa1983-72a3-4258-b9c3-1f5fbc77d8ab", "comment": "Malware payload (ArkeiStealer)", "value": "1cc94a118cad4ff05f63696def78e644", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632689, "uuid": "d68204ad-84a6-4372-9fbd-7ddbfee1d1d3", "comment": "Malware payload (ArkeiStealer)", "value": "27cd207590de18261070fcc0e8c3e5512d6495effd63b4c0c0979bac7a85c167", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632689, "uuid": "9da66ee9-a8e6-484d-9668-d57c682c841f", "comment": "Malware payload (ArkeiStealer)", "value": "352b7fd3cec5228f68fff438043da1e64ff2752a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632689, "uuid": "52077466-98b3-4411-bbb6-a0ef5144b15f", "comment": "Malware payload (ArkeiStealer)", "value": "a4844ea766f59e8f22991c3ffd96b05f1a4a0cce75174c586dccfb77f9efbfebe9ebfc82b487436e2f8be4c9cd00401c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632689, "uuid": "9d91a5ba-986b-45aa-8a1e-58456da0bdee", "value": "4CE4E02131D0C376DDA329758925C7B94E7BB8325B255ACB6BC70BB8DF246D07A3130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632689, "uuid": "0ed8856e-4ab9-4def-b5d1-2b1e690efb2f", "value": "3e9921d2f80fae5845191c15182956a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632689, "uuid": "5700ce36-6737-498d-8fb4-3fac9714a836", "value": "12288:8+59Fq2o3gS3gqEj5rP5tgBUvtHzJyHhN/oPFXAUrk:8UG3geZq5rxqBUvt9yMNXAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632689, "uuid": "aac3cf83-1d68-4475-a28e-1f32d42544b3", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632689, "uuid": "44d3bc65-2b93-4d5e-9315-e058bf59526a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632689, "uuid": "2894924c-b134-4455-bdd9-df69a2de5fd4", "value": "1cc94a118cad4ff05f63696def78e644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fe44f1-b1b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666476, "uuid": "e6a2da33-8230-42ca-964b-26333176c404", "comment": "Malware payload (Dridex)", "value": "e0ba74836093ba40801c5dfb0ee79402", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666476, "uuid": "b9355962-c0cd-4ed9-b3f8-5f273df561b0", "comment": "Malware payload (Dridex)", "value": "28476c01c5f87d7013e9ea05a51e5504543da1567db4d76c42e4265e2002538a", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666476, "uuid": "c3191ba3-59da-45eb-82ac-a338393fb7f2", "comment": "Malware payload (Dridex)", "value": "340ed009c371e27e446705174514b37f76a3c446", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666476, "uuid": "048621c3-e75e-4e77-8a9b-cf151c1bb0b5", "comment": "Malware payload (Dridex)", "value": "672d765662dc3cf0d2a9e0efb6afe43b5714b5da0d167f93101a72a50e64b6ac0d314abbc19d91f52c0d638aac5eb602", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666476, "uuid": "044c827d-d5d8-4886-bd14-1dc13ce8a549", "value": "9B06335EB639EB12D5264638C720364783133299B8BCE23D7E7560E7EC2D8E741EA44D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666476, "uuid": "af3bb7d2-38be-4db6-b849-9eec36db1b5f", "value": "98304:Z72Tzaj6+CC9qt1GFfuMT6WsnsZ2JV2YNx8jdso:oTza++BqX83MsKV2YNx8jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666476, "uuid": "e670ecac-5a5f-4f51-9ca5-f1872ec962d3", "value": 3743797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666476, "uuid": "af7e17b9-7226-4486-b6b1-57b64e496f02", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666476, "uuid": "647e48ea-d89c-4f8c-a828-38f74105abcd", "value": "export of document 555091.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6e4acf-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633741, "uuid": "4e2467d9-aa61-4e0c-8588-a734c6b58f77", "comment": "Malware payload (Dridex)", "value": "4d5328297ed555e83c6db6e6a270c471", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633741, "uuid": "878d1f50-6550-4b96-8a0c-3fc7b8679bf7", "comment": "Malware payload (Dridex)", "value": "284c26b9b17b843570ed68048b6e20a9276cc1d55a1015fb153d4f4d83ac807a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633741, "uuid": "3ef5119e-d1be-4f8f-8fc8-487eb90d6856", "comment": "Malware payload (Dridex)", "value": "406e19e479acc0ca1665cb7bebb9b1a6e77b0b64", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633741, "uuid": "fbeb1b13-2d91-489f-9fa8-f83ad75ce9fc", "comment": "Malware payload (Dridex)", "value": "057192000f7cdd8bad7ac76644dd4cabb512a8d34aca53d78ce8c1810a277f1e48b551a21a5f2bbd801269caccdc0ce5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633741, "uuid": "ff917c8a-9164-4b18-a560-4bbd5c378a62", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633741, "uuid": "512970fd-1382-4bfa-adf5-44e0979d74b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633741, "uuid": "986e44ee-c157-4d15-8eb4-82e440abd66e", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633741, "uuid": "c2f06cda-2b10-4ee7-ad8f-e9c049bc08e4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633741, "uuid": "33ebfe1b-c411-453b-b2a3-f434f932ac77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633741, "uuid": "f1dcd9b2-26f9-4dc3-9d65-3d95b65debd3", "value": "4d532829_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f600d6-b1b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620667142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667142, "uuid": "e8473329-762a-43d0-ae25-1e95ca430d9f", "comment": "Malware payload (Dridex)", "value": "bff3376643c19abaec12de924b31ea81", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667142, "uuid": "8023d707-e7ae-4d67-bc4b-e15cc61fffeb", "comment": "Malware payload (Dridex)", "value": "28977cd312c41e8ebdf5c7089a8e3d76d37c8551fdd9a9c32191ecea23f3c2d8", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667142, "uuid": "023d5807-513f-49df-9ef2-3c581ccd5b5d", "comment": "Malware payload (Dridex)", "value": "fc886a226660ae0423b24c5171cbcc5f60a0fbc1", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667142, "uuid": "e5cd8c55-f6f3-4d10-bfb2-66af5b18c1c6", "comment": "Malware payload (Dridex)", "value": "df3adeab96e47882143c9e83af4ed91ad52054ee29f0476bcebd8ffec12e7350d042b6239d1a4aadb7a7105514dc6a28", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667142, "uuid": "2848ccad-34b0-4864-992d-4fe4d696385f", "value": "240523E5C648FA4BCB63743462846F666383067799E3FC9CB245FA38FE94A41344225B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667142, "uuid": "c1b6aac0-0cae-4ab9-92d5-3533666997d7", "value": "24576:NHqr2mX3YI8rggLjzdmzn7qf+853rT43KKYrxk:NDpI8rgOSm+q3fXxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667142, "uuid": "44bd0e40-1b40-4ad3-a74d-d08b6d5db92f", "value": 828676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667142, "uuid": "6724524a-6ae7-410e-9f25-1b02b894ba60", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667142, "uuid": "39953f34-6015-4f0b-8f99-96bc8c5ff31d", "value": "check 24994.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0dd4aec-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620669343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669343, "uuid": "e3720122-4b54-4842-97e0-0c72c0dfd1b4", "comment": "Malware payload (njrat)", "value": "16975d1a6014294f38cdc5f3c311aa7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669343, "uuid": "5845c778-2813-412a-b82d-ac71b49364b3", "comment": "Malware payload (njrat)", "value": "28c85e08e2525f6d87faa5adb0982a395e165a71e21703bb0166aa5fdd72c54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669343, "uuid": "ff71c094-9bc7-44dc-ab60-33a02bc2e8a7", "comment": "Malware payload (njrat)", "value": "f24799c9139a73851735f917cc35e557f9d945e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669343, "uuid": "2d87c9c1-76a4-42e6-b49a-27f32c16af10", "comment": "Malware payload (njrat)", "value": "e2798983bd1a57dc416bd706e39930dff9d6e7bcf474a0e83b79a19b9b3484c8962f7deb590258c2f97ed82440c53842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669343, "uuid": "3a7566e8-1c97-40de-8f33-ad668f1e8540", "value": "0C34D01075C0C2B3D4B7113549E6CB7A4A29307A276FD4D3FB992BB66E212D09B352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669343, "uuid": "42d0dc8c-e33b-4b4a-ae57-98dcab95777b", "value": "720f62ecaae027b5c3ec6686644322e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669343, "uuid": "2bbb28e6-f738-4ecf-9b1a-77d399dd4bae", "value": "3072:DR8EC2Oi8NXC797F8TBfFvj4bq575LKaMx2PHlftYbxaUuxYlkqZUNkc:DhC2F8NXC796TB9vj485LlMx2Pkdmo/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669343, "uuid": "e5c91406-81cb-457e-a893-bedd5a080a2f", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669343, "uuid": "0cd14f59-dc05-48de-9141-2a1ac296edd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669343, "uuid": "d081a664-4908-4d70-8711-100155ebc24c", "value": "16975d1a6014294f38cdc5f3c311aa7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d85dcd-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673586, "uuid": "b0048fb2-8efb-4fd1-8c49-16e0de0c1c2b", "comment": "Malware payload (Dridex)", "value": "8c295dc773d69169bc1d078a3bc248c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673586, "uuid": "5d3e00bc-f203-477f-be8f-b6ab93b6841d", "comment": "Malware payload (Dridex)", "value": "28cfb8ea37bb21b76e7f69b6ce784e3a7ed8ff1d946995e0faa1a81b916f793e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673586, "uuid": "52876b2c-faf3-4c96-95c1-361a6fbde75e", "comment": "Malware payload (Dridex)", "value": "08fbd73c5dc371dcfa30bef7f80d136749373ce6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673586, "uuid": "dd83e0c4-53da-4d05-a719-62df2bc3ca53", "comment": "Malware payload (Dridex)", "value": "1f71b498ce9757fc9ddd02cc41462d1a6a5912c621f4c2ba5fcb403426b0bff78197ffc8cc4791950bfd2b8064f6c56a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673586, "uuid": "c254fe97-dca4-402f-bc3b-538e1fc5e3d2", "value": "81F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673586, "uuid": "a9369ad8-7a7a-4f19-a1b8-b9f21d6ecc6a", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673586, "uuid": "343b45ec-c153-4bee-b5f5-66834edaad7a", "value": "3072:besl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:f4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673586, "uuid": "a32c1ce7-5aac-4c09-ab53-eb883e0cae45", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673586, "uuid": "0b4d01f0-3b41-4c71-aac8-60ee6a2666eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673586, "uuid": "407d0759-bb67-4027-84bf-6c010c530598", "value": "8c295dc7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5633b219-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673379, "uuid": "d6e9f114-fd04-4c88-a4a7-60aafdf35c02", "comment": "Malware payload (Dridex)", "value": "4f15ac281b4f577e77887033d851b2d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673379, "uuid": "d9daa2b9-b276-41fb-a0c9-cc23dc0d0032", "comment": "Malware payload (Dridex)", "value": "28faa3d460d77212c134c81df109c039cf6e2304b87a45d4d36bcbc03bb0ddd3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673379, "uuid": "57b51245-64a8-491f-9457-fd60acf70c80", "comment": "Malware payload (Dridex)", "value": "b51f46631a4e9275fb6a16c9817c318c02ea3d2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673379, "uuid": "0078997b-63bc-4205-b37b-0133feec7a8c", "comment": "Malware payload (Dridex)", "value": "90211e93a7df657d6432ffbd87aa3817fc08f1c17a6074906aeb460e1d90cde3dd5af06facc75bd66cc03094ca40e07d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673379, "uuid": "d6756ac9-1e8d-4587-8c74-d656dbe9418a", "value": "DDF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673379, "uuid": "b1323ba3-7b0a-4719-8e6e-aeeea50101da", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673379, "uuid": "c7ba21a8-a38d-40cd-87f2-699784ad8ca6", "value": "3072:qesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:c4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673379, "uuid": "1b8f166c-44ce-491a-b6bf-36dcbe11aa20", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673379, "uuid": "990de0f4-b92c-4162-82a0-b81f0b534aec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673379, "uuid": "68a809d6-5815-40d5-bf64-b8f4984f2176", "value": "4f15ac28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e0cd75-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1620651231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "7ac565be-565c-455c-8183-3e5dfb8b9346", "comment": "Malware payload (ParallaxRAT)", "value": "da9cf01565ca4a3abbe4630656fadd23", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "731a792c-1c4d-4a06-9cba-22adaa40312d", "comment": "Malware payload (ParallaxRAT)", "value": "29369c122e942e2ca2747a55895c0d0439acfc372f5b698b250bb6af7fc90914", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "609121e1-f204-449b-bb0c-a6161bac9962", "comment": "Malware payload (ParallaxRAT)", "value": "781194da5ae0e04e02ba0c270483fac9d1c6b431", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "654ce135-155d-4f91-bc75-47494ca7aa22", "comment": "Malware payload (ParallaxRAT)", "value": "182acee2da592ca376c8b995863f9e735ed6520b6e40755c1cd79329c08b773efbed7d02a223319d1671622e22bb6ebe", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "73f8f64d-759b-4ac3-8b11-5c6963131c82", "value": "1AF49D61A2D044B3C1AE5E389C1FB6706835BE602EE914B927F4BE4C9F3D7913D1819E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "d268d9bb-89db-49b3-9173-4786165d72c1", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "3c8323fa-a87f-44de-ba4e-531579fcdc33", "value": "12288:mrnWDrl98a7LUacm7sbiD97T5QM4Pr4r/U/Oy/A:mrWnZnUivR71B48r/UD/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651231, "uuid": "d14a7020-afcb-462e-b389-961c06452117", "value": 729232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651231, "uuid": "6ca2a2c5-fd0e-4824-ba84-03d63c806479", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "52bcea07-11c5-428f-8439-438132ec28e6", "value": "DHL_988121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d152c895-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620670149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670149, "uuid": "52bad7e8-2432-4f3c-963b-b8fa477c4b32", "comment": "Malware payload (Dridex)", "value": "0699dee157589823186f55ec69247976", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670149, "uuid": "dd846513-0cd4-4c5e-a866-cbfd1ad5df40", "comment": "Malware payload (Dridex)", "value": "2953a18f4de2ebde8fc102e952ae2573f56f2b4be4054ad12b75b5608a79ca44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670149, "uuid": "44038431-0dcb-48cd-9d54-3e742052fb39", "comment": "Malware payload (Dridex)", "value": "ab04139f7b9c185d73c1ef56154daa5f66b1f692", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670149, "uuid": "6b43031c-d7e3-43e6-a7b8-bd0f5d2ef042", "comment": "Malware payload (Dridex)", "value": "d9ee1789296c259e0ea703d484360ce129681ebfe415d030739b7d46769fee46a8f17060c29f1be963e99accaaa642c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670149, "uuid": "39c8c78a-14ec-4aef-9224-d372cd220afd", "value": "62D423ECE5623900EC71C8FF15351AA53F7E668FAA516AB4A6E3F06D06035C9F1D0288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670149, "uuid": "bf53ac85-70df-4702-b123-ed697a03f4ce", "value": "12288:6kmP3GZZ/1mR3tbecLGoO3u2AMAHIgrysSWXq+c2SNp61RV73es:a3GH/1s9xLUJALogryFsuCH73n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620670149, "uuid": "b46b8225-ec8b-44eb-a14a-8d2c6844cf1c", "value": 612139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620670149, "uuid": "144d426a-f6cc-490a-96f2-5652a383a5e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670149, "uuid": "e6bab844-d31f-4249-9953-f2ac1d6852b7", "value": "check 6746422.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606ee370-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648056, "uuid": "32c41799-a5bc-48ee-8a0e-a32476a28068", "comment": "Malware payload (Dridex)", "value": "52ede63bf4dcd6139abc98c25385726b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648056, "uuid": "5836f4e7-d00b-45ae-8c03-7269bcd231eb", "comment": "Malware payload (Dridex)", "value": "29563aaaf0ffe07618350166175a848d1b93c88864415043ce0f85890d2716c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648056, "uuid": "ba40957b-47ff-4f7d-821b-56f28727e71f", "comment": "Malware payload (Dridex)", "value": "5dc1e77af1254f786c382bea34709b0c77f66b01", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648056, "uuid": "6c2db5b3-9df6-4666-8ecc-f11c7ebdf9ed", "comment": "Malware payload (Dridex)", "value": "7c435709110601d81c3f2f190fcceadca01c3b9e4de7d2fb856bdd1f791468663caf82e029775b94f093c3f2a8834d43", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648056, "uuid": "943189f9-487d-45ea-bfd9-cba9ea799b7c", "value": "B8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648056, "uuid": "392f5690-01ec-4baa-bd45-8fabdd1b156c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648056, "uuid": "a18a3ed3-ad88-4f17-b917-c7b806e5578f", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648056, "uuid": "3b808178-a861-4aca-8ef8-3df23e3aeb28", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648056, "uuid": "694bd550-7211-4b62-8830-dc9bd42deea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648056, "uuid": "03a1d6ce-787f-4242-9f88-2eac20410956", "value": "52ede63b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a424fe35-b19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620657618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657618, "uuid": "00280109-dde9-4a49-93d9-c807c5984179", "comment": "Malware payload (SnakeKeylogger)", "value": "11bbc515889ba594a337fa0dc078ffe8", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657618, "uuid": "6ba053ad-1d37-4ac3-a074-b81e889187d3", "comment": "Malware payload (SnakeKeylogger)", "value": "295c362da762ee9d2a53d7f2cd67256a77ec0e7d94e3e171f7a4569c950f1d8e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657618, "uuid": "6e7acff3-bcd9-43e5-8256-99cb03c89b4e", "comment": "Malware payload (SnakeKeylogger)", "value": "dd8006c14c0cb9d75d315dc21a1ac32a0494c79e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657618, "uuid": "58d48a92-0698-4c65-9bf2-07d591c8a895", "comment": "Malware payload (SnakeKeylogger)", "value": "fe6610f364bbc89c5a141515333c3bb905be14342ee421738c6c598de1b2583ed902b6207e2caf641fbf3139fb81b693", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657618, "uuid": "d2d7a864-ba92-4c49-b684-e31ffa2dc7a7", "value": "10B423BDF62D28B02185BA19765D08F3AD1BFBC456D2FC0263AD530E1C6C749B168C8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657618, "uuid": "560261da-a5fd-40d0-b629-a1b24730e7c1", "value": "6144:MfR5bA1jInxnEx9CJF11MnTWtyI27FAbh7ET766fOmrozpjJUsQkBNVvxi5kHnBT:Mf+cnSx9O11BYwlz8UpjEkF5jHnqWK94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657618, "uuid": "53604b60-9529-4e63-9725-97e3cadd9bbe", "value": 516098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657618, "uuid": "7e661b94-63d6-4250-a387-6e5e339d5c41", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657618, "uuid": "23987cda-2d6d-4d6d-a501-114ab25b7919", "value": "purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58363683-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637304, "uuid": "f98deb71-2202-4a34-bf33-4def661cdf07", "comment": "Malware payload (Dridex)", "value": "24ca33854d5db0a997aa95f3f020431f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637304, "uuid": "69f40f21-ea01-481b-8fab-c36653c2ae19", "comment": "Malware payload (Dridex)", "value": "29622e74792d296323ea8b86b9d0b6af8691faa2bd0d54016b0cb70bb1f47193", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637304, "uuid": "337a2065-f6f9-4f91-a5af-153b42d62386", "comment": "Malware payload (Dridex)", "value": "bdfdd9c37d461cf64f0d296dab64c806ef464995", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637304, "uuid": "14388c0c-356f-49b2-b774-3557e67cca99", "comment": "Malware payload (Dridex)", "value": "dc8763f241dc11baeea4c764d08438723e2355b0114b0b8f376720f64f3dc6e47970eb4681f91a2d88ba6f467cbbf043", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637304, "uuid": "380190d0-e47b-4170-978d-31d9e54c7d26", "value": "6AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637304, "uuid": "6344ef37-53dd-4264-9139-2c5715c46c06", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637304, "uuid": "6a167ade-21cf-4e23-bc03-8a2b810f09e9", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637304, "uuid": "11247309-c86f-4fd9-b78a-5bbf2f57ec9a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637304, "uuid": "cb078d2b-a8b8-4c17-bbed-cdab27a34fe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637304, "uuid": "08cada7c-ca27-41db-b09c-cfffa483c446", "value": "24ca3385_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f4b840-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684037, "uuid": "152391a6-ad3f-44b4-8298-01c12d406507", "comment": "Malware payload (Dridex)", "value": "cb057b01becde8c3408b59188aeebb8f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684037, "uuid": "7a97035d-31a9-477c-b5a2-b446d05bbf7c", "comment": "Malware payload (Dridex)", "value": "2976ac486e645a5acde64490b264af40840da98eb1e3c6ee922dc9ae53316797", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684037, "uuid": "7d55a5e5-604f-4669-9a66-00d11eec10f3", "comment": "Malware payload (Dridex)", "value": "fdbfd322940c2dbf2c287c522c021769526da451", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684037, "uuid": "7832723b-fc6d-47c5-9829-cd1a1061c65c", "comment": "Malware payload (Dridex)", "value": "0ce68eac67753de363d7e932c4ae2f67537cacf325a6367039890c7b70bf5bb619f97779a24e2ebdc8396d2ed4f64f52", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684037, "uuid": "c230f34d-8480-4e81-b9fc-971e6a19644b", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684037, "uuid": "77f146ed-ec22-40e8-9007-c66181e6b7a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684037, "uuid": "03f521a7-6eb2-42a7-b8bb-1468f081e647", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684037, "uuid": "a0c266cc-8cce-46c9-825c-ecd328af8852", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684037, "uuid": "ff7e728a-e376-440c-95d1-38630c018edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684037, "uuid": "c58dd4ca-f8db-4af8-82de-842fec0f8e39", "value": "cb057b01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14487a4f-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644492, "uuid": "d79a968e-68eb-4a0d-a5bc-1d543c1b35fd", "comment": "Malware payload (Dridex)", "value": "5a8c18178331d3adcd8c52bca01f79c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644492, "uuid": "e9994a9a-49a5-43b8-bf33-64714c3a4f90", "comment": "Malware payload (Dridex)", "value": "2a33fe7124b3126bc364696e33a56e98eae2c6cefdf8274ec44273c05bad7db0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644492, "uuid": "e891c921-50c4-4080-9018-bec06b308282", "comment": "Malware payload (Dridex)", "value": "67345ee7f2dc38e8c2018c31e84c1093ffa73633", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644492, "uuid": "c5a47af1-74cf-4902-9a7a-f42f7dd916c8", "comment": "Malware payload (Dridex)", "value": "6140ef3dbd07002c7a98da423de14fb5b77ed06c6323a2769413ca1675fcb35411ef17cc8e788c497f4552726b35e3e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644492, "uuid": "f3d31cb8-3fc1-475e-b899-0aedac95a844", "value": "31F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644492, "uuid": "3e6d8c8c-aa88-4fbb-9682-bc3e347b3e0e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644492, "uuid": "e595a032-bece-42c7-a883-f343b61c0c24", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644492, "uuid": "7480df43-b54e-435c-b144-2a1c32d3d25b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644492, "uuid": "2cc19ccb-c172-4bdd-a58c-aac26291895f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644492, "uuid": "7e8858c1-53e6-43c1-b104-314b015a515e", "value": "5a8c1817_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e20980-b16b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620636015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636015, "uuid": "5401b62c-30d1-47e4-bc9a-d3a56ab53d51", "comment": "Malware payload (RedLineStealer)", "value": "32fb9c5a0e4e448d4702a9041be4f11e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636015, "uuid": "e8395a5c-0d1a-4275-a7a9-096d8800d549", "comment": "Malware payload (RedLineStealer)", "value": "2a707bb26e7216a1e9e1e98e25a2c12e81ab4eed316075a3313539b38e2a01b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636015, "uuid": "31490a8a-e04e-49d9-a619-4188c3bc094b", "comment": "Malware payload (RedLineStealer)", "value": "11d6789a874e393f98d26b30d58d4a6411b31f8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620636015, "uuid": "d867a6f8-56f0-4822-a76d-b723f91d0efe", "comment": "Malware payload (RedLineStealer)", "value": "2ae1c997841760c2086bd80f3c9f31d9b9d3f296c3bf3026126b04c9d8d134e41616f57a66d6b9b24f889df21c438ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636015, "uuid": "febea73f-8190-4c7b-8340-0317691e4dc4", "value": "DFE4E130AAA1C035F4F311F845BA837DA52E79B16F7594CB23DD1AEE52346E4AC31287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636015, "uuid": "d86e5b2f-0822-4f0d-b173-6b0ac0207620", "value": "f005994d9c3139288cee35f5ba4b8d09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636015, "uuid": "036e8224-d13d-4d05-b00e-825e30e4d9ef", "value": "12288:Mg0IGYVwPhZfVE6gU3PXDA0vRhOpVMCFYo9hNN0cnnBXSvVIPJduzGIAAvHyr2j8:zufPQY8AcQAN0uSvaqpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620636015, "uuid": "cbb6bbe5-392d-4154-b6ea-011d9efe768a", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620636015, "uuid": "81e1360e-ef38-4c83-8598-4806660f2062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620636015, "uuid": "fd03542a-db17-4827-9ac8-1151ff6db835", "value": "32fb9c5a0e4e448d4702a9041be4f11e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595d46f1-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633870, "uuid": "0955903a-e5cc-4d99-9157-a689334ebfec", "comment": "Malware payload (Dridex)", "value": "dbd1fafd4111e1ef98301d66fa969b5b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633870, "uuid": "26e2b9ab-a8e4-453f-8e36-f9026a246cbd", "comment": "Malware payload (Dridex)", "value": "2a837841e5ace6b776e85d2063b90737810cd0f5d11f8f932288fc70e87122c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633870, "uuid": "e92b9ee2-94a4-4650-bf4c-899c962dd7c9", "comment": "Malware payload (Dridex)", "value": "23df22aca7f865511b7489d162804355daeb6d02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633870, "uuid": "687f1ef0-e543-4a0b-a7d0-415923c33b27", "comment": "Malware payload (Dridex)", "value": "7a85362921c8c61a45a02fbd3120ed5d047461c40e738f7c9af7c452d1f8510e2a0a6efa5c777c3af15953dceb1803ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633870, "uuid": "4638cea8-0179-49a0-aa8d-5f9c92e2ba34", "value": "6FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633870, "uuid": "0ac9dfd5-d389-4962-8f9e-6be4e5cbe90e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633870, "uuid": "d3623e87-4b5a-4004-8ebd-68570048819f", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633870, "uuid": "8be1c4bc-43d9-4284-9822-da09cf66a4b9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633870, "uuid": "44d14be2-1b5e-4a4f-a555-2b887059519a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633870, "uuid": "9a52791c-19d0-4b8b-aff6-3fcb647dbda2", "value": "dbd1fafd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5eef84-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673391, "uuid": "5b1e3900-d5a8-4057-ba87-0291762c1e1b", "comment": "Malware payload (Dridex)", "value": "9a0b6a601e9a20f29ac57ad6d864f34c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673391, "uuid": "f664d304-c689-49fb-adfc-22afcfbf0f28", "comment": "Malware payload (Dridex)", "value": "2a8b12716be9cf5ddb0e5d803ac4921d2c1029d05b92c2b246801cbbe9eb95e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673391, "uuid": "76bb4ec1-dac8-4aa2-8379-45a28f76eb7c", "comment": "Malware payload (Dridex)", "value": "d5b8d7de24ffd8c24d49cd595a49f971b8a6704a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673391, "uuid": "bfb32517-ca30-495d-a1af-5fc617788817", "comment": "Malware payload (Dridex)", "value": "b05d72084f8ffac867e2000ac975419187d659f815a20927e7d8d5d2cb35399bec93798036d81145bda8bee7fb58c82a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673391, "uuid": "1edec65c-672b-46be-aac8-d06dea053605", "value": "8FF3D0906A9BDF0ED9C13CF96A96A879B073458D811FDAB4D0CE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673391, "uuid": "750aae21-c6a2-4994-8703-879306c68988", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673391, "uuid": "3851e4c5-0dd8-4a96-8db8-cd71049c0fdd", "value": "3072:3esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLP8:74+VZQpt5hyPsa1ekiEY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673391, "uuid": "95e05f65-bf8c-40da-a8a5-04cdda6f06c2", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673391, "uuid": "709d0a0f-7358-4d08-8bf7-229aa4369f5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673391, "uuid": "4b77fe9d-0dbe-4963-b876-edd3d1e0d4ca", "value": "9a0b6a60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e290cb-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680524, "uuid": "e7f621d1-c545-4c6c-830b-66aaccf760f7", "comment": "Malware payload (Dridex)", "value": "ca1f297e0dd7f397f346678cbe0deac1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680524, "uuid": "76f28d79-a0a5-4827-b0c9-0f5634f7f91b", "comment": "Malware payload (Dridex)", "value": "2b33bf0ddbdc3a2eb11ce1e40bfa71250b574ee5a205e89659f9aa1472147d39", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680524, "uuid": "033b0769-d24b-4129-9fdb-7c9638529d81", "comment": "Malware payload (Dridex)", "value": "e142063fdc4f49f51af2991590eec95acfcb31d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680524, "uuid": "c9205d27-04bf-4265-a4cf-631ee47a86c7", "comment": "Malware payload (Dridex)", "value": "ad592d3236dca14cb8c390061728f378e68479deb609c10dc50329c1f0352e59308146c1f507b4f40210933b22b2724d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680524, "uuid": "c00a38a6-467e-4e4d-a590-77d7413c948d", "value": "E9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680524, "uuid": "5104347b-8c36-462a-9010-ce458aa45798", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680524, "uuid": "6dfdbf3a-d6ed-4d78-a3ad-a0f40102cf4e", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680524, "uuid": "bc5fb777-183f-4f97-b332-80ecc0dc06e9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680524, "uuid": "ed62f252-0a1f-4fe7-9c04-d33b20db444f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680524, "uuid": "05247a73-c394-4fb7-ada7-bea7bfdbecbb", "value": "ca1f297e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58823e8c-b17e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620644177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644177, "uuid": "2edffc66-f9f3-4be5-80ac-b6bbb7fa0d00", "comment": "Malware payload (AgentTesla)", "value": "f8528b7af1e2780251c20faac7dd5f15", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644177, "uuid": "df48202f-cbec-470c-9ac5-11b148799459", "comment": "Malware payload (AgentTesla)", "value": "2b3481587107737bb3de429c841ab24d664d592b0de08a87edf09e11e2bd0653", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644177, "uuid": "eca8ca1c-8faa-46d4-98f9-08888e4edd9a", "comment": "Malware payload (AgentTesla)", "value": "d6bfe9995d9003c0bd59d2e9cc09cac8cf96ccae", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644177, "uuid": "d07f2ba4-da6c-4668-8925-93751cd28e07", "comment": "Malware payload (AgentTesla)", "value": "73425930079246fce399a2c3ded62b642f385391d7efd574fa4c1b14d382f417b3f2cb0b598a22778f9ebbe341134627", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644177, "uuid": "dcf376f5-e3a4-4798-aca2-2fca7ab1c871", "value": "1CC42395CB51126C042F6819CD57FF8C8DCF27DA7A2AA4ED7F93A454630ED28206F863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644177, "uuid": "33530ec9-7c03-4774-b44b-79b3de909f29", "value": "12288:HV0FVE0Uv0hHikd5a2A0uIub8oQ1xy2OcTVGqKOB/AjPqMd8:HmHz55ansub81xpBTVGP2oLqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644177, "uuid": "c81680ee-9837-458b-bc6c-dee5dbe59ed0", "value": 579463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644177, "uuid": "d5752c96-5c4e-4f9d-a04b-c4478b4945c7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644177, "uuid": "764047f7-4856-4e79-9dfa-f5c470015609", "value": "03.PROJECT.SPM.05.21.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b71e43-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687691, "uuid": "390fe875-f831-4ad7-b6dc-3aadc66b3faf", "comment": "Malware payload (Dridex)", "value": "fec7579b310a3dd21f0224bd2bf7083b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687691, "uuid": "bc0dad15-82da-43d5-915c-5a30d3b44ac3", "comment": "Malware payload (Dridex)", "value": "2b3fa7cc5b77b0f04ecbc6c82cb0cdc1422aed16f91a42d9ea9651b0a42806e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687691, "uuid": "a55e16e4-494d-494c-acac-97432b2356a7", "comment": "Malware payload (Dridex)", "value": "f28225e56966512741ea92979642e4e54c06d9dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687691, "uuid": "68b01656-a440-411a-b077-8d0f6d2a2ceb", "comment": "Malware payload (Dridex)", "value": "4d9db7b139f91d08141b64b8fb795feefccb9f3b1f695f5e4e017d94958b3115f3d80dab0d0b1ac46fd33a47f7a59857", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687691, "uuid": "8a92b4aa-1dcf-492b-861b-0d74ec579bf0", "value": "1DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687691, "uuid": "e65bab32-389d-45c5-b9f0-331ccfb02cc6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687691, "uuid": "3200e518-277d-4edd-8b0a-9a96df8be62e", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687691, "uuid": "34407239-b0a6-47b2-a530-222304fc017b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687691, "uuid": "2d321aa4-3b58-453a-8ead-a5fac1023136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687691, "uuid": "80ffe907-26e6-437a-8285-4aa3c22571da", "value": "fec7579b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40eba568-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662606, "uuid": "6bc46bab-6239-4973-948d-1327e8f3fa6d", "comment": "Malware payload (Dridex)", "value": "7abe682425be560c79503588eb578704", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662606, "uuid": "54ff2492-6ffe-4e4d-8c63-e501c8a69f75", "comment": "Malware payload (Dridex)", "value": "2c13a0d25e8ddd23673c7665b39b640635c0685bfdae6af751eaf3959f798578", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662606, "uuid": "618d4b57-54a7-4df6-a116-a593620095e3", "comment": "Malware payload (Dridex)", "value": "01bfa45e8eb7f20ce87485a1648a0daede23eba3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662606, "uuid": "4a72f57c-430c-4241-8d43-8e7deb90fffe", "comment": "Malware payload (Dridex)", "value": "cb1f7b2bee7036074f7edddd1ab9ea42d2bc281192f47968f15566885211709538b20b0b7f9ae3d4241b9637d29b815b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662606, "uuid": "cd4f36d3-0c36-441b-9ffe-dd37ab75be26", "value": "98F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662606, "uuid": "dfa9172e-4a5d-45f8-a9c4-bc2a0fb43eff", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662606, "uuid": "bf726fd8-4975-4230-931a-b98a5a1b1d91", "value": "3072:eWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:e42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662606, "uuid": "24b11f50-a576-45d3-a73f-3f393986ab1d", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662606, "uuid": "b35d05bd-86fb-4d69-b4ef-a1b3ba79b531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662606, "uuid": "4f247ab2-d51b-411d-bbc9-517fb50c0644", "value": "7abe6824_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e97d999-b1c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673688, "uuid": "7cb68735-3756-47b5-976f-8b8099e0c695", "comment": "Malware payload (Dridex)", "value": "5565e6b153ea9d154aadc442458600d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673688, "uuid": "a65f1e0f-4969-4543-8936-7904fcd2a587", "comment": "Malware payload (Dridex)", "value": "2ca23f740e3059b9951f61e5473dae0fc69c6fd15721839abfa3f36aa38e090c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673688, "uuid": "6d10ce10-6df5-4ff0-b3f6-7d1be80c23af", "comment": "Malware payload (Dridex)", "value": "3a36f9080fefde43d931ef85aa8c51fd8707ce62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673688, "uuid": "219aa62f-9618-4e0f-95b3-c63388dedc51", "comment": "Malware payload (Dridex)", "value": "1b758e9326cda56d0fa64d81642f695e219f152149c9dd73f233ec833297d6bb25aa1a33e674b6e3ae59cec785bd7b15", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673688, "uuid": "45f5795a-cc4e-4286-8192-ce6895683018", "value": "CBF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673688, "uuid": "eaa731d0-92a2-40f3-94c1-d22362e88fb2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673688, "uuid": "a98b6481-4ac9-43f0-bb33-97171a2fb17e", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673688, "uuid": "36fbd120-9394-4451-ae9e-f74c57bce469", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673688, "uuid": "6800cd54-51b5-41a1-90b6-c2eb18d8009c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673688, "uuid": "979f1487-4746-4107-8231-1f4598cbfef7", "value": "5565e6b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cef76c-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633868, "uuid": "ca1cfde8-f492-49e1-b693-3c5e281c65ab", "comment": "Malware payload (Dridex)", "value": "d23d9bfc1372201dec049a99cb3adcd1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633868, "uuid": "0488c18e-ffc4-4aef-af07-b668bfa6847c", "comment": "Malware payload (Dridex)", "value": "2cfe9ef447f98f888e5b93b22b5c0125e40c4f3c6b984fb7acf707b4af60142d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633868, "uuid": "6ec4e5d4-0883-4544-8744-f408b274d658", "comment": "Malware payload (Dridex)", "value": "d4b96503a578558a1e7c80fc9d047fb694dd336b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633868, "uuid": "59d638e5-f293-4971-b852-4c982b8f9e30", "comment": "Malware payload (Dridex)", "value": "dbde85c3576f1f68fce4986ca6566eb5b33f91306ecd85c7e568d8e6ae63c1b5d83ab0d4bbc26e0fd8f2decbfcf9d4a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633868, "uuid": "fb46fea4-aed8-447a-aa94-991c5a1f4140", "value": "0DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633868, "uuid": "228e0a8f-119a-4401-b589-e92db3eb66c3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633868, "uuid": "deee3d2a-999b-4eaf-8422-bc7bfe7bdce5", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633868, "uuid": "68cdb6a1-e65d-4017-be09-f4c5d0017f0d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633868, "uuid": "284b0c47-5c8e-47ce-ac28-aa86ba9a2e72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633868, "uuid": "6a306597-a939-4fa4-b25a-3dc68330f868", "value": "d23d9bfc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb1bf7b-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620659033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659033, "uuid": "54ba470b-d0e0-41a8-a3b2-121e1fbd9fb9", "comment": "Malware payload (Dridex)", "value": "93525029e3f6dd748b2bed4cc57fab4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659033, "uuid": "bc1f777d-db24-4052-9580-bcc9a7ec1254", "comment": "Malware payload (Dridex)", "value": "2d4b481dea296eaf408a56df169286ea1d95dee1ea444f3a030144fef80eb74d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659033, "uuid": "b4399d49-ec58-4b90-8aa9-541bff3dc2f6", "comment": "Malware payload (Dridex)", "value": "75e81a08297bde57a3489bfaa04a02547e847fb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659033, "uuid": "e7a18851-2067-4b21-8564-deccf326961c", "comment": "Malware payload (Dridex)", "value": "8aa6633ecc68ac7460a0bec3b141890e7533ba2710c457da9e14169a1db53d50d55916430329166cee90b1c066cd2ac3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659033, "uuid": "28e94f07-3611-474b-b132-85eab529c18b", "value": "4CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659033, "uuid": "6d2ed0b7-a989-4eda-83d0-65235736b27e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659033, "uuid": "944b2471-8b31-4c2e-88f8-b70d52a1c698", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620659033, "uuid": "70f1b24f-2020-488d-98fb-8b15e69be28a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620659033, "uuid": "75c3c485-2c1a-41ce-a716-23e9af216316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659033, "uuid": "80708b9c-ad4a-40b5-a162-ab922901fb50", "value": "93525029_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64811a3-b155-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620626779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626779, "uuid": "528a82b4-75f8-4f77-93fd-b18cd61d65d7", "comment": "Malware payload (Dridex)", "value": "5503b1360eb587d41df39221d8845a2b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626779, "uuid": "7a3a0465-9a4a-44b8-8fb5-35cd9bc1aece", "comment": "Malware payload (Dridex)", "value": "2dc42230babb6a1bedf6c32f3533295f262ebe3ec952d60d44b55e8b58e705b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626779, "uuid": "2cadf5b3-69a1-4cf4-aaa6-8d878d00eb2e", "comment": "Malware payload (Dridex)", "value": "44f9a2e9a5de49a5ee3c47698baeda488824f73f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626779, "uuid": "15580130-0aac-48da-9a66-bea0b6b875ec", "comment": "Malware payload (Dridex)", "value": "5c1a401cbe2568f521275d72448f2ba6fcd128712c825d50d03086867375bdb49a52593742d34c69ff2bdb80d8ed0399", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626779, "uuid": "6a75c3b6-872a-4da8-845b-a00f104d5076", "value": "6CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626779, "uuid": "58fa1c83-0b22-4674-884f-85c7da4f3b1b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626779, "uuid": "a69eb551-9003-4e1c-993e-2056c12f9787", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620626779, "uuid": "251ebf32-12b5-419e-9833-3698d508a41c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620626779, "uuid": "05fc06f9-245a-4660-adb2-c81f57bf3825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626779, "uuid": "0e5d16c8-1a85-432b-8f0a-8cccbee9ab64", "value": "5503b136_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ed7874-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620651145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651145, "uuid": "59e925ce-57cd-4072-a354-26e621bd9e12", "comment": "Malware payload (Formbook)", "value": "8de5c116b2cde266b707582ade061a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651145, "uuid": "7f67bd23-4659-48cc-8a54-a297977e7cf8", "comment": "Malware payload (Formbook)", "value": "2efbb8abb0745a78dba6bdd6137619d948b47b352ab95732f00471831f95ad6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651145, "uuid": "357b71d9-eb9c-4e23-8ce8-b9af95360e5c", "comment": "Malware payload (Formbook)", "value": "21a6a11acfcd3c975efacf067d8b9db96072246c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651145, "uuid": "9bd22194-8058-4989-bbbb-1cb9939a53f1", "comment": "Malware payload (Formbook)", "value": "0ff262b873e16838c78beb3ffdb116c450bcb93ce75706d9f268c01348e4fd853e1caf47fb26cb5d2fbbeae2e8b34a23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651145, "uuid": "ee45d99c-3b27-4c8b-9da7-6e444c0fed46", "value": "BEE4AD2C26E44A4DF6BE16BC5C73116082FCA1179916E7594AE06CEC3CB7710FE32E5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651145, "uuid": "efa2ef9e-e056-417c-a1c2-ff50ea0d0c11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651145, "uuid": "adce5ebf-51f7-4b11-8a1e-5fad3bc86b12", "value": "12288:WLfmxOEPGQntLS9iZIdXIJJqdYX6JsdmFxosWxK1PMLyW:5x9xLS9OIdXiJnA5GlxK1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651145, "uuid": "c7693957-7b98-414e-a0f5-cce219d06b7a", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651145, "uuid": "bd036337-45d2-4670-bb97-faf28e932ed0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651145, "uuid": "bbb861f6-242a-4cc7-87af-66c8cf9336f6", "value": "0987654345690987654356787654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf8a65b-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684072, "uuid": "bcd55868-df33-4370-a5a3-e587bde26778", "comment": "Malware payload (Dridex)", "value": "d245fdf9eaf068cedb398434e48ca0c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684072, "uuid": "a6c15acc-6f61-448c-8dea-7bf14e987b3d", "comment": "Malware payload (Dridex)", "value": "2f629a325d99b7ef6245d852436e4fabdbb46c395ac1186fc3c261fdd1f5618e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684072, "uuid": "a55c2eb3-4d03-4bf7-bac4-218674d9beb9", "comment": "Malware payload (Dridex)", "value": "4fc8e8df859c336f166d72bab24582952018337f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684072, "uuid": "5b03202d-eb3f-479c-9bd3-c6e930c77649", "comment": "Malware payload (Dridex)", "value": "90fcbdc11e192a55bae25a3b36592656ce0146dbe69231768ee90c07d3856e136e3517e65bc0e230fac409da71ef9337", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684072, "uuid": "c7346608-5799-45c3-9ffa-461d4e19f18e", "value": "6DF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684072, "uuid": "0fec0bb5-f9cf-41a9-ab8a-d5aceae89e51", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684072, "uuid": "02eaf5dd-1ba7-4123-8c49-1b39d9195369", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684072, "uuid": "faf7fe60-78f3-4532-b026-e1e4b2a857a7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684072, "uuid": "6507c590-4b8d-4c61-bccc-a13f2cc647df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684072, "uuid": "148875e7-8419-49a9-a226-61e4259f61a2", "value": "d245fdf9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee8a7a4-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620633772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633772, "uuid": "5ad8846d-e3a6-410f-8892-64d5bbadc6f2", "comment": "Malware payload (AgentTesla)", "value": "5793e2d68865ef2c7a760013ae37e37e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633772, "uuid": "f194912a-2b18-4eb9-9688-a61f50570b24", "comment": "Malware payload (AgentTesla)", "value": "2fae417868faba34181eb6c15154634377a39ec927d3acb2301816069326213f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633772, "uuid": "28b6a18b-bf7a-4b37-b30f-252fd193358a", "comment": "Malware payload (AgentTesla)", "value": "44f49f4e1138bad84e12a9419d2dfe566ba88fec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633772, "uuid": "d0e85fde-6185-4089-bb9f-ecc8f7d52ef2", "comment": "Malware payload (AgentTesla)", "value": "c11f47016a04dd619abbc3c61a023a29f9ba266318b55be8e28e205b78b3c9a212cd6360d7463606c984ad1e11b0b4e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633772, "uuid": "e6548e12-8bf8-4b6f-96eb-0c9d564bfa6a", "value": "BAF46DFC765465F0E35B5D32A3DF0C0642252270A93BAA0E8B6013BE5A57E173E39D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633772, "uuid": "9865c400-1a07-4345-96bc-31aff167ee8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633772, "uuid": "c365aea9-e192-438b-b319-6248bf64c89d", "value": "12288:TMgH1oLLoS60/K7yh0dGQflLNvB4pBsRSl7Q/itsiBGj:l1oLAdFb5ssRG79tsiBGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633772, "uuid": "9c6e0429-679b-475b-9c4d-d054e066d0c8", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633772, "uuid": "1c37692e-f778-40fd-b0f2-e1c319893bda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633772, "uuid": "9639bfaf-982b-477c-8259-05468b63005a", "value": "5793e2d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9914f29f-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687664, "uuid": "a40f93bd-63f9-4012-ac7b-0270e816fcf1", "comment": "Malware payload (Dridex)", "value": "10d240685b3746b7a13fbf95b6654d19", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687664, "uuid": "b9eb83e6-e727-47f4-8eff-4c34a5e0ab03", "comment": "Malware payload (Dridex)", "value": "2fbcd01b35bc9653b395d641526668a796ce9f5d6224e27747f1c459867ef68c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687664, "uuid": "c4f34496-733a-4aa8-afe3-727c289f7d93", "comment": "Malware payload (Dridex)", "value": "de98b45838db89c64ddb0dcd9017c6296c0cfa67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687664, "uuid": "96b4dd81-e05f-4ced-8fb6-9a33423021fb", "comment": "Malware payload (Dridex)", "value": "14795b91d6927d03e4bb7a4088ea0b0508e11bca24166ec3bbd20c876d85fce56e65c019b318cd460448a0f16f1236e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687664, "uuid": "2f3beb5e-5da5-4d91-80f1-9386315829b4", "value": "8DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687664, "uuid": "93df2a62-55f8-4056-a844-c5e3a018192b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687664, "uuid": "e79ba728-62c5-4e4d-8426-1e73defa40e8", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687664, "uuid": "be16b0d9-f76e-4496-9f1a-8868ed7a1e78", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687664, "uuid": "88d47a86-dabd-4d1b-80ca-7784229d40ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687664, "uuid": "4c01b005-1e07-4e14-b970-4f2a19b234b2", "value": "10d24068_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67f1e7e-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620652039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652039, "uuid": "c4079684-e30b-48c1-830f-4d21c8d86c1d", "comment": "Malware payload (SnakeKeylogger)", "value": "79cc8c0593b05956f1d23ac078fcffca", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652039, "uuid": "bfc09fd3-3bef-436c-8e80-92fbaacf67d7", "comment": "Malware payload (SnakeKeylogger)", "value": "2fefb516bf7d8dbc53e6f8c14bf64de30456b3db13bb90fbd3648af7c8baf956", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652039, "uuid": "9562fb67-a294-46fe-811c-42e100fce55d", "comment": "Malware payload (SnakeKeylogger)", "value": "017e34bea411d1e69802737d95a98af2d50b25f0", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652039, "uuid": "cd223300-a84b-4412-974a-2c5b2396279f", "comment": "Malware payload (SnakeKeylogger)", "value": "5e03f8dad545dedd9176c808d153ceaf98b4f73587a7bdcff32409c38a334f11a857e25788bf47edb38392a4fb982ab6", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652039, "uuid": "723ab537-4561-46fc-9138-f5dcd6fac31c", "value": "B903D157A77B4060D74A0AB3598429CCBA12F4B21C427A263F37E85D69B7B333A27416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652039, "uuid": "76fe0c8c-1fe1-41e0-87dd-a6f4688038d2", "value": "768:qz7cQx4dTVuspEbjrTiLV4fzJsf7/Ov8T/POQQXIGA9+OlQAOTA4P:LVuXfY4fz0dHOcMyNOTAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652039, "uuid": "15f58f1a-9444-4df5-81e9-4beea327899c", "value": 38471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652039, "uuid": "0f957ec9-1017-40cc-a527-4164d18e8a00", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652039, "uuid": "f8faf791-997e-456f-a1a8-79d91f3e25da", "value": "79cc8c05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe198a74-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620650897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650897, "uuid": "2a87e210-0c50-406a-9289-447dbfea17d0", "comment": "Malware payload (Loki)", "value": "4db482186be96b6da86c4ca7414a5aa1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650897, "uuid": "6bbc92f0-cba1-4761-b04b-dcb7693fba06", "comment": "Malware payload (Loki)", "value": "3004c8f1ed37a070c779ef3a55d0302126150ed0a2dc5e17f14f02d2de6a9a3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650897, "uuid": "2b758028-8a3a-40d3-852c-98ae2b20bd92", "comment": "Malware payload (Loki)", "value": "6f4c6ad2ed189e9018db194e26e8ad8d42d89e31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650897, "uuid": "822d22c5-9e77-426d-a0fb-7cf6962e6a6b", "comment": "Malware payload (Loki)", "value": "d706e24bc3901bfd26e56d6693b326cfffbf49ecd8b3fa842be2e400735c0369053a6745d45eeb3d10ca466ec901adcc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650897, "uuid": "ed834f22-985a-4d66-aadd-0ee17515a798", "value": "35B28E3D9B915EEAE3FBA0FC450C3B171299CB2B6A52CE5CBCC90963D62812E5D3055C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650897, "uuid": "d7a94bbc-be5e-4b69-a29a-8de494c452b2", "value": "96:wnKO5/iU5K8R1IaSdjufCq5Qsifepqsay89xVwGugi1/JKr:qv/iUk8RiaSdufhFifepqE6aGuPvKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650897, "uuid": "60d261aa-2892-418f-9e57-0e97d3d89981", "value": 23748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650897, "uuid": "871e5308-411c-4378-91d8-99a16f7c4686", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650897, "uuid": "3cb4e223-9c98-43d6-a043-31d949dd7816", "value": "Proof of Payment.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029028fb-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669802, "uuid": "a95f25f2-7c94-4bae-bb0a-a702b2529d2f", "comment": "Malware payload (Dridex)", "value": "c10d71ada18ed2d653987d0e2d605e33", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669802, "uuid": "21781100-a3eb-4c8e-8766-90008865c662", "comment": "Malware payload (Dridex)", "value": "300c7e2aeebccf7d13a1ca62a991e135cc3e71552da35ff6cc3cb7bfd2c7f768", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669802, "uuid": "f2c0a189-f94f-4b00-a126-3808d9fde243", "comment": "Malware payload (Dridex)", "value": "f53f7bc3f6b833a512267afd92779f895a07bc56", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669802, "uuid": "871b2373-9225-4c8f-991a-930f22cb4bbd", "comment": "Malware payload (Dridex)", "value": "2bbaba9bcaedb72acbb2430e8d5764d2cc7f730e356c7e12e9dfc81a7cefdb0d7386cde13487a1987cf66087a356c476", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669802, "uuid": "6b98701b-e05c-43cb-9382-f407cd01b0a4", "value": "47F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669802, "uuid": "a30e7b4c-4a37-4ef6-9204-8732eda34eda", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669802, "uuid": "ba576d4d-a123-4f31-acf2-dee8880c3ad6", "value": "3072:5/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL0D:zbrE1kvcB74DXZ2MelVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669802, "uuid": "e6537ef0-b5da-4d29-a184-d4b1bba3b09c", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669802, "uuid": "2734f913-914c-459d-9b86-e37ca73c3966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669802, "uuid": "65aa6496-31d6-4cd4-80a9-b49c0a32c2fd", "value": "c10d71ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38488bc-b1b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620667200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667200, "uuid": "87c30478-c1c9-442d-8e16-a9071fb5a11e", "comment": "Malware payload (Dridex)", "value": "5d9f5c048fc1a86ea4b9a6f06e8b3ead", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667200, "uuid": "3b98056a-52ff-433b-aa3a-dde32b29e1fd", "comment": "Malware payload (Dridex)", "value": "303f20c5b48de4c343f3445e9615ec1f4635ead29aaa1c57271334dbaf0a1894", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667200, "uuid": "3bca8ab6-8a33-4551-a33d-6c0787db7bab", "comment": "Malware payload (Dridex)", "value": "8e5e217d30505c2f54eb5c0278358840d54fda13", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667200, "uuid": "c662971e-9dc1-4811-b72c-3ac2187a6225", "comment": "Malware payload (Dridex)", "value": "3244f95d8531faa18911abadefcc69db4ce43fcdc608aef13c35388a5b51d71800140f54d435240339332cb0296b7880", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667200, "uuid": "6db848da-c311-4f76-b844-287b577bcf27", "value": "F006331784F1B92CDFA520381A784632B08266B5F7FB5D97F550B3F4B9A8F4A24410BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667200, "uuid": "961d9f14-6aac-47a8-9041-3213f0bafd94", "value": "98304:PTfqPWF4mvMfggvkLvKiuHGw++8IqBLM7xCdsOt1:PTCPa4m2gg8LaHGwcI+MNCdhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667200, "uuid": "ef1e018d-d397-4f6f-af1c-6417d2489767", "value": 3987238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667200, "uuid": "4fa03f6d-ee02-43cf-9674-0d407f313f20", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667200, "uuid": "e09c6579-c119-4043-8b8d-ea0327b4db6a", "value": "export of check 209162.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05e97b3-b158-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620628111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628111, "uuid": "60783075-b974-4627-ab41-9bcc980df1dd", "comment": "Malware payload (SnakeKeylogger)", "value": "e3bc1c6e272905fd1b2f3f097ec59b91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628111, "uuid": "1314ff57-c055-4dea-b170-389a03d2187e", "comment": "Malware payload (SnakeKeylogger)", "value": "305b2ca545df92ff52219e0bd056099cf603aa4db483e11117b3373e0617fae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628111, "uuid": "80d5d527-df7e-4de5-be83-fbad1e3d6145", "comment": "Malware payload (SnakeKeylogger)", "value": "988ee9b57119da15f185b13720a3bea4fc2c3666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628111, "uuid": "28b915e6-71dd-40fd-a7de-666ac39c9203", "comment": "Malware payload (SnakeKeylogger)", "value": "2a025f9f0c9f45dfec9e3a7150e8f3d53210a96bc8db6ae532302c3fc0781c0a3dcc3352293208fd4a1b78d17ab27aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628111, "uuid": "aa1bcaa3-e23f-4a74-b46c-223277c17d07", "value": "09F4DF2037D8AA58E0BF97761970C54463F2BA17D322C65E6DDD904E2E32782C7B2B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628111, "uuid": "fd9a4232-4c8e-4527-b8d0-4a1ea69c88f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628111, "uuid": "463606b6-c464-4bd2-9450-a25d947d20c1", "value": "12288:2cbwN1VeXMtBVw1hhhuLVdSXRqNEaj4LeLbqWgdFdTLT3jbbtTtWg:27VeXMPGhhhmVIRqNTj4MbqWghLTnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628111, "uuid": "72c30df9-b815-4b48-b027-7850f99f3fcc", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628111, "uuid": "57cadb8a-97b3-44ce-9084-4c6d5ea56f0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628111, "uuid": "d934a215-c8e4-4a4c-9598-86a19f663360", "value": "Updated Order list -804333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b10f138-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658865, "uuid": "6a9863bd-65eb-48f1-a095-aa0556091c65", "comment": "Malware payload (Dridex)", "value": "36319a408790425c797678263bda9f9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658865, "uuid": "d371d834-a31b-4d0a-80c4-f93c7b32a993", "comment": "Malware payload (Dridex)", "value": "308bfadfde618ab1ac439e718014fdea363d2701386085f8286424a160e8654e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658865, "uuid": "89e16cd5-ffd6-4e40-aad9-c2e681fe25c1", "comment": "Malware payload (Dridex)", "value": "51d16e4bc6c23ea311153c675f856b2573ae39e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658865, "uuid": "e3626620-0d71-43ea-949b-de9d758fc5ec", "comment": "Malware payload (Dridex)", "value": "1bd27797c7427f34d002a58e94bdf90937acd35a893621f7b9d0a803cf7f8ddf1dae7241c169173145974699fd9803ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658865, "uuid": "63858ef9-9acc-416c-aff2-767fd55b2e1f", "value": "63F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658865, "uuid": "14f504e5-30bd-4bd2-9884-30b05040cf64", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658865, "uuid": "26a64b3e-0687-4e72-add7-4f1262b65ca8", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658865, "uuid": "69aaf968-afef-4fc6-8ef5-2d3994dc77b5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658865, "uuid": "d164da70-456a-4f97-bb95-5aa24a69f6ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658865, "uuid": "f8a70557-c59d-4b49-a585-6f41a57fc29b", "value": "36319a40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd3939b-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628321, "uuid": "69db12cd-d89c-45a5-b1b2-bf23f3421a48", "comment": "Malware payload (AgentTesla)", "value": "f4d9101fe1deff510e68c39f38b71b09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628321, "uuid": "04c79b3e-bccc-4ea4-9b20-a6f681a16c8d", "comment": "Malware payload (AgentTesla)", "value": "30a8c0df00327395c8b1beef758c41cc14a6c93b08b06d9bbd7436387c699222", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628321, "uuid": "460a0016-75f0-4c3c-b870-549c85b55862", "comment": "Malware payload (AgentTesla)", "value": "807645b64bb1dee8361df2f43da8e7fffa0c35ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628321, "uuid": "9bbe7d79-f602-446a-b558-cff43f0a6398", "comment": "Malware payload (AgentTesla)", "value": "9503a5feabddcf222bab2b51b8e9ee050ab0bc99af7f27f59e8a6c9c95e35e36376ab725a8a55ebd922b60e450e347ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628321, "uuid": "b4ce1d86-65a5-4090-80df-4f0c6b8ae949", "value": "B8056BAC725459F1D36B1E7263DF1C0643252274643BE90E8B6013FE5A63F173E39A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628321, "uuid": "6e2555c9-3a6b-4a04-80f0-54364d9aea49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628321, "uuid": "b8e1ff3f-d5d0-4956-a247-b6a09efdbb93", "value": "12288:KEL567uLQoLLoS60/K7yh0YpKyDaM3jTg6250SPxVOGwRVvjtLG8O2:/567uLQoLA3yD9Tg660SPvO5tLGZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628321, "uuid": "6d6e3ad8-d7a1-4f47-bbe5-5cebfd8ee1b0", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628321, "uuid": "a3cb2917-4d8b-4abf-9de9-60baf898bbd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628321, "uuid": "3e3d925b-0967-4b30-8eea-c2d0225679dd", "value": "#CMA-CMG.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36235f8e-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662588, "uuid": "cfbbc7d3-3842-4947-90a0-236ad924e56a", "comment": "Malware payload (Dridex)", "value": "ba6fe5073713af5b81f9264030b5c519", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662588, "uuid": "9ef6d3b8-acf5-49fc-8a6f-da18c2f85312", "comment": "Malware payload (Dridex)", "value": "30b0b9245ad92a9479072a06cfbb9e10e0363d1a3e95418de5145d4e2bf30ed3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662588, "uuid": "da9bafb3-3f17-42bb-93a6-30804ea4d297", "comment": "Malware payload (Dridex)", "value": "2659f63d7064ea75a05b4c9c1063eddb9c02e40f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662588, "uuid": "43b97875-b46e-4115-a0aa-7b5ed8be82e4", "comment": "Malware payload (Dridex)", "value": "1724444b3073f10c3be0b6af92c2209d90200ae22a1104c80b90794efefdd21b233b16f6f96b74ee9419a75c4b32bbda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662588, "uuid": "bfca9cec-afa2-4af1-a3ff-667c20ce3d53", "value": "DBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662588, "uuid": "d1ee94fc-1f2a-4540-bfe5-9defadbcfe1b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662588, "uuid": "b6a56e9b-8592-4710-99e4-ffd45c12bec6", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662588, "uuid": "52359497-5b51-4934-b8ca-e97a3985d6b1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662588, "uuid": "20512cf2-8bb0-4a6c-ace2-50a3ce79c267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662588, "uuid": "3af6808d-72e6-4935-bbf6-fffeab4d506a", "value": "ba6fe507_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0da559-b163-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620632529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632529, "uuid": "7bef3993-a717-4c4e-a29d-18fe1dd5d6ea", "comment": "Malware payload (NanoCore)", "value": "611c93d5f208dd8d3d530449cc5c6050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632529, "uuid": "5910ed8e-1a84-428c-be2b-fb5dadc3f776", "comment": "Malware payload (NanoCore)", "value": "30f55e6b4f6320b18c0f57328be0a9b6b527a20be5bdb9ba8190029cee41783b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632529, "uuid": "585b80f3-271b-494b-a6f4-4fe9767879b9", "comment": "Malware payload (NanoCore)", "value": "4b5f40014945a46e479cdbe29ff51dac9db55d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632529, "uuid": "ba057809-71a6-4c49-a06d-95f21b2a3813", "comment": "Malware payload (NanoCore)", "value": "ae720fb89799af6e343bf7610cc42428f6df34393567425a99e7e34276838a85c22bdd431b4acbd0b3dc35fe2669c79f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632529, "uuid": "ad9383ce-ce87-4b8e-bc2e-ed9dc7bde38f", "value": "A335F03433D8AF42E57EA3354570541007F6B917E721E65E7EE229DA2E72F828223B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632529, "uuid": "add5faac-fc6c-431b-b8a3-6b235d0e76e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632529, "uuid": "9a349257-fd7a-43ab-b1d1-150973c5af8b", "value": "24576:bipbwSWZfgomGV6nvWGI4tjzmp8C6Spi:LSW97V6nvWh4tjnmpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632529, "uuid": "b9915752-313a-435f-9aaa-6a9bb50ad3b7", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632529, "uuid": "a2ce7dc4-b162-42e5-a208-8cfca7468264", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632529, "uuid": "afdcbbb0-2a0b-49e9-80a9-ef4a9fd9b2a2", "value": "611c93d5f208dd8d3d530449cc5c6050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69f0393-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620666266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666266, "uuid": "251d7b62-3790-4451-9256-0f9c54161eec", "comment": "Malware payload", "value": "d5f1c7fb9d53c752c16f640d386874e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666266, "uuid": "c75e39fa-90ff-4e60-8f0b-bdaabf073a9a", "comment": "Malware payload", "value": "3147c764701dfcb545624e3cc7a1cc562dfeaad81f6bd825fd7ab1d527cf0e0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666266, "uuid": "744fb4b6-07e9-4a36-997b-a53e188f3bc4", "comment": "Malware payload", "value": "63172fb5d286196a4f492f7f9bc58c01f35cdd2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666266, "uuid": "5463d05e-92cd-43ae-a503-28efc2f24350", "comment": "Malware payload", "value": "39c76f3b2027a8a50a16b91f2d2a36f41e31c735ba58b56da87e60e3ac35725c67702ec7663e0b77b752bcdb7bbced5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666266, "uuid": "5cbdff5e-0236-4dcf-b9df-c01173e22a98", "value": "07C4F68539BD7527D7B2E924CA019F65A865FC131C9713E16B863F06DE39CC01AEAE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666266, "uuid": "c406e223-280c-4efe-9ac4-2772b45df3b1", "value": "6144:QEfrVgLV4EbVkfoGfk0BfncGXIaRW+mH5rVgLV4EHgvDHNwbgtgr0Q0joG9HpBt:at", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666266, "uuid": "4b27219f-de7a-4745-9036-6155b212c063", "value": 565232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666266, "uuid": "e3e1c9b7-b59a-4ecb-9c18-95b23f1505e7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666266, "uuid": "c667ce87-f33c-4c99-9a0e-0edb4d8fe9c1", "value": "d5f1c7fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f792e3-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651868, "uuid": "9e8f9c67-2c0f-471b-a9a5-7dfa01b776c5", "comment": "Malware payload (AgentTesla)", "value": "15a8db86060368ecc3d8ee13d8a4fa26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651868, "uuid": "a010d056-0572-4554-902f-4c1c7d5bf4c2", "comment": "Malware payload (AgentTesla)", "value": "317fb70fdfcc7fea5356a30bf36a8fffa40d059d783a6d50adee9f7664e24740", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651868, "uuid": "3e287132-cd00-4ece-b4af-23edd437bf35", "comment": "Malware payload (AgentTesla)", "value": "638fafa279282eab933db9e2e99a2f7799359db6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651868, "uuid": "26008613-26bd-4808-856d-a22d7a7d97cd", "comment": "Malware payload (AgentTesla)", "value": "3627cfb503cc2aa21ea6b6eb69de85417580aaaac015fc9a0d08b074ab94806910ab48185a74977a5f2a469f0e657cd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651868, "uuid": "86b1f5f1-fc5e-40cc-92bf-c0543a34f5ae", "value": "DBF4CF2133986F55E43EAB396531050013F2BD07D721EA8DBDF679EE4A72F418626B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651868, "uuid": "53ab0db3-4ee9-47d6-ae0e-c0edcdda7378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651868, "uuid": "712d1e41-4d90-4a97-adcc-96745b7993ce", "value": "12288:+572ML1dSijSylMDK1ABWn6pnHlU2mDfDrJ:+B261lM+ABW6wTDfDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651868, "uuid": "cdceff5c-fcf9-4395-aa3b-94c6aedf366d", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651868, "uuid": "90dd58e9-d287-421f-90f0-22fcbe40b2f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651868, "uuid": "699558e3-d352-4bfb-824a-74d108b341ca", "value": "15a8db86060368ecc3d8ee13d8a4fa26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32632c9-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669777, "uuid": "445ac099-5f79-4555-a85b-ea595cf1c5b2", "comment": "Malware payload (Dridex)", "value": "061a6278693b86c22080e4050ac0aacb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669777, "uuid": "afad3cea-15a8-487f-94f3-62f5733444b7", "comment": "Malware payload (Dridex)", "value": "31dbf658bf3b60a4913e3f81ab36c143f75e4519ffc84cf7f5dd2c048c4948f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669777, "uuid": "1ad1837a-0087-41cf-87c5-7711e9aabdbf", "comment": "Malware payload (Dridex)", "value": "5459136a99bf970472df3d807ebbab4603116e98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669777, "uuid": "2f122d17-c45b-4906-bfbf-0e83f65aa75d", "comment": "Malware payload (Dridex)", "value": "4984da017e89447aab868fb1b686df4a6bfbac953781518d77f5d9c61a2d358f2b343e177ab0cdd469da6c95553e8595", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669777, "uuid": "18a48afa-7fb1-4934-a3de-9956b41b7882", "value": "B3F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669777, "uuid": "375d9f81-f77c-48ef-a11e-5465528a5308", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669777, "uuid": "c43f0d3e-66f7-4e61-872c-e880f94aa843", "value": "3072:M/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:2brE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669777, "uuid": "c6754eb7-4fe1-4517-baca-713bda3e7f3f", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669777, "uuid": "5be89f3b-7d10-4589-a294-4e3b56aa508a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669777, "uuid": "351b0a61-a76c-46f8-bcf8-c3ff9ae0576e", "value": "061a6278_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43da472-b161-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620631983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631983, "uuid": "aab0cb1b-f903-4846-8f9d-9cd3c84f8a4a", "comment": "Malware payload (ArkeiStealer)", "value": "6305401de6bc31cd537cceab750b8394", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631983, "uuid": "2e57aeaa-315b-4053-b968-50bfaecae312", "comment": "Malware payload (ArkeiStealer)", "value": "31f1ff5083de27575ae62c62db9135a43bde87a038defcd554600333870c9395", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631983, "uuid": "44f7bffc-8b7f-4887-861c-ea4aea56a5c0", "comment": "Malware payload (ArkeiStealer)", "value": "842f1c8618e3131b7861e2d120ea9f420268abe3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631983, "uuid": "195e27f7-6a53-4582-8ed4-4c9508f3ff70", "comment": "Malware payload (ArkeiStealer)", "value": "e75205d8331911a2d1b2819712b3f09f382d5986ad2e321b092610cab261abd7d463477c3dbfe676b26003bc0033cd15", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631983, "uuid": "d832dc77-842d-481b-b577-056da2787b02", "value": "73E4F0217EA1C032DCB5A4754525C7B9CE6EB43106665ACB6BC60FB8DF282C17B3D70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631983, "uuid": "7a81847a-de75-43c5-a234-638a295b69ad", "value": "3e9921d2f80fae5845191c15182956a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631983, "uuid": "916ca7ee-8dc4-4548-9d88-9ad2c78df92c", "value": "12288:E++9Fq2o/BlOYsdg2s34FzEARoVq08t1nYJpoMjCg6tCXFcUZx8:EhG//GPzToxL/r6sXFcUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620631983, "uuid": "f57aa5e6-d2d3-4df7-be87-f7d0afdd8b32", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620631983, "uuid": "e46db15f-99cd-4889-8ab9-91706fb94fbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631983, "uuid": "41210df6-d00a-4a28-bf2d-8ac30a52903d", "value": "6305401de6bc31cd537cceab750b8394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a40bb3-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620655362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655362, "uuid": "b832edf5-b278-4f16-858d-e459f001b83e", "comment": "Malware payload (Formbook)", "value": "1939130a95b16662cea59b8812f9c505", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655362, "uuid": "feeaf0d3-6527-499f-bd4c-ae574abd2e56", "comment": "Malware payload (Formbook)", "value": "320dab87aef07c03720923504dd0506f7d3e67de57b0067ebf0694966982db89", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655362, "uuid": "f08ec4c8-2dae-4604-8eec-8a9b87340c9e", "comment": "Malware payload (Formbook)", "value": "f4103a530615a7c5ae8e712dad07f750ceba9b9a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655362, "uuid": "8bc3560f-a8d6-4c03-985f-2b2c5ae646ee", "comment": "Malware payload (Formbook)", "value": "fa59696e26b4212d36e658c5901dcf3be347ea9b389765e2a51ee28f8fbfd2d2a2af39fedad918107be67600b381fd34", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655362, "uuid": "19a0f44b-845f-4592-9fa9-9e4e290ff3db", "value": "87F4BD2C6AE99671D6FE16BC9071116087F9A00F6907F35D0AB0ECED3D77310DA0DA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655362, "uuid": "e7f75618-a5ec-4c15-9f18-9ce0258ec5ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655362, "uuid": "d849e82c-b697-45c5-b2f0-1e4c3f426ced", "value": "12288:BAxLx/3ABlxjBEnoVw5cRYba71yejIDTCq+7:kORO2IKYdeGTCqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655362, "uuid": "39a16f66-776c-4381-a9a8-14b1345abe05", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655362, "uuid": "d72b71e9-0212-4bc1-b907-f3e1b26cb82e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655362, "uuid": "bb242a80-27e0-48f9-beb0-a3be24c29bce", "value": "1939130a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53cc755a-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651900, "uuid": "46e020e4-646a-45b7-9125-8711c1d2c8d0", "comment": "Malware payload (AgentTesla)", "value": "945e773e8266467d6dd738d40eb6b4a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651900, "uuid": "45e5053b-014e-4a90-85e9-ba5f957a02e9", "comment": "Malware payload (AgentTesla)", "value": "3218979f7eb74c99c68f2f4d118720da809f68ac0563214f664701aa141dfc29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651900, "uuid": "268a7080-539d-4d85-a493-e40e5893c12c", "comment": "Malware payload (AgentTesla)", "value": "09c491ae55eb33c09e1210fb26af2225922d00cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651900, "uuid": "ccae02b6-a8d9-4bb2-976e-74a9b34e2a31", "comment": "Malware payload (AgentTesla)", "value": "bc60d36c07a60d87f93a0b8f1e4cc08adc0c7d1444780d43912bdd7510fdbdd208e93593173c13ca94cdae569b06c90e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651900, "uuid": "e968b57b-eed9-452a-a4b6-33c70a8fbc41", "value": "4CF4CF653398AF56D83EA7391470140023F2BE07DB32E94D7DE6B4DE4A72F418626B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651900, "uuid": "0c4741f9-1590-4a88-868f-8e4eeccac8aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651900, "uuid": "b5ca165b-7e53-4c2f-89b4-00b21f2af0af", "value": "12288:Se6CmI77M2V8sZb4LDhqV5OaZLyPs/Dr0Yfpau6snNn0qbS3S8771wEmWb:77RbuqVys/Dyu6sNd+C0Zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651900, "uuid": "59e0e71a-9dd5-47d1-a5ad-ded28907d548", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651900, "uuid": "0d795263-cb67-403b-bc3f-ce4a1b07c5e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651900, "uuid": "ec117ff6-5636-4a91-82f4-36fe71f80390", "value": "945e773e8266467d6dd738d40eb6b4a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d09618-b1c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673680, "uuid": "05772104-407d-4832-9c0e-ffaae6287b02", "comment": "Malware payload (Dridex)", "value": "a7300361bcdd5116f083ff618aa6ae2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673680, "uuid": "d88d36bb-e3a5-4fda-8618-e6c85fd635a3", "comment": "Malware payload (Dridex)", "value": "3241c672e2fea234ba6a80af9211f3073bf1c9ea604c811073db6596b2c9622d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673680, "uuid": "aacbd950-d712-473e-b093-880a4462efc7", "comment": "Malware payload (Dridex)", "value": "8539d4ddffcc702bdc78e635f9a857feb82f79fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673680, "uuid": "d09a3ef3-81e1-4389-b58a-7e3d2ba522c7", "comment": "Malware payload (Dridex)", "value": "de4511f605f886452d31532c3060b34812d7a098962812c3be9c1d6e995c3faf5fbfbb0f65874d9ab00fdd44064d37fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673680, "uuid": "0f8de915-ba61-43e5-b0bc-496219985228", "value": "93F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86DA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673680, "uuid": "f421b016-0173-40d0-8d4b-5d331d93dddf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673680, "uuid": "6abb35de-5e82-4a8f-b073-6bcfcaeb0dab", "value": "3072:yIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673680, "uuid": "df3577b4-b4ef-4c91-b051-404c6ea16184", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673680, "uuid": "c3fc200d-f5b9-4927-baa0-e947e9f41e70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673680, "uuid": "278631b5-edb8-4ea2-b0e1-d0302c5702b0", "value": "a7300361_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aab495a-b123-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620605016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605016, "uuid": "1120a62e-3774-4902-94f2-cc4c369bb2c9", "comment": "Malware payload (Dridex)", "value": "c7e6af3838c21fb8042dbdfadea82d88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605016, "uuid": "d1410ebc-947f-4f87-a549-53900afbc5ab", "comment": "Malware payload (Dridex)", "value": "3258baaa9e2a444a91f88b37833d01e0013eb1d1a5b4a7b986486acda535e91e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605016, "uuid": "672a96f4-8f23-4ded-96e6-7aae75fa7f90", "comment": "Malware payload (Dridex)", "value": "cbf75194807c979280186498d002b08d8ffeac4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605016, "uuid": "63e1fc01-036d-4076-833d-e8f0efa016d4", "comment": "Malware payload (Dridex)", "value": "0c8b155eb89a73606698ba3381d3aacc4db2bc072d73748f9e6ae9e779a05a76540fbe55d7071ee024b37ec014684c2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605016, "uuid": "edbde9d2-9f7a-4792-9eb8-c68736bcec32", "value": "ADF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605016, "uuid": "5c35a064-5c76-4ada-bfb6-d9eee70c29b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605016, "uuid": "c709e317-21e3-4036-9935-4b48ac469dad", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620605016, "uuid": "2439a5c8-9b2e-43a3-8323-3faa10decf48", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620605016, "uuid": "f627469a-279e-47ea-a943-6a35e202b5c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605016, "uuid": "fba018c8-88cb-495a-8948-4ad524d83d20", "value": "c7e6af38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07d8b6d-b17b-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620643009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643009, "uuid": "24c9b4ab-57e5-47e4-b7e3-1dddab78e1fe", "comment": "Malware payload (NanoCore)", "value": "d1c848df3ee2992d2034a58898a1a4c2", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643009, "uuid": "26ddc54a-e9bc-4bfd-b907-a94525c35078", "comment": "Malware payload (NanoCore)", "value": "325a417655bb8b9a07cdd5650bd004e066ed3ea01474338494a7b8023520ed43", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643009, "uuid": "7ca4c879-1f9f-4abb-bc22-d0481083e0b0", "comment": "Malware payload (NanoCore)", "value": "206e4300988ba2b02a2b31731349c61d00cd2c00", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643009, "uuid": "68a27b1e-78d9-4f0a-a245-f57dd5c5c81b", "comment": "Malware payload (NanoCore)", "value": "6e76b25716c26dfb48c5f5f945493045660712ac20ccccf97e9773ad07be51b9ef071134e947184f56db1ad70db7815b", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643009, "uuid": "35683e4b-b880-4c98-bc56-ae769d72753e", "value": "5715BE223ADCA6DAE0BF4BB51D20F348A3B5BE128621CE0D6D95F14D197164582F373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643009, "uuid": "d7c3152e-c2e2-4fd6-8860-ecb0e74975bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643009, "uuid": "17631037-9221-419f-b3ef-000eb056ef6c", "value": "12288:hrl0F5XJrBVw5hhhyiEWsENQgarJicJMWiNN3BO7GSuu18u4eFn62P6xKm:hm5XJV6hhhyBbAWJiOkn3BO7WunFpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620643009, "uuid": "602efa41-ad05-4495-b876-0687f4e08310", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620643009, "uuid": "6f8d7506-d659-46ee-bf3d-0213490ec705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643009, "uuid": "3183a5d7-2423-468d-b528-7104b8b9c276", "value": "Invoice_orderYscFwfO1peuGl0w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee8e7bd-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669179, "uuid": "d48f24d3-d528-48f2-8f61-90a2fbe2a642", "comment": "Malware payload (Dridex)", "value": "6c04f16f199c7422d5c9a2eeaa4d0b0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669179, "uuid": "e087c311-e6a2-40bd-8ed2-539572afc499", "comment": "Malware payload (Dridex)", "value": "325f4e7f9a72791eeca1871f572a87492204f568d431b8318ce6749f446f6cee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669179, "uuid": "309a38be-7623-4984-a762-527ffab0f4ea", "comment": "Malware payload (Dridex)", "value": "1b1e93b20d2ca7d0321c419fd46c96b5c21982cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669179, "uuid": "0c538a61-e602-4ce7-8f90-3972579afc88", "comment": "Malware payload (Dridex)", "value": "f965a9698727951932d1d08140780cdacb24b87745c5b1db44bc6b29fbbd690cd6303ba5871016134f9bc7797872b613", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669179, "uuid": "36cbb58e-a7e4-49e5-acd2-811af53f3071", "value": "C774239EA8B8CD28FC761636C33D4EAF7D4324B664923A54EB2660CC274BD456CCD097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669179, "uuid": "27420d57-5976-41cb-b442-b3576f49d415", "value": "6144:pPVj0YqLi+4lbb5ZIphIOaEHPHbm42HcixTYpYsjfWOKMbRnkRnwYEz+uKOIcG:fLjtZdZEIhEHPHb+HrEzuwRkR4z+uKOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669179, "uuid": "2933bfab-5863-4a92-9a1d-b02e51880775", "value": 369689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669179, "uuid": "1da722ba-bbff-453a-8c20-d6fbd8a37b8d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669179, "uuid": "f1b89782-ff9c-4221-82e7-3a8e3394d7b8", "value": "generated document 98208.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6057032-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658937, "uuid": "e6c710da-8b60-49a1-88e9-8b89d56a71c9", "comment": "Malware payload (Dridex)", "value": "32a1084d245e987d05120642b53627fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658937, "uuid": "d03ecacb-683d-45a4-9254-79b6feda77e1", "comment": "Malware payload (Dridex)", "value": "3277b291849f0571b1e46584a396a4bdcd208d57e43674b40a336ee290fe0461", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658937, "uuid": "97889256-0626-450d-9b8a-9f9f823b480c", "comment": "Malware payload (Dridex)", "value": "85cf2535cc2c4c099f9ff47626a27d75a04504a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658937, "uuid": "94f77134-5f59-40d4-9d50-f35d2f6769ca", "comment": "Malware payload (Dridex)", "value": "7402d5c4694c895699eaf7c6155ed4baef0a50f97a21c17d51359e40f97fcf8cd7edc2fa792b3db8b088d18e8476bcb6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658937, "uuid": "6ce0759f-8821-4966-b224-7fd0668ca67d", "value": "06F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658937, "uuid": "661c3982-c4f1-4d49-a8e6-c228d5fea998", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658937, "uuid": "ddba987a-3a90-4284-b987-999f5ce42b91", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658937, "uuid": "ee003cd2-5820-4c3f-b3be-149ab503ae7a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658937, "uuid": "3b8bb5ed-8ef1-4020-a9ee-71da2a14e894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658937, "uuid": "e790a367-82d0-4d4d-8fe3-5cc6e0a6ff7d", "value": "32a1084d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cce2b8f-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630735, "uuid": "348f57fa-8714-43d8-afa1-773e70d2648b", "comment": "Malware payload (AgentTesla)", "value": "6c7c48775e80dbdaaa4c1e0dc6e2b1ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630735, "uuid": "4b87d8f9-5d3e-4c21-9ff4-b04b9085c841", "comment": "Malware payload (AgentTesla)", "value": "32a7b8dd7543335f47f3e2500802ca043c0c3adea3659226b842d8a28ba04ac6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630735, "uuid": "6b0a1d34-a7f5-44f1-8d78-562a49501601", "comment": "Malware payload (AgentTesla)", "value": "537dd8036883ff3ad8b6db8027016d9fb69f70f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630735, "uuid": "e500b9be-2abf-47c9-ad22-d98403fb544e", "comment": "Malware payload (AgentTesla)", "value": "fb2ce60fb68d44ea8f986aeb7d77cf6816560ab3c2bb4ce7162ad343a968bb9e7f1b5a3a6e25a27fff511da1dbcc05c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630735, "uuid": "b8fe609e-5751-4d59-8510-caa71d14fc9b", "value": "C3F4CF653388AF55E83EA7391434040053F2B907D722EA8D7DF6B8DE1AB2F518527B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630735, "uuid": "10a6bb15-3f7b-4cf1-9075-a5c2b26818d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630735, "uuid": "6a37da0b-0f4f-485c-9588-fb1341bab567", "value": "12288:BpEg75MODIMFZdChCHq4QsHESYVdZ9+Edb:B75DcMDdkPRsHEfdZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630735, "uuid": "d6551332-33ea-41b8-8d53-4795ecf11a43", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630735, "uuid": "0b85b51a-4fd7-4f2d-8769-1a41bd428d3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630735, "uuid": "5315b65c-f6b5-4544-9b59-32ddd8466ccb", "value": "Consignment Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76001ea6-b15c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620629623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629623, "uuid": "b0555cf0-f4bc-418f-9364-4a3645e2327a", "comment": "Malware payload (Formbook)", "value": "d6b7f35f001a4c2000a1127b2b873469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629623, "uuid": "2abbf3d9-acef-464e-b203-e0410516851d", "comment": "Malware payload (Formbook)", "value": "32ea10b6bd6642663614f79f2332c45d76772db89bc7efb5d4df3bb21d9c3562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629623, "uuid": "1e91fcfa-2f6f-46f4-8276-98add81c5490", "comment": "Malware payload (Formbook)", "value": "5741cd439b968f93d89c1bdf5b56096c57ac214e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629623, "uuid": "20d37000-7111-4d8f-88ef-8f0dae4f5852", "comment": "Malware payload (Formbook)", "value": "262125b0337ee7c5ec225e3b41c548df519cfab24973eaf20cb6b07bf251cbb86d2454f4c853e23a11aae98d0d5bb2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629623, "uuid": "ce1764eb-6bb7-4fad-849f-07e35ca1e8f9", "value": "8C24125161B0D0B7D2F507711DBAED79A3E28124323E5D1BC7A41BDEBE03A43871E292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629623, "uuid": "3cc417d3-45f7-48b9-8ff6-eb8892f3270b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629623, "uuid": "3dccf731-192c-424b-be6b-a0acc2e5650a", "value": "3072:Lf1BDZ0kVB67Duw9AMc+bWfjVKIqt70inBqvbApI3DAAo25sfg/nZfVTNf3G6r+z:L9X0GgWx2wPvsaAFg/t/msmQs3WDUwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629623, "uuid": "11c913e2-84b9-4dea-93e7-3e0fd25483bf", "value": 210943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629623, "uuid": "439223fa-5532-4a9d-826d-027e75b397d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629623, "uuid": "9e582f3e-2f1b-4198-a979-75543093b497", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8a4ed6-b15c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629772, "uuid": "70b6466d-7e65-4869-8ebc-6d90c88e3991", "comment": "Malware payload (AgentTesla)", "value": "3f255708862b2342dae07bfe8c7a0de5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629772, "uuid": "1fbf1dd4-d62d-4c55-82c4-4da5378c7928", "comment": "Malware payload (AgentTesla)", "value": "3303026871e51adf4ce267404c9728747f5a7077320264314fdd31bddfb5d9aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629772, "uuid": "692b1bf2-34a6-4e7b-b44e-85f804fa6df0", "comment": "Malware payload (AgentTesla)", "value": "03a028e380ac7713c612f9a2bc2a0b21b4662877", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629772, "uuid": "ee6f16ba-e85f-40db-ae22-9090f26b166f", "comment": "Malware payload (AgentTesla)", "value": "79bbb8ac03fa6f15e1d16f015a8730c43e975dff89a92ff15050d76d99acffcdb0774be0e009d877f67f101b0fb0546f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629772, "uuid": "d5623c41-b312-48ae-8fa9-8c8410927230", "value": "48F4E03027C86A29C3BE0277C01DC58056FAABD55313CA1DDBD455AD3AA630BB73739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629772, "uuid": "46d8a5da-927a-4f20-b0da-4ab7b03056e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629772, "uuid": "7d7b5b26-c61e-49fd-a55a-6e29d509b746", "value": "12288:UoJMBVw1hhhEEdIk1adkT6Tw7PZO5p24fcqUGH+E1TmmGA51q6FXPUkj9Dvwe:gGhhhFdIDdgO2EcqveMGA51pTj9Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629772, "uuid": "e7574c9c-8dd1-4350-b2f2-22849178409f", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629772, "uuid": "e59b9f0e-b3a3-415b-a172-734f9c9e628d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629772, "uuid": "d592803a-b867-489e-8772-67102d053c51", "value": "4Umt5Jw6SGMBy9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6171430e-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620648916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648916, "uuid": "2a2f39ea-f15a-49e4-aef1-9a91e0514292", "comment": "Malware payload (NanoCore)", "value": "50ab414be17f4e03bee8f9c5cee06335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648916, "uuid": "6905f77a-f10c-4c52-95fb-d90a28436aa4", "comment": "Malware payload (NanoCore)", "value": "333b1ae9552e6a65ab7c4edee6677746e801ebed73294795b9057e17a0e284e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648916, "uuid": "a8d0103b-1554-463f-bfd6-27ed6e63ffd6", "comment": "Malware payload (NanoCore)", "value": "d0def6e40e7858a1b8c46d46f24a6b29499c7c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648916, "uuid": "513dfe47-1a4f-44d3-a706-b07dd2ed28aa", "comment": "Malware payload (NanoCore)", "value": "3e2983d68c464c8e5965582c6b3e8b534b2ecc8a9a93a8de88f91e89abfb8de44baf5e4c371fd43851c9781a7b675018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648916, "uuid": "8cb1e983-f740-494d-aa21-947bda68e395", "value": "62156BD8AE9AB90ED56E6778702041FCC3E72D1204CEE7EA0BD3FCDA5B6721185416C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648916, "uuid": "9a976ad9-87ef-4def-a049-8d90292dff41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648916, "uuid": "bb700494-ab5d-49a6-a650-4bb0e5b907b7", "value": "24576:0lO/1fBDLs8i4Y77/21nEgEcJCHwpKCfLc:0s/1pRY77/Lnc8HwlLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648916, "uuid": "62c043dc-ec2d-413e-82f0-92fd8aa801c9", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648916, "uuid": "2d7ba12a-0e5b-462a-9b55-61c390cb66cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648916, "uuid": "0dd02361-07e8-4ba1-b74a-13ae0ab84d84", "value": "Devizni izvod za partiju 0050100073053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86090ce1-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620630509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630509, "uuid": "e0d67f7b-bee7-41e1-bc54-66890e3ea551", "comment": "Malware payload", "value": "c645e3e02294352f9cf3d9c4147bd8ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630509, "uuid": "a6575eef-3f4f-4742-a17f-15a9bc2513a8", "comment": "Malware payload", "value": "3372da1316a3ca49c5c7fcd6c56ed0528f83e71e4ab2e53ae4c2ae9c163ce0f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630509, "uuid": "369250b6-8cc1-44c3-927f-a6f43af8a463", "comment": "Malware payload", "value": "a04e45467aa3aace509f47e2e6024ca16b1a071e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630509, "uuid": "b2dd7e1f-fa98-403c-8c14-499f390aaf64", "comment": "Malware payload", "value": "467a7f1da5855d336dae25293eff84e3f165a8379442539657f4c7953d463c5c43e83b2b8e3d9deaac22aa44a0a3cd53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630509, "uuid": "3e44a0f6-a91a-4582-9161-7eb0759f975c", "value": "88F1B522F7B48535D4B6AB781C73E7410266E30866134F0EFEACB21EAF072479A3D851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630509, "uuid": "34873513-ea9e-46c2-bc37-f36ceee362b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630509, "uuid": "503160d1-6a86-4479-9e29-808205880e43", "value": "96:z5VzGRnWAgEb7Vdj9ZwQ/kPcKo31LUQtMeAk16plGZf:zfENxhcPcxFZMi1wGZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630509, "uuid": "1a3f14c8-7c16-4d24-a9bd-505ebfea684c", "value": 7597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630509, "uuid": "788a96ae-5f83-44f8-8bed-e5ac19939523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630509, "uuid": "0bc00675-ac52-4b24-a25c-fb311c6b327f", "value": "090009907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a405053f-b150-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624547, "uuid": "0bd6ab0d-6aa8-4a1b-a85a-6e6c8138f809", "comment": "Malware payload (AgentTesla)", "value": "97f96d9b5d2844d5904250c8f05692d6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624547, "uuid": "f6833ff3-2ae4-4661-9815-f6d9b4bab477", "comment": "Malware payload (AgentTesla)", "value": "3376a022f30971a09ee62e83c43594266417cca59f9a1e4907b20065457ce792", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624547, "uuid": "3a0fcad4-1ac7-4130-b792-53553cf10e38", "comment": "Malware payload (AgentTesla)", "value": "fcf0c52e283a1fb3a935cd8271443d6158332468", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624547, "uuid": "4c8ee02a-facd-4d30-ad0a-aebdc926c305", "comment": "Malware payload (AgentTesla)", "value": "e86ea9006f7f90d3b78e5423720fd89eab936546a3e441396b5305fed48d79c5a9c6aa25568c42071f18d8d28a2046e7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624547, "uuid": "f4eab0fc-41a6-4044-89da-57b05d2b94ea", "value": "BAE43371D91C2E4F9D9687FE050753C1C95B20CE38BD942706F8A1CD2799338AF98EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624547, "uuid": "a010df40-4d89-4870-ab5c-215a6115151b", "value": "12288:JV1MKu0WQ4/rrWj/woRfaDblBP0YjnNeROAeFvHhD6v8zh:1MokWjIohafHP0YjkPC4v8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624547, "uuid": "f23327cd-e77f-423d-8736-73cbf750ccdb", "value": 669855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624547, "uuid": "75910db4-42e9-49c2-b038-cafa3e3656c3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624547, "uuid": "b2705e0b-e42c-4972-afab-4aac19148e8a", "value": "LPO-6809.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa66650-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669019, "uuid": "3c920b27-02ee-415d-b68a-e2e329d48546", "comment": "Malware payload (Dridex)", "value": "f0dfc62ce0b3f515ad42a65e67907907", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669019, "uuid": "53972b9a-946c-4ffd-871b-dbc39fd86ec9", "comment": "Malware payload (Dridex)", "value": "3399e3a509e621b0f868f0a5ee0ad34abd9e0b3706189092ff62e132b4a9e8cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669019, "uuid": "ef9f08cd-1927-4fea-8c63-a209df9a477b", "comment": "Malware payload (Dridex)", "value": "440cbb32337706dbb99468fb64a0576b78b078a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669019, "uuid": "9ee0d3b4-b380-4b11-93f9-0ac74300b93c", "comment": "Malware payload (Dridex)", "value": "36d6bf1ecda5509b687fa34251d6766e171844a908459365987d2db327de241b0c21c94e6300bf919fcfb5133e3101dc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669019, "uuid": "26b728b6-52d6-4f61-9bc8-4d11e5948f74", "value": "0C0633326024D1E4FDE3B97BF2F72BDC9B47DA4D8644BEE12203A484284796B2E430D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669019, "uuid": "3df8462a-a962-40e9-8da8-f08f39e16a1d", "value": "98304:PQuJGA/w6Vq8QhkrGYlNcorgwvQ/CPrQEb6CcOm0E3:PQqG6Vq/YGan0waCDVbqOmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669019, "uuid": "022c9bd3-b720-4e72-99be-87f0486c273c", "value": 3768733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669019, "uuid": "f4d2dba8-4005-4f8b-b2f0-b68948821535", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669019, "uuid": "01f52324-d699-401e-8190-e17014cb5f68", "value": "copy of invoice 4347.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36458b53-b14d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620623074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623074, "uuid": "78d23645-7d30-453d-b129-f46a49924d4f", "comment": "Malware payload (Dridex)", "value": "400ae2635f27f04f88a76f1b508e0a15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623074, "uuid": "9ff04c92-1d35-4fa6-b87e-4023a4b28bcc", "comment": "Malware payload (Dridex)", "value": "33ced08c199b488f86ce04a205dcde574a60fbbd6d31c61cd889354fcd0d3622", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623074, "uuid": "f1e8a710-7aea-43a3-b964-314015dda66e", "comment": "Malware payload (Dridex)", "value": "f69110daf5936d53de98295250a85534cb18651f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623074, "uuid": "86a39ad6-dbf0-43a5-be59-034b524c5725", "comment": "Malware payload (Dridex)", "value": "5a4364382571ce4b5a9f2abc265ea34b5ec028f21b8c975b16176d385720803c5ba77fa5dd21479a3851acf378fbaea3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623074, "uuid": "1fac4c65-0715-41c6-8ebb-27a75848c144", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623074, "uuid": "33b25226-1174-4424-80eb-8d7d613889ff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623074, "uuid": "0eceaaf7-a9a1-467e-b846-753933b2abcb", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620623074, "uuid": "03bb626a-adea-4a5e-b089-be4719cec5c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620623074, "uuid": "036af88a-84ff-4766-94b6-0bea95df49e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623074, "uuid": "ca243150-1725-48d9-925d-0d18b222366b", "value": "400ae263_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e374d771-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673616, "uuid": "768a8169-bf41-4446-b774-98e800d807d0", "comment": "Malware payload (Dridex)", "value": "5c2664d4df587d8e429f01216efc3ed1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673616, "uuid": "8e7b3b84-5293-474e-98c1-f1ae5dbc6f18", "comment": "Malware payload (Dridex)", "value": "33d858fbdfd6e58337a9c1b244907bd19febcad44466b8d18d6a38be1cd6088b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673616, "uuid": "0eb0d261-d1dc-4f6f-a506-40bea16b3462", "comment": "Malware payload (Dridex)", "value": "8b2d55c91a3a8a22677545c98171751b259a8631", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673616, "uuid": "3bc339e7-c834-4fa2-8588-cb1fa663efa7", "comment": "Malware payload (Dridex)", "value": "c4062f60a46a34a039ab796f6373be6885f9fa9a74761cbc6c708d5ba7cfaf458fb5be5f29766b274f35430197f99c71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673616, "uuid": "858695ed-e145-4edd-9c14-aa906f7dd13c", "value": "9EF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673616, "uuid": "24627efd-ac6d-49e8-8f9b-c9ed9f860cbd", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673616, "uuid": "e33d429f-0181-4113-8bef-e91e40eb7445", "value": "3072:tesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:Z4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673616, "uuid": "7463c4dd-0735-4ea7-ab88-a0a2da68af68", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673616, "uuid": "bed72795-bfcb-42f0-b513-4c8285b5ea4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673616, "uuid": "39eb5df5-6ca1-4bf9-8951-70a58a5f8eed", "value": "5c2664d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74217372-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651954, "uuid": "59f5da94-0fe6-4033-85f7-06db8ba75c6a", "comment": "Malware payload (AgentTesla)", "value": "3ba367bb53bc5ad7c0e8d7f5a9d33532", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651954, "uuid": "182d9b33-1c3f-48a6-9c36-039c2a3febd8", "comment": "Malware payload (AgentTesla)", "value": "33ea02b92678e7c73d8f65dc81d76733fe0ce94b9c9b22ebe216132a0986436f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651954, "uuid": "8d362c9f-2e4d-4769-a37a-5b514df73700", "comment": "Malware payload (AgentTesla)", "value": "974c0e32a4480927f27daec1f65ce9bf23ff0e0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651954, "uuid": "c1a7253f-fa28-4e9c-a9d3-4d592cfdfde2", "comment": "Malware payload (AgentTesla)", "value": "1acd818ad18e5c37640f050834225fff45687902ae0a2d996c4bb657faaefe7714eb2e193cb25c845e7b30fe18dddd84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651954, "uuid": "2837a6f5-1fb6-43a2-be92-5af9808fefa6", "value": "24F48D62B2C14533E1AE1A389C5B76B54821BF5039F560796BF4BE0C5F3A7807C292DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651954, "uuid": "90ddf837-9dcc-4ee4-9f45-cc984eeca49a", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651954, "uuid": "0c6b4bcd-c1e3-43c6-bdd6-336fd69a6e36", "value": "12288:trnWDrl98a7LUacm7sbiD97T5QM4Pr4rvU/Oy/R:trWnZnUivR71B48rvUD/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651954, "uuid": "baa2f4e1-bd32-4b21-90fa-76ac5b06649c", "value": 735640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651954, "uuid": "eb2d7d66-2c71-4168-b65b-82fb64f911a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651954, "uuid": "7cb29345-191c-447f-9eac-897554a57e72", "value": "3ba367bb53bc5ad7c0e8d7f5a9d33532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425d467e-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655307, "uuid": "dd71bd15-a501-4b64-b2b9-630339d795cc", "comment": "Malware payload (Dridex)", "value": "7441c6020e8e41afc849fbb7b65d13c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655307, "uuid": "c8549732-239d-400f-bc06-9af5a1f03d5e", "comment": "Malware payload (Dridex)", "value": "340a08d9444b34ff16f7ecb94176afbfc8b88060ac31716d380e15a175763a11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655307, "uuid": "652c818c-7854-493f-aaf6-2d7279c58caa", "comment": "Malware payload (Dridex)", "value": "e8964e4268ed85714e351284f02fc8361cffad5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655307, "uuid": "80e24d62-b74f-4e24-974a-79640faf5909", "comment": "Malware payload (Dridex)", "value": "28f0f495c8cd693a3b582a5d1e689dce12edb6ffc61ee37f386e661342fdccc3630d1aa87cb4c88a8d6623614384720d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655307, "uuid": "00bc8802-4190-488c-a463-9ef5e30b3544", "value": "0BF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655307, "uuid": "4897ccf7-4fa5-416c-b477-890ab1c6313c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655307, "uuid": "f76962b4-d2a8-45d6-a260-67389361063f", "value": "3072:PIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Qc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655307, "uuid": "e4bf6e92-20bc-4155-bf3d-2858d1430e16", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655307, "uuid": "cd46d2ef-282d-4953-9ff7-4c72e7375d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655307, "uuid": "1ca8fe77-1f63-418c-af40-3e111bb7bfdf", "value": "7441c602_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0553cbbc-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669807, "uuid": "970985f2-04e6-468d-8d6a-1643bff017de", "comment": "Malware payload (Dridex)", "value": "3e0ca33c31dc6f666510fb27b66c6e10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669807, "uuid": "9bbb89b9-57e1-4e1d-8898-480efebc7c59", "comment": "Malware payload (Dridex)", "value": "34517e16c85d031ba2aaf38ec032d2758568084dec5be9a94d3321aeac41d95f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669807, "uuid": "cee1a32d-d4b2-4e03-880b-817bf7007f16", "comment": "Malware payload (Dridex)", "value": "6afa10a4597a55c8a4d879ade00f97745c92dcc3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669807, "uuid": "e800e9b8-5daa-44bf-9c4e-ad504dbcfef6", "comment": "Malware payload (Dridex)", "value": "3c89f11806d2b2719708fff840ec473f2297c8301b97e0e4716ec984cb93c18e6a301e7a593776ad31b4a7b025d56437", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669807, "uuid": "41800d52-bc71-4175-a048-8399a20baf21", "value": "56F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669807, "uuid": "a053a71c-ab63-4bb6-ae58-f90042946ea1", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669807, "uuid": "e1d2e259-bb59-48c0-a33e-14a8eed32b89", "value": "3072:8esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:m4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669807, "uuid": "99e8ee57-a948-4333-b4f1-45375e65d5ab", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669807, "uuid": "bdf14551-7473-4d2f-b846-833a1c5c86f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669807, "uuid": "feb26017-5255-49b1-b0af-387ae40c8eda", "value": "3e0ca33c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e29171b-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (404Keylogger)", "timestamp": 1620630845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630845, "uuid": "c02d73b3-3d63-4415-9844-536508e14815", "comment": "Malware payload (404Keylogger)", "value": "1e3219cb0ae306cc517c1e4a68f9dcc1", "object_relation": "md5", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630845, "uuid": "21a9e8b8-2c5c-498a-8fef-fa8578b6c0f8", "comment": "Malware payload (404Keylogger)", "value": "3488da9f019dbf66487d0a80604f3dd3678f05594923a169b3a07f225108a214", "object_relation": "sha256", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630845, "uuid": "77e7da43-4bf7-46be-b7d4-7ffeb653a5d1", "comment": "Malware payload (404Keylogger)", "value": "567400dcec2acbceb46efb2658d6ab82c892c8ca", "object_relation": "sha1", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630845, "uuid": "32e57224-943c-4982-a0e3-789df188b1a4", "comment": "Malware payload (404Keylogger)", "value": "c2815e7e2b7275d12e8a826c338ecb27cbb0d6b4cb91ecba34975984355b3bb70a7f1d5a2d91f00051dab9cdeb978e28", "object_relation": "sha3-384", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630845, "uuid": "22d50351-c81d-40f4-a38f-b24d94ce9b36", "value": "1EE4BE213398AF55E43EA7391171141013F2BE0BD721DA4E7DE2B9DE5AB2F418627B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630845, "uuid": "b6878c42-2419-4d25-9587-f12076441fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630845, "uuid": "c5e09241-a260-4a9f-b639-45708a35dc32", "value": "12288:P7uBrmrC6UgokKp2f1Wam4HJF/EshV/FymtS4M:zudmG6vHKpOW53S/gk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630845, "uuid": "725f1329-917b-4de6-b22a-9495aa12b487", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630845, "uuid": "4465a602-6dc9-4ff0-a209-cbafb2ed47a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630845, "uuid": "7fe3a5e6-f064-4eaa-88c3-14a7b422dfd5", "value": "Quotation_05082021 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fc05df-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Alien)", "timestamp": 1620655304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655304, "uuid": "cba78fa1-bc3b-428d-9637-15817a686027", "comment": "Malware payload (Alien)", "value": "25dbb2e7c15f00d01a222c78cc96cb6d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655304, "uuid": "3318097d-d146-4ffb-9e20-eb6d2fcc6716", "comment": "Malware payload (Alien)", "value": "34a019fa671da69f8a53c116110bee127a39cc517e71b9f2bf819d23a09e976c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655304, "uuid": "3f8a5f4b-9349-420b-b316-a4a93ce05786", "comment": "Malware payload (Alien)", "value": "579f99a4c4bb7b5d3b4d5dde87400424a7004d44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655304, "uuid": "d17b2e24-9187-4404-88e9-d07a22e12ec2", "comment": "Malware payload (Alien)", "value": "9901bd462b0e8c94abf267555177ff5dc80349fc68777f95f2331253f1a9f201a353c3ac6bd526a22e8e24e32eb5efa8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655304, "uuid": "84a8d75d-1e6c-4b34-b858-439627b66fb8", "value": "E9C523DF6F568C69D6328A3235530492B4300F08BE94F26E13A5205A39B7F614976FBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655304, "uuid": "f12feff4-040b-453d-b13b-fd00f0146b1c", "value": "49152:69L2L/LCjfCKLkWOMbmws71r0EP6VDueECwq35/Eh0F/:YyL/UlLmMbq7p0ECVCeECwqJs0F/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655304, "uuid": "fcd2a164-2c2c-494a-a6bb-2e0131c77da0", "value": 2526827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655304, "uuid": "2acd5b58-db5b-4aec-8d49-a50253e23917", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655304, "uuid": "ff00f0af-0d96-4aaf-88ea-80fb8532a903", "value": "25dbb2e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d396f4-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620649001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649001, "uuid": "2ac5f6eb-42cb-40b3-9473-11e7f28232b4", "comment": "Malware payload (RemcosRAT)", "value": "67fb76a278f36ef5281467a87806d443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649001, "uuid": "d2438a42-578a-4228-9880-402ce270d35b", "comment": "Malware payload (RemcosRAT)", "value": "34ae6e94fd8ce101fadff4baf68d7c0b8bf606d1796b7c8199e7d45a9bc57a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649001, "uuid": "22f5bcfa-91a0-466b-9061-f4cb3614a0bd", "comment": "Malware payload (RemcosRAT)", "value": "22930a44626105fa99485192002166eb34145533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649001, "uuid": "542d5364-16b1-449f-b878-2ee82a5f3b02", "comment": "Malware payload (RemcosRAT)", "value": "b89bd0ae8d10f51a2bd3806171156f7315610d3ee7715b40512c5ac05c00e65a3b60092a2f191a9a115faa85e40c382c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649001, "uuid": "8d9e21fe-bc2e-4c8b-9d95-b8d40bf945cb", "value": "D1F47C21B6E14573D16E1E389C6AB2744C31BF612DF510BA2BF47D08AF797813C2A19E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649001, "uuid": "499d792f-dfc0-4319-a314-725398c21b72", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649001, "uuid": "e296beb0-0f85-477b-b0a3-1358db281ccf", "value": "12288:mrnWDrl98a7LUacm7sbiD97T5QM4Pr4rvU/Oy/O:mrWnZnUivR71B48rvUD/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649001, "uuid": "83a8d91d-9137-4191-98da-70f06fb8f2f6", "value": 729232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649001, "uuid": "87d94d5e-408d-4935-8738-81afed3d94d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649001, "uuid": "43ac3836-b237-4fe9-96c5-13cf364cff9f", "value": "Contract_kyrgyzstan_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822686d3-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637375, "uuid": "b7816933-a9d3-4b59-8443-cdfaaca1a1c4", "comment": "Malware payload (Dridex)", "value": "6684b5cce89482b160f96abaeefa3977", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637375, "uuid": "482369f9-dac4-47dc-bf10-ac0fdbe1afbc", "comment": "Malware payload (Dridex)", "value": "34b2743216582560afce587a443c4de451a8d29a06de8ea7204ce0ae84822162", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637375, "uuid": "d4e91dcb-708a-4d67-8478-9a09c0d2f4b6", "comment": "Malware payload (Dridex)", "value": "17f36cfdf8940286a8dc2c8af9923c2b875559ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637375, "uuid": "a7f9309b-0839-4c3b-bf8d-2ea42c5e9985", "comment": "Malware payload (Dridex)", "value": "6b491c5a03ff0807d7e2aa2dd7273e9156a9d51b46a16f121a619a8be5685e3ff278aef2bfc5ebd15e2e80695c0e3c8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637375, "uuid": "889d547a-cf58-4d63-90da-6e54a78e031b", "value": "5AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637375, "uuid": "fd3a41b0-1f32-4034-94b6-161a26619133", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637375, "uuid": "46b3a0d5-5894-4b3b-aea0-099d72a0205e", "value": "3072:iWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:i42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637375, "uuid": "99ed8cbb-38d0-4d44-8c73-09e4e36960f5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637375, "uuid": "6ebdbfb4-c124-413c-b26a-4f101a97a065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637375, "uuid": "7a1cbe0a-3fbc-4d6a-94d2-acb9fee393a4", "value": "6684b5cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1715f3a6-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651798, "uuid": "66ee2566-1ddd-42b6-8bd2-f97d622b7bf5", "comment": "Malware payload (Dridex)", "value": "24cea81dfbc28a0a2d33538cc0b050a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651798, "uuid": "c30a4174-6dd9-475d-a22f-cfd28ca7a17c", "comment": "Malware payload (Dridex)", "value": "34dedacf595a76caea5856f1edde8fb35f1cd54ad97ae758624929cbc1cad8c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651798, "uuid": "da5678dc-ff3f-4f57-a2a3-ee2dfed280c4", "comment": "Malware payload (Dridex)", "value": "e187545a2ee6c944bb9dd9bfe5a14dc7911484d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651798, "uuid": "7efc806a-60ac-4513-8342-9d94a212745d", "comment": "Malware payload (Dridex)", "value": "dc51f323a053346fa9241ef8cb40c1b722534349c7f37c510c865901cee1a145ce9e358c3cff24f65165b26b756eea6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651798, "uuid": "00c9c06f-836f-4e85-b62c-7270c5c61b5d", "value": "2BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651798, "uuid": "882406a5-46f5-4e98-bc34-a7f374dcdbeb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651798, "uuid": "1c85a104-dd33-4a06-a58b-6c54c78fa702", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651798, "uuid": "55719d3f-14a2-420b-bd2b-176ead9f0d50", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651798, "uuid": "7769396e-79c4-4300-bda7-b9c0bb6c049a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651798, "uuid": "96bca592-a3fa-4e23-b5c0-6c494cadaa68", "value": "24cea81d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d2ca30-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673591, "uuid": "629e9d70-02b3-4472-9e8d-318de9785f13", "comment": "Malware payload (Dridex)", "value": "11de1bfbfb243abc655f82bc1b60aa39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673591, "uuid": "545045b1-c300-4599-8eae-ce22cff47831", "comment": "Malware payload (Dridex)", "value": "35589ca98631771fc849a7b2ab98a5d127abff9d5b525f700bd72b8895f5dea2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673591, "uuid": "c902f846-3e57-4778-9856-acf9b014d047", "comment": "Malware payload (Dridex)", "value": "78910de773995a35d4c38fb3eb4557e9c10c253d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673591, "uuid": "1b791065-5510-43ad-986f-38af02434dd2", "comment": "Malware payload (Dridex)", "value": "79d7c86bdfde387750c3e1b25524d42aa092b536f2b23fec5da679d59acfbe80560b2e76eb4f99d0159d86bc2c545414", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673591, "uuid": "6e594376-6591-4042-9e1f-65b169c20040", "value": "D0F3D00FD94ADFC3E6F21C3284EEB26E7E98D12A4D24E2D77960E52E5267D6901344C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673591, "uuid": "460fac7d-799d-4d5a-8af5-f3082b12f5c2", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673591, "uuid": "1ed63ffc-0e0a-404d-a6f7-ee5baea98bb1", "value": "3072:X/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLKM:tbrE1kvcB74DXZ2MelDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673591, "uuid": "95e0a3eb-7cdf-4e92-8cf2-9e351258d2c8", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673591, "uuid": "f3854e9f-ea6d-42ea-8315-eaf8ca2aa786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673591, "uuid": "47de84cb-fb0d-48a8-a358-6cd756c1e84d", "value": "11de1bfb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892dbb58-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620655425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655425, "uuid": "2f83ccf0-3b3f-43c3-a589-e823d6ebf448", "comment": "Malware payload", "value": "db0688f5d2319ec6af692010bfb28ffd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655425, "uuid": "525d5657-89db-4477-b602-ee020599a49c", "comment": "Malware payload", "value": "35880c5210af5dca3edc22a693ab5f0cfcec0105cec988d930ab29fe09bd3461", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655425, "uuid": "aae53a2a-e379-459f-9deb-eda77781c06c", "comment": "Malware payload", "value": "39c0869d8aff33c21bd1b9730f01c7f48744c295", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655425, "uuid": "5dd1082a-ee47-41a7-9959-a5aff5bbf397", "comment": "Malware payload", "value": "a9addbc866071d80c074232cb62d2ed1bc071b83784bc6849bcdcf99636b84ed228ef4b75d1976451a662cebff3b39de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655425, "uuid": "8b1a6c3a-9575-42de-9cd3-d0c32c8128c9", "value": "C40381E2B2D6D856DA5907364DEBC6E66336BC115F57838B3288F31F1FB1AC08902617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655425, "uuid": "2c9e4247-57dc-42f7-bed9-f2daef1ee485", "value": "768:Gck3hOdsylKlgryzc4bNhZFGzE+cL2knAJ0OiCgpkUvrtrpoMubyEs1nwG:lk3hOdsylKlgryzc4bNhZFGzE+cL2kn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655425, "uuid": "4c536815-f7b7-4925-9e97-a1f2fdfa6465", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655425, "uuid": "c084bb81-8c09-4233-9052-bb55c377ca17", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655425, "uuid": "5e6d5a8c-47d8-421a-b15b-15b122378b25", "value": "db0688f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2aa40a-b18c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650146, "uuid": "8bc07c69-42ab-4337-b316-a1056e754945", "comment": "Malware payload (AgentTesla)", "value": "4d33cce0cdea796f854a28614deebfe3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650146, "uuid": "d80c58ed-f7bf-48c7-8947-8900aa756be9", "comment": "Malware payload (AgentTesla)", "value": "360afb4fd65a7dd9bd8856cbfc7a27e517326a732e41a63bb568f55cab40d488", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650146, "uuid": "82012c2b-e497-4a7b-8fab-f38f219947e1", "comment": "Malware payload (AgentTesla)", "value": "33012e9f249011fa740a4de7b6a0c419f0d2510d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650146, "uuid": "ca1d7355-e9b5-4e80-9bbf-06bcde9b335f", "comment": "Malware payload (AgentTesla)", "value": "3dac0f88e43ce332a638a8378d46b747f7d537851c36b7d997580eb09b4b651cd511359e77b0eed69abe067a145a619d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650146, "uuid": "c1f1ce12-4d58-4d04-8aad-fe96aa7f19ec", "value": "3205E0683AB4C952D7BE47BC44B1A23447F47E5A9D03E75E1EA070EC2E77720DD02A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650146, "uuid": "2ccde496-dd10-4d07-b1c8-dc98b4e4b612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650146, "uuid": "5cedad6e-330d-4521-b07f-fd82dc43547c", "value": "12288:aQRijzZZI8BkEFzPWo4GX02WlQzOxVC1iA0jPrqTF+U8oO7Qbn3GhMjvLe:mo03FzehGrGQzMVCQBPOsUyozvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650146, "uuid": "f8fd0803-4f00-456b-93ec-bbda01200268", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650146, "uuid": "dd390204-d33b-421c-8bf9-f7d12253b1ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650146, "uuid": "e496f3ed-2ee4-4df5-a985-1d44cecf90d4", "value": "Receipt of Payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a4e92b-b19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620657619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657619, "uuid": "0d40fe4b-3202-400e-8832-dbbd9c032d46", "comment": "Malware payload (Dridex)", "value": "769895e32b1af349e651593267e5bb86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657619, "uuid": "a06a3dd4-f1bc-4b5c-afa1-db538c8e0638", "comment": "Malware payload (Dridex)", "value": "362440d9fb1c0b0bbb29abb767b62e47d7d27c15d96299942ffa2f47020dc4be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657619, "uuid": "c555d6ad-5293-4335-b1e7-3ffc3b4af25d", "comment": "Malware payload (Dridex)", "value": "7c978993f5d3842b144fa69e188f10c97454f102", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657619, "uuid": "9ffa0a00-7ffc-4890-86de-3fbc37081a8d", "comment": "Malware payload (Dridex)", "value": "c30469913da660dd783977f53994dd89b378950a124a95a8ddc2eec66ed007fefd1f2a591d1d9fef88d3ac08e379a433", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657619, "uuid": "929fcf86-97f5-44d5-b396-0431a75cf1fa", "value": "FFF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657619, "uuid": "927cc0f9-b9f1-4ff1-b78e-70078f7c5806", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657619, "uuid": "65ec96e3-538c-4d1d-9b96-a5733be31301", "value": "3072:m/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLIe:cbrE1kvcB74DXZ2Melxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657619, "uuid": "24a1d333-af83-441e-9b98-2296b2b924a4", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657619, "uuid": "1f7c1492-c476-43da-8328-0c3b8a517aae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657619, "uuid": "d1a82a79-e04c-4bfe-bfc0-fdc16419b706", "value": "5kERH5Gj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55121f09-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655338, "uuid": "0184d302-efde-420c-afca-539b6467d155", "comment": "Malware payload (Dridex)", "value": "f814f9aec860ee82375dd2ce4220ecd6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655338, "uuid": "6b3b0466-df38-41e5-962a-ace709314dbd", "comment": "Malware payload (Dridex)", "value": "367b89001629d5d9582a5ef03e5ef5537e9f5013e39d61090122f554241cec0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655338, "uuid": "f35d83ab-3099-4757-b2c0-09bdf6fe3b5c", "comment": "Malware payload (Dridex)", "value": "2477d0d39023ad04bafe276df80f93694392c2a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655338, "uuid": "ee0b0793-9fd9-4563-a45b-26ca8c8bbce7", "comment": "Malware payload (Dridex)", "value": "8cac72f412045127a235b725e9573250368d1b1670d4719f28f049b6f0aa71a86e606fe961d6256791af5054bc45f071", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655338, "uuid": "8eb41309-add1-4355-88aa-cc0ffa588af2", "value": "FEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655338, "uuid": "01a4d211-af6e-416f-a4af-1d850505a3f5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655338, "uuid": "4d510733-d1df-4547-8e39-e7f0fd00e806", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655338, "uuid": "a54fba87-cec9-48a8-b391-3bb7b7bf40ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655338, "uuid": "24ff1221-4d18-4a8e-b060-cdfc95712cc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655338, "uuid": "ab1c71f0-8ff7-42df-8630-6264a5563f95", "value": "f814f9ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dc7351-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658967, "uuid": "c09dbeff-ddf8-42af-8b27-dcbd5297f47d", "comment": "Malware payload (Dridex)", "value": "6e13c0bb99d5965164b2c4333b42c33f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658967, "uuid": "6a057140-fcc9-48b9-8676-2af18b61b1bb", "comment": "Malware payload (Dridex)", "value": "36c9924442db7b1f10817447d5c82369778f919c052a69ad152ff5574e0269b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658967, "uuid": "90773777-0dc8-489d-9830-cee1924f5140", "comment": "Malware payload (Dridex)", "value": "647a277c64e4114f2eceb37069e03b87aa934484", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658967, "uuid": "c163f686-bc29-42c2-be7b-58350c323a92", "comment": "Malware payload (Dridex)", "value": "719133e2ef2121991f9b24e677bdc6073fc902ebd5d221bedd16e8d0a529883ec7a00f7a65e8cd24b61aca159a1e1927", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658967, "uuid": "c2b002bc-916d-48ee-bf93-7e95b116533d", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658967, "uuid": "386022cd-4967-4ae8-beb9-f34bcb060595", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658967, "uuid": "823d211e-e3d6-4a28-ba0c-1dbeb6816b24", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658967, "uuid": "75af71da-ea8a-4ef7-9f55-5f23dff5b624", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658967, "uuid": "8f1f708a-e096-4e4e-b0ac-ac76c12ab1da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658967, "uuid": "ba692c63-e343-4565-a504-c53aa384a203", "value": "6e13c0bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422b541b-b19c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620657024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657024, "uuid": "29bdb2a3-aafa-4535-aa87-b48dc96dd91f", "comment": "Malware payload (Dridex)", "value": "5b53732883728eee4671836d1fa6b4e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657024, "uuid": "0cc80e77-70f8-4b1d-aba8-252a8b8eec9b", "comment": "Malware payload (Dridex)", "value": "36e5ed3074f159cddac23394a6704779a29638a96bac25499f7c3c600933dcec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657024, "uuid": "3e7bb577-02fc-4b64-8b55-f7d979b47112", "comment": "Malware payload (Dridex)", "value": "62c0d0074d0f58dc4f21284797c6aff5f58bc693", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657024, "uuid": "5bd65a97-ccb4-4aed-bb15-1300bbd303b3", "comment": "Malware payload (Dridex)", "value": "90c107c26108b04c77f06a2ef896cca06dae0c47a4f6d758cea287216117d925d0cea37bba5c9cf328b93080467769a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657024, "uuid": "bd5da804-7900-47f7-a566-f96775b2e37e", "value": "D0E533A0D9B9D324DB2B1F3FD77B1A4B24B329472D4F9480A4C0D54A329EEF39449E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657024, "uuid": "6338d254-0104-4547-a615-29a35d415b01", "value": "98304:1FU53KmhBm6NK3zeh/1wn177WuEaABcjB952MF:cLhQZOY7LekJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657024, "uuid": "6c80d0dd-1ffa-4965-ac6e-f6da7c732c32", "value": 3196101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657024, "uuid": "9869c6fa-4a06-41c5-9cf0-e9f61c4d12f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657024, "uuid": "8efa3c01-56c4-4c55-857d-c788f628a173", "value": "fax_74557.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eee564-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669196, "uuid": "0b570db4-ba61-4362-a4d9-53232bf14cd6", "comment": "Malware payload (Dridex)", "value": "44539934a4ee138994f33f22a3ba00ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669196, "uuid": "c09e8d6b-7dae-4336-a449-684fd16e7b0c", "comment": "Malware payload (Dridex)", "value": "370b22c76374a25855a8904ade963c0d54313b034ff50d9a02951a3c78a674a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669196, "uuid": "7e14498e-e7d0-4140-8730-b4b30c8af1d9", "comment": "Malware payload (Dridex)", "value": "021f8148c43dc70660482d9b69a9cd765c7b3b94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669196, "uuid": "cc77cd1b-74f6-45b5-bb69-b62a91b352bf", "comment": "Malware payload (Dridex)", "value": "49d204b23c8aa3e709eefd0298295f9429278e241d0039b43c78ed0fdcc45492f8cd63eeedb61bc4c39497e4b9c243dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669196, "uuid": "54b38ab5-e259-49ce-a573-24fbf6e7f3eb", "value": "85742200CC7DF4E1EEEA1531DA594F429C679B6F6CC1346DE211D88E1FA1E89089A8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669196, "uuid": "6cda78c3-4446-4d20-a6a7-1d840c4521b9", "value": "6144:a0xcbF1Fu5pJeibgUyBCmwLSXe+GuhpoKDCHFVgKSKrunLSZSrmRXDpnwYEz+uKE:aRFujJuBLx3LhS2OF8KruLSZSCRXDp4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669196, "uuid": "2eb403a3-b752-421d-b287-6c959adc5d20", "value": 351848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669196, "uuid": "18f2251b-71d6-4ba0-994a-93f7430ec10a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669196, "uuid": "2e2ae7e1-f9c0-4265-a532-28ff3ba70584", "value": "export of invoice 33562.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac807cf6-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687697, "uuid": "76101b20-af55-451c-8341-0b266d0da43d", "comment": "Malware payload (Dridex)", "value": "362165f50d750ccc1790f6e4c9d2729e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687697, "uuid": "6dac9015-8976-4249-816c-93509921c6a4", "comment": "Malware payload (Dridex)", "value": "3769e8f5e2f0e20afac40a79287e78d2688927632775b693b88d50f70063b283", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687697, "uuid": "280592d3-f860-4e6e-90dd-031d71f48469", "comment": "Malware payload (Dridex)", "value": "0038407597578a19c76e92fdf8da6a3f05c4e0e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687697, "uuid": "4c58f713-fef2-458d-8d0d-3d43df0f60ed", "comment": "Malware payload (Dridex)", "value": "076e232f74bc69b5fb32f8fe5dbedbbf3efcc2c66c91e3f70c5817481fc2460f7b12fc08a80115d120257d2c3c454af1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687697, "uuid": "ae8f58f4-a0ae-4df8-95d5-6237f81be2ed", "value": "2FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687697, "uuid": "89581050-6a21-4f40-9c09-16708e557505", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687697, "uuid": "4f8a918a-f812-4716-89c5-62ed3b075dec", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687697, "uuid": "2e6be140-3111-4837-a54b-50b20b74b3fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687697, "uuid": "bc97fdd9-1d7e-4e44-ad49-124315ad79ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687697, "uuid": "6ce7826e-bf5c-4374-801a-e9e1f63eae21", "value": "362165f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44642860-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620628252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628252, "uuid": "1944bc4a-bc5b-4120-bb3f-b20065f1cbdd", "comment": "Malware payload", "value": "13653be1bd43539522d4e1702fe38fc5", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628252, "uuid": "b4851406-e315-44e7-afa1-1e7ca5f7f046", "comment": "Malware payload", "value": "3792b9f9022fcd8e0b80ec9b5a053720e0ad647b27219bc7fa7dd078f2b739bc", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628252, "uuid": "3166bfba-3a0b-41b4-907a-14fb6150de62", "comment": "Malware payload", "value": "bade1e77ce7c7724bdf24fe77eb5652f7f62d130", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628252, "uuid": "d74426c2-3866-4d8c-9744-1b411a0567ae", "comment": "Malware payload", "value": "20b50355b6829b7110fd6886198efdb58939fb26ea1c3edee7ee4503c45fe20871afc5d74587dc53a890b83c1d0cedeb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628252, "uuid": "b5468636-5f12-44bb-9e28-8bda0a8540e6", "value": "0563F696B2A5D459C94807F54CE7D3E63B36FC315F57838B3298B32F2F72680890264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628252, "uuid": "8b898182-7e86-4775-a428-3a1add12fdf4", "value": "1536:eFxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAG0ewZELSPm3l+Mz0Ss7y39:eFxEtjPOtioVjDGUU1qfDlaGGx+cL2QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628252, "uuid": "d2eedec3-786b-41a0-84d3-31646d90b5a9", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628252, "uuid": "a4858b23-0ca9-4943-99a1-2a6ea1d41d7f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628252, "uuid": "022ea89d-2841-4b28-b803-54f0bb825f9b", "value": "Inquiry.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe4c496-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644592, "uuid": "c5fa0071-d560-4ab3-b1c5-1fe921e48974", "comment": "Malware payload (Dridex)", "value": "5aa6f26c222a7b7c0b0137398e8c9005", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644592, "uuid": "34ee0727-fa60-4bb8-9912-e75568cfa69a", "comment": "Malware payload (Dridex)", "value": "37c3c17b3695c9a519954e98129575ed4216323c9df2789679c75446e394b73d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644592, "uuid": "69d50efd-9100-4779-a063-4d8c092b2385", "comment": "Malware payload (Dridex)", "value": "e19e661aaed63a55f97783c4296b1ce25c73cedd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644592, "uuid": "5e0860f7-5835-4e0a-8faf-e1cd0800e8d4", "comment": "Malware payload (Dridex)", "value": "d279c9097bbc1d344e41253717478963fa679578fd4ab66f8575e4b66791c0127f0e8eb7dd7d6735e88d1e4d77ab8e10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644592, "uuid": "2858fa1d-0986-48b6-9991-a7faf9e60f56", "value": "30F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644592, "uuid": "b178d409-ed24-4bb4-a9c7-1a6dc25e9616", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644592, "uuid": "72e934fa-7c26-49d1-8e77-012cfbf9009d", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644592, "uuid": "c2531d26-0310-4cbd-8077-4c24a5c45ea0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644592, "uuid": "1dafc963-19c9-4c6a-a47b-02365bae2fec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644592, "uuid": "329065f9-33cf-466a-a941-1821512268e1", "value": "5aa6f26c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a88d21-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655334, "uuid": "b36c8731-a20a-42b4-ae82-ef2c99ed36cd", "comment": "Malware payload (Dridex)", "value": "fd1bbcb426ee96f969182f138e609f11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655334, "uuid": "f7d03c8a-7c69-46db-812f-57237d62e059", "comment": "Malware payload (Dridex)", "value": "38bf4620fb7faa121050ae8a61d12cdf5e2b492479b673d5c78996b6eae62057", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655334, "uuid": "10766852-caf8-466d-9fac-dcf55d2a04f5", "comment": "Malware payload (Dridex)", "value": "888fc1083522657dfecc11fb99df4fa9c36ecb2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655334, "uuid": "6ebee534-8097-46a5-9203-89beb97e233e", "comment": "Malware payload (Dridex)", "value": "63c1e23bb68dc42bc59fda53c6e5e7b12841c342a52a63b0dc341ab415d16aadf8996e362b7203ee0b25759d85abd85f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655334, "uuid": "c677af4f-59cc-4623-9b2c-49f5ac193f4a", "value": "92F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655334, "uuid": "cc092015-5186-42b6-9d9e-b74a2ebac1e9", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655334, "uuid": "1da3d7bc-d48a-4c9c-9f35-478165fb27de", "value": "3072:Clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655334, "uuid": "679158dd-5281-440d-8c03-285e4cc3a1fc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655334, "uuid": "84c43e92-b103-47b3-a694-3f0fd0d80fbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655334, "uuid": "3539f458-7794-45af-a9ec-a94ca765ff97", "value": "fd1bbcb4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c2cd77-b1b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620667118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667118, "uuid": "36b53696-5df0-4809-82d0-9f6592076b1b", "comment": "Malware payload (Dridex)", "value": "a840b634bf3e082faa0ee20824ca2bdd", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667118, "uuid": "3c01af26-a942-4625-82d6-e79e6430466d", "comment": "Malware payload (Dridex)", "value": "38fb2c278f253f55227327d21c9919b60e7a8c8407769cd92d79c8ec7c038e3e", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667118, "uuid": "e37260d8-80b8-4872-9f7b-241d799be32d", "comment": "Malware payload (Dridex)", "value": "562ae1eaeb4cf47da71727d66d39a29f0271ee98", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667118, "uuid": "79d37f61-9a11-4117-b017-7b2c73303ade", "comment": "Malware payload (Dridex)", "value": "06339eee9962a21c64fa2b6cc64c2e8723c714de7b060d1ae2b16ac850f94b11f359080e4c17df88708bb84d617c1966", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667118, "uuid": "0d8488cb-271a-4df1-9a54-6b31f4a98cd6", "value": "A1D433AE2FC088CCE3C66E358327D5A6AB1B42F5E16AD99B4C5162C78489033D51B1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667118, "uuid": "71224c93-c9f3-443b-b324-ef99466413eb", "value": "12288:XBx98GctjHxMDrX0IsBJkPzhsBIEC92wZHbHvWnBSnmE6ESgE:XrHcVHWDrmyzuBIBHZD6SnV0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667118, "uuid": "c437e23f-f2a4-49f6-bf34-997584ecc522", "value": 645365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667118, "uuid": "d94e4b10-9d90-463e-b0c3-86001e82fe71", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667118, "uuid": "847eeff3-99ac-4d00-a69e-3b2bb87eb9b5", "value": "scan of check 0561.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af505bec-b193-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620653342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653342, "uuid": "856f3757-cfae-43ef-b918-8d684f22e50b", "comment": "Malware payload (SnakeKeylogger)", "value": "2826f093a4cab38283e9f8505023785e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653342, "uuid": "12863b06-699e-42d1-9509-b932b36ff92b", "comment": "Malware payload (SnakeKeylogger)", "value": "391077df3297be3e2557f8385e94b4c792c6c0bd2808e24cc7bb3d9ee9a910b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653342, "uuid": "354a6c98-2487-4a16-8eaf-b5897b9076c2", "comment": "Malware payload (SnakeKeylogger)", "value": "b48fc69dfa33e6acb2d6d13619869e0c004c3394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620653342, "uuid": "01b46cc8-b2bf-45d8-9a1d-70a3c51b1b6f", "comment": "Malware payload (SnakeKeylogger)", "value": "9591aed634d93fa853b438cb2ee95b8514378223045019e32cd6ff400fc221912efe993a9ec5c43c3fcea2ced1f0974b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653342, "uuid": "ef6690e7-60b1-44ff-859b-46f93e6896a1", "value": "E3849E64AF931F5BC6DCC2FE00C6D156C9A9FC5DC2B1291A37B2CA9AFE00544ED2C586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653342, "uuid": "b635394f-c548-4131-b0a3-0ba72deaf0db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653342, "uuid": "0fb2a9e5-4384-4950-9373-3d8512d34da4", "value": "6144:T3tjv+EqJUS1ln0pN02vwVUIrjQsSX7PGFx:TdNZmj1SX7PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620653342, "uuid": "7ec72924-f0b5-48db-8055-b3959a0683f0", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620653342, "uuid": "b8020fa9-cfa1-4bc3-ac9d-ddbabff5a612", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620653342, "uuid": "8f3c04aa-2326-406b-bc62-3515303ce1ac", "value": "XPBPS2DL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419b6ba4-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669908, "uuid": "6ba78294-caee-476c-8023-e69f8c2f4fc4", "comment": "Malware payload (Dridex)", "value": "5a4e5d97183fdfcf993bb163304103a4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669908, "uuid": "9ad4b961-3ba5-4796-a2c2-1861aca5175e", "comment": "Malware payload (Dridex)", "value": "39df81066f2f41ff30adaf31dce11596cb67a61e166fbbb2e51656955aaa3255", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669908, "uuid": "25600779-0497-48be-9d21-cdbb03457088", "comment": "Malware payload (Dridex)", "value": "4a817dee32671920f89a0ddf4c7ecd261f1b2ef2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669908, "uuid": "4bd0fb8c-ec42-4726-b81f-f0799515b7c2", "comment": "Malware payload (Dridex)", "value": "3f330389ba0985eec738fa3638f65d4c690eac0cd44ad0cc0e1f3807d249d2e16c2d2ef3a042598afb5ec487eb21888e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669908, "uuid": "6e96f16b-4d47-4d28-8831-4b10be8618c8", "value": "0FF3D00FD94ADFC3E6F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669908, "uuid": "ff8b2410-8e72-458b-a5c2-f1a0530b93b6", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669908, "uuid": "c2a4eaad-afce-4e92-8d06-854fbfd28850", "value": "3072:W/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLOQt:sbrE1kvcB74DXZ2Mel3Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669908, "uuid": "73e4cf50-2821-4b64-8397-797c907e1301", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669908, "uuid": "d3fd7717-0bfe-42a4-bd54-92f8ca822aba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669908, "uuid": "4c40ceb6-d308-47e5-985c-240d7255b873", "value": "5a4e5d97_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0d7318-b163-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620632503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632503, "uuid": "3515cf71-b39a-4948-b8f6-b510531ea30f", "comment": "Malware payload (NanoCore)", "value": "8eef1dc1d7785c278d13d90cfd640a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632503, "uuid": "b5f5c528-bee4-439a-9f2e-3aa3170223f6", "comment": "Malware payload (NanoCore)", "value": "39ea098dc37c12477cdfde92cb07cf2840d907c262c582a2320ade782e01bbcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632503, "uuid": "e7edaa66-b49a-40a6-885b-62142773ff39", "comment": "Malware payload (NanoCore)", "value": "1bd413333cbe4286256d37dd099e92d090efc1cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632503, "uuid": "82527ecd-8bea-436f-8ae7-858939f5d89c", "comment": "Malware payload (NanoCore)", "value": "4021002f15c9bde27020db825406460ae6c5e62b6ce595a9b57e69505d8fe0d74c1b5f5437f43ce58c9416f1b905e44f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632503, "uuid": "35efcd1b-93d1-402b-a500-52a06d47cc34", "value": "01241267F341CC73C6220A706E769D78EFF0839E215A1B4FD72D8EAD78124525A2E067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632503, "uuid": "c4aadd61-3b9a-46bd-b265-a3df050f5385", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632503, "uuid": "f1230a55-0c29-4ee7-8acb-54f97f695918", "value": "3072:Lf1BDZ0kVB67Duw9AMc+beDpRWwR+nq6QhFdiMkLbcNz6ppL437/D0kTaL4C0FiP:L9X0Ggtwy4FkLbcNsc37gkFdJMaJ8al2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632503, "uuid": "67544cb5-4873-4c1d-bbfc-c0b8e635c9da", "value": 210927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632503, "uuid": "b03fad08-2676-4126-9a08-a63927e23c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632503, "uuid": "50a7557b-24d8-473a-a31b-c81af030a3ff", "value": "8eef1dc1d7785c278d13d90cfd640a32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b41ccfb-b163-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620632612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632612, "uuid": "9450fd5a-103b-4664-82a5-9fa439d6a0e4", "comment": "Malware payload (IcedID)", "value": "63964c4e2eb6bad3591d09c708355522", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632612, "uuid": "2107d021-4227-4bbf-96e2-ecb53547d656", "comment": "Malware payload (IcedID)", "value": "3a02a1c45007574927d5b8efd8fe805ac9885849c67e4b392367b3373666d0c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632612, "uuid": "f814b435-2143-409c-b1c4-036066c88cd2", "comment": "Malware payload (IcedID)", "value": "df3dca69becf159b649788d3044b63687a704799", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632612, "uuid": "c3e70319-cb8e-4e4d-a146-b4a50f4df48f", "comment": "Malware payload (IcedID)", "value": "2e0f56d590b85a97196f8d116dcf21f3a0d8247c5f3275a62944e0bc5d154801d1926381f4563d66dda677cd62f900f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632612, "uuid": "a457ca65-fe09-4505-b045-bd02e9e08905", "value": "1E0462BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632612, "uuid": "39a85629-ce01-41b9-886a-160d036c875b", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632612, "uuid": "a20a8256-81fb-44e9-bd4a-fdac5c16c2e1", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632612, "uuid": "4237e6cf-4fdc-461b-8102-85dc64f368ea", "value": 180715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632612, "uuid": "639805c8-81d8-4769-b7fc-212a61885bf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632612, "uuid": "1331717a-8553-4de9-8ffa-7273b4ecfa81", "value": "63964c4e2eb6bad3591d09c708355522.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcc6c28-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624781, "uuid": "44036635-e15c-45a3-8f0c-8bb6a89beb95", "comment": "Malware payload (AgentTesla)", "value": "0ddb60465a9873750e042d5583159bf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624781, "uuid": "ebfaf7e1-13d9-4632-a811-4a35ac5b5a5a", "comment": "Malware payload (AgentTesla)", "value": "3ab4992a55bf19ce9d855ed0ff10f965e9d51f07b8b214436bbabd2f2ecd5c92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624781, "uuid": "cda46b63-32f6-4078-9bbb-8f2e12d71a17", "comment": "Malware payload (AgentTesla)", "value": "fb4a0e030e9abc65e91e3f5aea352283f800f1a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624781, "uuid": "8fac2587-d632-469c-ba37-d62967c4ce51", "comment": "Malware payload (AgentTesla)", "value": "b1ed7db785e121696da35571109ea874d66b32a34c92b775fd39bc5822968081bbc2284993204add6d365379a58d3c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624781, "uuid": "1e39d058-ef1c-4640-a368-573781b64d48", "value": "0115D46A71FC25E3E22A1B7663CB19064F243E306837990D4B6037F92A73F572935D89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624781, "uuid": "d096c3a4-0d16-445c-9262-74b3669b3367", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624781, "uuid": "4d076846-3ae9-4cc0-87b4-e6e235213027", "value": "12288:NKb2X+v0iooLLoS60/K7yh0DQLop4EbTeY21eW4/0TVSB6x6MM7tnaaaaaT5Uaaw:8b2X+v0iooLADQ44EbTeYWVlx6Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624781, "uuid": "22b7f66a-682d-438b-b5d4-2063af39d585", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624781, "uuid": "b975d45c-11e3-41a9-b814-d0e3da625f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624781, "uuid": "897e9c43-3feb-4c8e-bb8d-771a0bc19389", "value": "PO I-3ACT-PU-070 rev.01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f757f9-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620649056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649056, "uuid": "864d1e92-8fb5-449c-a173-c4c3128aaa15", "comment": "Malware payload", "value": "694c107c4d4c26b825a629472b1f575c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649056, "uuid": "d10e6027-d1be-4b7a-9999-67732fe30d6b", "comment": "Malware payload", "value": "3b5685a37e04fc02b76c4686e62b17fede7a9fef26a5d1809652c805841284ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649056, "uuid": "a2d1cc37-1935-4afe-a6cf-5aade6e71c0d", "comment": "Malware payload", "value": "3b8b9c45d0875cda29dac4c31e3c6aaf253c3ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649056, "uuid": "4fbef7cd-25b0-48b2-a7ff-a8227a33724b", "comment": "Malware payload", "value": "619c4b96c9d08e0f857af01fdf61b26f1b053d45c86993862c7077b98e9444f56d1d429d124bf93e375ae42083803d4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649056, "uuid": "117581a3-74d3-4424-8b51-fc4f05434b71", "value": "C815F1303BD8AE59E5BF4BB51D70C28093F2BA23D722CA1D6DD9918E1A71745C6B2313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649056, "uuid": "fec9d5b4-db18-48d5-82da-c84e8d111612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649056, "uuid": "3883cabb-fd29-4265-8fde-de8871e44e1a", "value": "24576:NglcCjXFV6hhhIr6K9zP4hvwSYigXuWVIwThhUc:mlcCjXFB6wSWuITj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649056, "uuid": "79c96884-af04-4cf1-bfc5-61a59bbd755b", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649056, "uuid": "3dd29cdb-f2b5-4b35-ae40-e03e5bd43e09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649056, "uuid": "46481947-e16b-44f2-ae25-63194f128158", "value": "118937279-112134-sanlccjavap0003-60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6013a8c6-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637318, "uuid": "c2293e84-3757-4388-9ccb-dd028cbd63be", "comment": "Malware payload (Dridex)", "value": "42fceb9216a33b8a20a24b6b834d913d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637318, "uuid": "3ca8d9c3-119b-4a5b-8d50-412515687da1", "comment": "Malware payload (Dridex)", "value": "3bcb02a03b452155c65925c690fc284f7285865d360d2c92cc732b58fc188c51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637318, "uuid": "0a9f7cc8-a29e-4f65-bbb1-c3e69cbd6a39", "comment": "Malware payload (Dridex)", "value": "350cd7348a7497e7c9c52268392e031dae948bbf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637318, "uuid": "02062bbf-baa7-467b-9266-d11ca3e47da6", "comment": "Malware payload (Dridex)", "value": "08f83445c2add269e2140a13000440a7c1a79c0e83fcf7932750d081600440b84223d02c35d9f2578590d0344d07f316", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637318, "uuid": "489e2f56-0101-486b-8c90-955197c8cfee", "value": "7AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637318, "uuid": "bbb36b0b-a8dd-494a-80a4-3309e01171cb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637318, "uuid": "87491ca9-6eb7-4433-b8e2-a1416aab1c68", "value": "3072:+lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:+lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637318, "uuid": "452e4df8-562f-45b4-9a65-ad11998468f5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637318, "uuid": "49afafdf-d59b-42a8-a575-8a49cacb8ed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637318, "uuid": "4a82d434-eb02-4a0b-a6ca-224635e42b4b", "value": "42fceb92_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6ce873-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687668, "uuid": "89f2178b-120f-48f7-9c64-d90532f7f3df", "comment": "Malware payload (Dridex)", "value": "f7fd4ca778ec389056639105f99185ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687668, "uuid": "50062845-3300-464a-8f20-0996ebfefbb1", "comment": "Malware payload (Dridex)", "value": "3c07369cedf3f0da6500c1722ab86ca4d2187c731fe315b8e04d569d9c9713de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687668, "uuid": "58930d80-ecaa-4ec4-a713-226efbe1b0fe", "comment": "Malware payload (Dridex)", "value": "7b7a62aa66a57bf5ddc0262989a70fa68e70edc3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687668, "uuid": "49558973-bb41-4b90-a96f-133e712fad5f", "comment": "Malware payload (Dridex)", "value": "0219ca28ed1e30bd61de00a87f188ee4f5024f4f838a548e1992306ff41b00004e7ae3634e3f2c66001b7c20dfcf7ffd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687668, "uuid": "ac3f1fc3-84a1-4e54-bb36-5521b14320dc", "value": "20F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687668, "uuid": "c73ee840-df02-4c45-b198-f6ed87f5da8f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687668, "uuid": "833df0c8-ce24-41ad-b616-d044bffdc322", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687668, "uuid": "add873cb-474c-4053-be6b-47a2ffab726d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687668, "uuid": "da8bc4a0-3d30-45f3-bff3-67e8bd4c9ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687668, "uuid": "22a69f39-1614-47df-9aa5-67c83692679a", "value": "f7fd4ca7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b76ddb-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673346, "uuid": "8f79db05-a32c-4578-85ff-713816325762", "comment": "Malware payload (Dridex)", "value": "3cfc048d6e677edec15c30f5cc162607", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673346, "uuid": "cd4de293-1670-408f-99c1-679db11aa31f", "comment": "Malware payload (Dridex)", "value": "3c21d1232d96b0767127431e699fadd033eb90c34045b6d3a8206df080076584", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673346, "uuid": "fb8132fc-3782-4b9b-b915-c5aa3c2cb4e8", "comment": "Malware payload (Dridex)", "value": "51ca870b1c93d33d508baec4be669cea71274e0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673346, "uuid": "cdff0172-a58e-495c-923d-0b1edee88244", "comment": "Malware payload (Dridex)", "value": "0d1d96144cc9b45c5d5314683238941d3b1004e13c562350c06d7f686625dd11ad272d57bbbe48f31e3b9e86d528fe75", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673346, "uuid": "b7a32474-9b12-4e02-83c5-36adf111828a", "value": "71F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673346, "uuid": "2db8aec3-93f2-4a83-bf03-e82e07c94df5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673346, "uuid": "bec67b3c-9398-4d92-bf49-116969721f15", "value": "3072:gWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:g42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673346, "uuid": "2289623f-a953-4630-b06a-46a893683e64", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673346, "uuid": "a2151d4e-3e81-4a42-a406-bdfe16c13dec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673346, "uuid": "e365bc2a-08ad-4d4d-8de7-85008f477f1b", "value": "3cfc048d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec92ab9b-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620651297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651297, "uuid": "a85d1277-4140-409f-8a0c-44e6b1562c37", "comment": "Malware payload (Formbook)", "value": "7865e4215d53758ff1d749b26b56142e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651297, "uuid": "e0563cd9-6103-4b78-9b6b-0a3cd912e90d", "comment": "Malware payload (Formbook)", "value": "3d376406d5d05f3f353447e17a2f5adab37ea85d72a3a7cefb33549c2a17c19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651297, "uuid": "39f027f9-85c1-4895-a056-e1e36b3f4850", "comment": "Malware payload (Formbook)", "value": "506db383bbaa167442c8dba0f0884b745cec8a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651297, "uuid": "f25c125b-8120-413f-aae0-9846afdf927a", "comment": "Malware payload (Formbook)", "value": "7ae9b594f032d8c36fb709c7cdcf036866b8b6c33f03f3b4876009b92b72a7dee989d49bc46e253efe4ba197993941e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651297, "uuid": "50777626-ba42-45cd-84d8-7574ba7f0d96", "value": "73C4DF3EF6849D06C69F12FD80C25510B3F8926A6C5FEB54CED160B09E96371DD8A3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651297, "uuid": "1bc740d6-2cf4-4bce-9ddd-fae8fe44bb21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651297, "uuid": "4fe89b4a-cb4b-4ba5-ae0c-2c5045c7eea1", "value": "12288:mm4R7v3Knn6oJyyInK+EUbwzLjXtBaESLEPalMXY2X51Pljh:ibal4nkUsBB/DkMx7Pljh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651297, "uuid": "153f0a9a-682b-4bb3-b395-b1b9996c4a9a", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651297, "uuid": "a2741b18-0993-4e9e-9af0-11e61b6a8981", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651297, "uuid": "e9ca2d12-1137-417f-93dc-891b3ee8012e", "value": "0987654332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25e5fca-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658904, "uuid": "49789657-2e86-4f35-aadb-5075b6a79854", "comment": "Malware payload (Dridex)", "value": "16483d44b7125c07d912318cf1afb580", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658904, "uuid": "8dd5c197-8550-4672-83d8-8bbd31c8e2e9", "comment": "Malware payload (Dridex)", "value": "3d71a7df5583b10054de3dcd60aaf74d4bbf6eb08e7b7e814e73298bb1d7bbc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658904, "uuid": "69b9e7a0-e832-40cb-b096-c5942b26e1ef", "comment": "Malware payload (Dridex)", "value": "398851907b7f03268e46ff4ec86e29f1f1b12dcb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658904, "uuid": "132c636c-b07f-48f5-843f-9c4b6d141bc2", "comment": "Malware payload (Dridex)", "value": "763cb227463a44b096cbd569967cb2cc2d309e0d84b3148f2557a29c744e68b268b88b07dbc9f2f9d79d3a6c84bdec3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658904, "uuid": "eec1a994-09e0-481d-94da-5bb7718436b3", "value": "2FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658904, "uuid": "e99b8870-0a08-4bdc-a20c-fc1f6dc2c259", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658904, "uuid": "6633be7a-6905-4bba-b9e6-b15e6da15a30", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658904, "uuid": "e8b56330-1e70-402b-8645-e88dd4883982", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658904, "uuid": "0cc1e5a5-6139-4dce-9408-07915b40ad20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658904, "uuid": "f880dd18-6820-4362-a85b-64c0c778c933", "value": "16483d44_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f506a419-b1a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620661190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661190, "uuid": "f8af3702-50f7-47cc-a830-5f2a320e16a0", "comment": "Malware payload", "value": "8cb0f88a754bc7f100be01b0440961c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661190, "uuid": "a5ccffaa-9f64-468d-81c8-f7c47cd1256f", "comment": "Malware payload", "value": "3d95c35eabab3d92746cb896f3398e97772f9b1fe703ff5ea4365557d696a0f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661190, "uuid": "9cad66db-4661-4ac6-9284-a13e30a60232", "comment": "Malware payload", "value": "b6b887b0ae8f3da3fca2142fd3490f62d464528c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620661190, "uuid": "f10878f2-06df-407e-94f9-6eff5e7fc980", "comment": "Malware payload", "value": "35bbfaf7ff482f203f9e2150eede7d815567e3182724ad294fda9c914956cd405dcaaafe6e96dbe0f093ffdbf800427e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620661190, "uuid": "c8c27278-f4ec-4821-ab2f-508d122114fc", "value": "9051B9E47FD2A2240E4FAC42BD2DF45B583551224525DC399946E81938F33D4ED3FA86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620661190, "uuid": "7498c83f-97af-4998-8da0-d8e16f3ebf90", "value": "48:MIVPnEdEEUmLtkDG1kCxWPbR+Oa1IiGUtKYYC3w81WOpZbSGtKwe0a1:bV/0UmLSgDybBa13GUtdYYt7Zbzij1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620661190, "uuid": "740ef2cf-301f-4592-95d3-6c175fc1fc6a", "value": 3014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620661190, "uuid": "0fb8d253-1727-4f22-b0fe-b41e13a9adea", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620661190, "uuid": "368ee1ee-dae7-4ec9-9a73-4f8fe4799f15", "value": "counterBufferList.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4c2e33-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620659029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659029, "uuid": "c5e2fdee-7c36-4fc8-b2e9-aa6a73b06acf", "comment": "Malware payload (Dridex)", "value": "333173a0815950cfea38f8087fda1483", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659029, "uuid": "279b2965-fe73-41c5-905a-4d43623caa72", "comment": "Malware payload (Dridex)", "value": "3dcd650effcce33dc6d6b5745d570afa4d1552dfec9886f19c7a3f4af6f42df5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659029, "uuid": "58b288e0-e9a8-4b37-b225-634567e1c230", "comment": "Malware payload (Dridex)", "value": "8aa5b3ed0d35b1995d8784168633e529e2480402", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659029, "uuid": "f69fd3ad-eecf-47ab-8049-66840863c69f", "comment": "Malware payload (Dridex)", "value": "427282b8929f66bb950a3ae16fb243573106e72a6bd13783dbc63f9f9e4744cbe6038bf398f6b16e3d032ac8eb8aa1ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659029, "uuid": "33d18121-d35e-4c9a-a2f8-8df64337caf6", "value": "A1F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659029, "uuid": "90dc1df0-9678-4ed8-a2d2-b7199408dd45", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659029, "uuid": "a2d723cf-2628-4392-b3cd-13bbeda6912c", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620659029, "uuid": "9664742d-3fad-44a2-8c6e-f57f7c7b4f7b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620659029, "uuid": "840961c4-c2b0-49ca-b245-4ed01c96c493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659029, "uuid": "68c3834b-ad85-4294-8ddf-c25b4f2923d3", "value": "333173a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16bfdb7-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658983, "uuid": "c1abe123-c58d-425f-91d4-b85030de1e08", "comment": "Malware payload (Dridex)", "value": "2955b62fd26875e5c3ed0bf6a1006400", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658983, "uuid": "f7474208-fbb3-4012-9ec1-46292d59fca1", "comment": "Malware payload (Dridex)", "value": "3e7276e5ec2b0dba1f312bc63bfea577ef3a027dd594dfd162b0f22103608e25", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658983, "uuid": "dabf0051-b623-4f9b-8931-1eb1a4fa120e", "comment": "Malware payload (Dridex)", "value": "c8214b9eaf47e3db82b4bf61d87a564cbff87cb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658983, "uuid": "dedd8c09-885d-4237-99af-7d8982c407ff", "comment": "Malware payload (Dridex)", "value": "9626a83bde27fdc2f903c957d14d7f668d4ac415c1a3f433e8f1accc3a740de9c0191a3dba940c2357084fffbe6772b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658983, "uuid": "12c736e2-71df-4d33-97f3-7a79a72d7f25", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658983, "uuid": "4d23f571-e82f-46dc-b0e2-594e83428805", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658983, "uuid": "373ba322-34c2-462d-bdd5-3d46befe8432", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658983, "uuid": "dd6f5dcd-9d98-4b68-aa96-c1ce21d284bc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658983, "uuid": "893b013d-88fc-4a5f-9bea-3d1aed9030d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658983, "uuid": "3603c5df-8716-4e8a-b754-aa489ca0694c", "value": "2955b62f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8f9c85-b12c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620608936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608936, "uuid": "dcde1eb1-96f5-4656-b6a0-442d0026b640", "comment": "Malware payload", "value": "666d499d9bd488d17f35fcb8ff84a759", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608936, "uuid": "44211fb1-e65b-483b-b0e2-241b2b1c86e5", "comment": "Malware payload", "value": "3e8861ac898a1034a9642d170a1eb496f4d5884f99a7faea6ae8c27385a9d1f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608936, "uuid": "8dd82fdb-84c8-4f18-8fea-61440e6cbc55", "comment": "Malware payload", "value": "adbc80c2a265a194478a1c9f541c7bc0320500f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608936, "uuid": "07cf9b65-de8a-4190-bb29-8937e7b62b0d", "comment": "Malware payload", "value": "b3e5941bd9574cb93c6fb3501999c3dd810f36923689bc144a6780f106b284a45022748258f7d9d45ab51ddc2ce8bb04", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608936, "uuid": "354c5e01-5b16-4bca-8242-9ed17915c3ec", "value": "A7815F36929385B6FF9D4BF8599BA42E5A9F3682032402F7178481C61ED8CD3F535712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608936, "uuid": "3b95b12a-1b10-4d33-a093-98bfd039bf0a", "value": "46789c36e380ae3033025f1ac79fb4e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608936, "uuid": "1d0cfc85-964d-43c4-91c7-295eaf5c753b", "value": "48:iRkEsIn1ASkT3Jd95Ei4TC7KbRMhbmhnherKbgXWoqsScz5dXmM:GFn1ASkP34cKNOKcXWoq7cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608936, "uuid": "d5e60e32-4431-489e-9e31-71e71a8004b0", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608936, "uuid": "d018c601-7728-45a1-914b-3231834e8479", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608936, "uuid": "918280ef-03ec-400e-9de8-a83eb0b15c52", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.5975.28230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73b8255-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620649060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649060, "uuid": "3b1c4ccf-c955-474f-b5ac-a05603e72b37", "comment": "Malware payload (Formbook)", "value": "50dbb5552bf24cbf0537e9bb3912c86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649060, "uuid": "16139922-79d0-4107-a52d-be09c92aca53", "comment": "Malware payload (Formbook)", "value": "3eaf562f8434b81494c817bb90000cd612c6be3cad116c59c2f9608326435144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649060, "uuid": "1c5d84b0-7dba-452d-82b9-ece4d6f153d6", "comment": "Malware payload (Formbook)", "value": "39292fb540686e16472e6bd295d51eb5ebb4d92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649060, "uuid": "fd10df4f-17d4-43df-89da-d2fd7cfe2532", "comment": "Malware payload (Formbook)", "value": "3d795f50a1855eb3ac2147defe337cfbad4b0d2f59b5b9c34f42c8a3a552020a2e793067f8db6927843b7cf4633bc3d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649060, "uuid": "db13d62a-7da1-4360-861d-8ba2a29edafb", "value": "DB5501203BD8AA68E1BF83751970C10463F6BA67C762C65E6ACD904E2E72745C773723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649060, "uuid": "505abe1a-943c-4466-9a47-fb51f412fe23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649060, "uuid": "3b0642cf-ed47-4465-9384-0f76fd990ff8", "value": "24576:o1FXUPGhhhPE0ZQD4R2fgfa35zY8R/4hFbpgPQhNWBgIlAxGB:CFXUd0Ay2fgstRwPpgPUNWCIqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649060, "uuid": "3aa726a4-1fad-4f77-8344-6ce1fd15b9a8", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649060, "uuid": "8a38c6f1-5312-4e49-8cf9-e655a969dc46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649060, "uuid": "10a9c993-d661-481d-a9fd-1c2d30121708", "value": "ouCeNMzxAW8tbEx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5124c9c6-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620630850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630850, "uuid": "9590942e-2c8e-407f-84b8-7d269ebaede4", "comment": "Malware payload (RemcosRAT)", "value": "ad0fa1fbbc7c22ade1e56a530f8425bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630850, "uuid": "e3c77bdb-8325-41da-b859-ed4669864f0e", "comment": "Malware payload (RemcosRAT)", "value": "3ebf027f17e2ba9e5689a67df4f1375297e9f43d258ac0b781d6fb27305fd452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630850, "uuid": "3c0dd702-01f0-4656-b3f0-d4ec9a893d54", "comment": "Malware payload (RemcosRAT)", "value": "84d12fe925213f334d01f4c9501cb593c39e82f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630850, "uuid": "b1f9bdf6-38b1-4303-9254-3420b792cc2d", "comment": "Malware payload (RemcosRAT)", "value": "331c677ac75deec201948c583e54e341add951b0642844ee5760e528b178013c222791d18120654cc80011b82595749d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630850, "uuid": "d3f9f323-c148-4d04-8ec0-f61a604efcd6", "value": "42D5E9B9F66C117E507FA6E5A15CB1DC0EBFEB72D5B8128B530280534F693984B29323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630850, "uuid": "f4b4f547-8768-4056-95fe-e3e7f15dcbf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630850, "uuid": "a48549e0-0a1b-45fb-b79e-26c528d0528c", "value": "1536:t9yNkIMkEpkI4FAMG6SKbWYf4Jz29pXzzYtPBYXLNUnf1+sJSJZw0cRcKoYZtdZG:ztfqVLWc6Eblm9BFsYAyR+m+rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630850, "uuid": "27ca2c90-fe05-4700-8bc0-33197e1e07bd", "value": 2835456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630850, "uuid": "e68f405b-4730-476f-bfde-3df4d52847a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630850, "uuid": "88a9d5e0-e06d-4188-9c51-8e02519a2fb6", "value": "Factura Serfinanza_0975065870_6947500_191136433437276862847_8174211_83395420064529248_1443580329_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a0300c-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620648118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648118, "uuid": "cdb7982d-6657-414f-bebf-a7d89ef3e9d2", "comment": "Malware payload", "value": "6e5f3237624d775fa72460c4c0fe901e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648118, "uuid": "e3788161-9bca-4102-94f6-a35c9b384a81", "comment": "Malware payload", "value": "3edae5a85a1638335ecd1849e2d27533417aa5f3b516ac595bd5226e7e0aa6bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648118, "uuid": "882469dd-4b2d-4a63-bbd4-db99153fac33", "comment": "Malware payload", "value": "bb81466a0bb0e50bad6037df0e24bc40e77d7573", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648118, "uuid": "49f34027-3ec8-4bbb-92a5-07dade2d3f49", "comment": "Malware payload", "value": "a209290837c811795fac78a0041c05264b05c932a35daa4283d145a13c94a94e4de7e19d924eb525216a39368dc9e33e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648118, "uuid": "23ce8da5-8d63-47b5-984d-1513a3010509", "value": "20714CFBC68CE9A7D1D20DB91CA98AE41327550CBD2580A277330C2C7C1BA45F93D146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648118, "uuid": "4e0e9785-c990-4c28-8e36-1b1b6d84474f", "value": "96:uSeYkjO8v4hP2QqOaDyxl8ffZquJwJmuh:uSMjdL5yxlk4uJQTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648118, "uuid": "c5bbdf50-2958-4ccd-b280-e56ddb644c15", "value": 3588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648118, "uuid": "b3d321f3-c897-43b4-b1a1-54571f809718", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648118, "uuid": "98ced79a-8836-4738-8e36-9493283b2a19", "value": "6e5f3237_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c043200-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620630868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630868, "uuid": "a6a25ba4-4e93-4ad9-9b81-661ad2424c31", "comment": "Malware payload (Formbook)", "value": "d394a8c0a37bcdaf432b2882714c6eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630868, "uuid": "ed22cb61-e0ef-4511-a6d6-f6bbdf5cd109", "comment": "Malware payload (Formbook)", "value": "3f4dc309be69548972299cb0517c884bcb5a472fbf9693ff3d07776c9464af1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630868, "uuid": "ee37a0fe-a3e1-4486-a385-d54d7c31301a", "comment": "Malware payload (Formbook)", "value": "52d386445e50600a920f16692bbf30829d08932c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630868, "uuid": "a14c4c0c-0146-42d2-887d-42b8042305a3", "comment": "Malware payload (Formbook)", "value": "4961b85501539e2a33c314e0c2e4ccba66f90bb48ced52f3d62ed253cd1ac2c17614daf3b69c22872d699b71ff8c0eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630868, "uuid": "7601a69c-0c6b-44e3-84c0-987ceeda3f08", "value": "F1C4E040E90DACD5E7D9E4B3B13A8B100575BEDB92B881AF2666331452F37C331B6D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630868, "uuid": "95552494-0467-409d-b8ee-0aab0a553fcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630868, "uuid": "a9bef398-3353-4188-bdd7-1d4dc75c83ed", "value": "12288:OHFMw7Y9MA59CyMAn0pGZVkfK6Jaei3kqh6PehkHFRAomlTx:OH+w09tVSKLkqh6P3lRAoqTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630868, "uuid": "41940397-8b38-4cad-995c-2da2a987b15c", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630868, "uuid": "4d613da9-42e9-4213-9d36-0de46ca8168d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630868, "uuid": "c1654b9b-6480-460d-8345-cba5e319918e", "value": "Inquiry_10_05_2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a38a5-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687703, "uuid": "f66995bb-1c66-4124-97ee-a3ef93939bca", "comment": "Malware payload (Dridex)", "value": "ca94009260bec42a36051aae5fa228a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687703, "uuid": "aa6154a1-8cd2-4808-bcb8-e761487f592b", "comment": "Malware payload (Dridex)", "value": "3f7c1570ba1edc9a339f2f716c8deb9385e41448292f401641d50c5c3318302f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687703, "uuid": "c6ea73e1-1292-47d4-b085-84859a66991b", "comment": "Malware payload (Dridex)", "value": "be755d9f0cb77ff3650fed48471b9cfaf97001f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687703, "uuid": "d6a6af64-ae93-4c7a-91a9-2a69984c296c", "comment": "Malware payload (Dridex)", "value": "09cb3d20bdf50c3ae1b3569bbe8379a76bbaa6d85148b933c7ca58417a26da16e73f04bd8cedf1039cce7f24437a33af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687703, "uuid": "a66a6c04-a596-401b-b552-16384fecab77", "value": "5DF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687703, "uuid": "a23304db-b6f2-4a6d-ad0c-8e35b2026e75", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687703, "uuid": "d916a40f-2650-4c8c-93ac-a6e9a78e3c3e", "value": "3072:+WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:+42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687703, "uuid": "96719dbe-fde9-49cc-bd0a-11cd9a566148", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687703, "uuid": "439942c6-67d2-4858-bc27-7d58b2e3f71e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687703, "uuid": "fcdb9f22-fd0f-455d-961d-cdaa12efec66", "value": "ca940092_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932224d1-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669186, "uuid": "be2910e2-27ad-44d4-832e-e536d54e8935", "comment": "Malware payload (Dridex)", "value": "77a654037686397d9d3d42b7dbd506c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669186, "uuid": "51cdbcad-83c5-466e-9fe3-deaa9f81c8b7", "comment": "Malware payload (Dridex)", "value": "3fba54e45fecef3a58becfba9bbfdcea6e45c40e1a8dc834848ad0f8fc17c61b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669186, "uuid": "bb358dd1-b72e-4f7f-a7db-b49ffc1d2aa8", "comment": "Malware payload (Dridex)", "value": "2fa4f2c781331d9dc6da6c79193d283215a317fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669186, "uuid": "d5d80def-bba9-4ed7-993c-67ac3a441f10", "comment": "Malware payload (Dridex)", "value": "fcc50b806f0142e44b7e33447d5ac2157b3884f13f9f189d6ddbf387000b38eac698abd72932c59a95b7503cdc52cf36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669186, "uuid": "7d09a22d-0b2a-43e5-bbc4-4f6d533dbb65", "value": "DF64221BD97FEB04C92F617F52FC8FA6B82B1DDA85E20112DB90B1DC6F48D32585A091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669186, "uuid": "334801be-bc47-44d8-b10d-1167edfbfbfb", "value": "6144:G4plukcTZVm5rXTKv0Z+eieCqJ9D+0YVDEd0dT2xHnwYEz+uKOIcmUo:G4jclurXgFqK02Q0dT6H4z+uKOAUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669186, "uuid": "0b7a6a94-6132-4adc-98fe-9ad05c589b1b", "value": 328928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669186, "uuid": "0827cfad-957a-4eb8-880f-0f9f65bfef1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669186, "uuid": "cf659974-6b88-4824-abc5-204a7b1de91b", "value": "generated payment 330070.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01719b16-b1de-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620685263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685263, "uuid": "3353dd8a-d4d5-458d-93e8-5baab0cbcad1", "comment": "Malware payload (njrat)", "value": "a3f4e8cd7aed2d13baa996692c18bd78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685263, "uuid": "72e96905-2d9b-426d-a96e-bb1b9579246b", "comment": "Malware payload (njrat)", "value": "3fccf276ec2ebc7dac3f2d61b1c4eebede9856c2fd0cc303821e644025d11851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685263, "uuid": "bb5c17a5-3966-4411-bb3c-cde6ebbfbde5", "comment": "Malware payload (njrat)", "value": "0b0fa58e73a167b8a298ad41340b9da4770930bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685263, "uuid": "7aed1457-bc98-43ba-8514-3f8b97297907", "comment": "Malware payload (njrat)", "value": "febe8e3c212e0d1b3b3bd4dd91b8dd35359cdd0224fe4e0cbed19d4e560f4703703eee6ff8f20baeae385605c274a415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685263, "uuid": "dd9be401-37dd-4ba4-9e81-345fe5ed2dde", "value": "C5B22A4E3FA98856C5BC17748AA5965003B091870423EE2FCDC550DBAFB3AD91D8CAFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685263, "uuid": "5812a58e-83b9-45d7-b566-3c6043a62af0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685263, "uuid": "9943445e-e443-46d6-a4bb-ed6d6fa3d9b4", "value": "384:AMQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZKpD:uOaxVULRpcnuvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620685263, "uuid": "ddce5266-9a0e-41c6-852b-a6a5d95b1588", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620685263, "uuid": "f9fd7a27-962d-4835-b6c7-f5e106050ffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685263, "uuid": "28f32052-79f2-4bc0-b3f4-7ab6830cb3da", "value": "3fccf276ec2ebc7dac3f2d61b1c4eebede9856c2fd0cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bac574-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620657921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657921, "uuid": "2c57d829-21f4-44b1-891d-d93fbe36515a", "comment": "Malware payload", "value": "cce6aafae57088dfc56f4e61e61f1bad", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657921, "uuid": "1598f6ed-1608-417e-ba6d-44a4da46a757", "comment": "Malware payload", "value": "40351a0503d20be9bce25439118c22c7e1f995314a94b6f595e34ebd0bed01b5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657921, "uuid": "62a26588-602d-4710-9204-71a9da8d38cf", "comment": "Malware payload", "value": "54b21e9f4b49f6d7c0d12792470365b0c2b57ac6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657921, "uuid": "9a751938-a69b-4818-8ea8-9fe1bf87176c", "comment": "Malware payload", "value": "d56de8fba6b76e3cf19b556ff470a1043edd5c46c2266a46c0a89edebbc14e7f69054eae500ef880e9c66b56ea1ff084", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657921, "uuid": "a8ec879f-1aba-4717-a86e-fe205deddde5", "value": "2C8533178AC0FC8BD51791714A836DE6BA641214B932EBDDB142C0D3AF189BF178E3D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657921, "uuid": "a81b9d3d-c5f4-448c-89e9-01eff2c6d625", "value": "49152:F9KQpz6przMtpVnBCTwbAhkb0Cc1RqZk9TibC8XPaWhTd:F9Kiz6V4vVnBZbqC0qZk9TB8XPaWhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657921, "uuid": "461fcbe3-5982-491f-ae36-7b244ae0c4bb", "value": 1802275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657921, "uuid": "4bf5e35d-503d-4c94-9292-fc5f118a43ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657921, "uuid": "de13c7ff-f628-4001-b6aa-8cdae3d68f11", "value": "VMware Deployment Report Instructions.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14a450d-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680484, "uuid": "54a5b855-4770-4cae-b2e8-a4db1dd38ddf", "comment": "Malware payload (Dridex)", "value": "e1df7cf973dd15f9fe1e8b0f15104be9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680484, "uuid": "2e928000-9533-4dad-83dd-11d4e01da714", "comment": "Malware payload (Dridex)", "value": "40a99ac1428435d2d63e33f535c16eadd9f33f721e16c304ead7b1c303f5c585", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680484, "uuid": "0116e2d3-ce31-4a2e-b4cc-314232961606", "comment": "Malware payload (Dridex)", "value": "c21755f9a66426662e964bc504cb1439f49d094a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680484, "uuid": "5ad8d874-8ade-4f95-97a0-09f62e1f817e", "comment": "Malware payload (Dridex)", "value": "c2e06c70deeb19a01ac3a3d4f1828efa890494b46134a47c176015d830b1cd2009f5aadecdd9b51b7820f54c671680fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680484, "uuid": "76914803-3b08-4417-a39b-f3d9556c1dfb", "value": "9EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680484, "uuid": "1f2ee5ab-933b-4717-8e19-a135f9dd6358", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680484, "uuid": "d0a5bb67-5368-49c6-bc11-9831d9e1e462", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680484, "uuid": "8d6c261f-122f-459c-868c-6a8d21917927", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680484, "uuid": "b58fce39-9f9f-4ec9-8981-61ea5c32deae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680484, "uuid": "c10e0df8-4538-48bb-aed8-5f6e575b10a2", "value": "e1df7cf9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04121ed8-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651766, "uuid": "2209d129-14cd-43da-84f8-56316afcb70f", "comment": "Malware payload (Dridex)", "value": "e28756b8b31ba0ae4551ecabbbd4da26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651766, "uuid": "8f3560ad-548c-439f-9958-276534c8bd12", "comment": "Malware payload (Dridex)", "value": "40d10f74d6bb2950a5683e370e11765f84f7a204afc3df3b65059ae90e0db0a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651766, "uuid": "c88d5a2f-31c5-4945-a7a4-1bc24ba44f62", "comment": "Malware payload (Dridex)", "value": "65b9548675d80e6c695c3bd2de17b20de416529a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651766, "uuid": "c37552f9-e7aa-41d2-ad21-cf46e5ae236f", "comment": "Malware payload (Dridex)", "value": "1c7259f3dff1d237c16a30cf08d2249ebe9c36ae89fa39877d66a96904d2e4327d25d6cbd346511e54fe25405b58da4f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651766, "uuid": "40f52755-83a6-44d7-a557-6504092674ab", "value": "00F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651766, "uuid": "e6f4a4fe-c113-439a-b17a-60dfea19b408", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651766, "uuid": "36498dec-f57d-4273-b6ad-1c8e08db0c92", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651766, "uuid": "365e4213-6c42-455c-b810-0caeac3161e6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651766, "uuid": "ecf23f10-f354-4255-be83-598f86f98742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651766, "uuid": "d05b9501-2fb3-4991-801d-a31a832b06f8", "value": "e28756b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1590fa69-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651796, "uuid": "3d393d3b-aaf2-4dbc-a7e3-5149db9cb368", "comment": "Malware payload (Dridex)", "value": "b1d5aa66a2019acd13db2f5f4ed27ef9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651796, "uuid": "9b3b7515-f9f8-4090-89d2-e13ba2bb8a20", "comment": "Malware payload (Dridex)", "value": "40d67afd594b071c85da653d0cfa50aebc7e202475cc25d61b24d4aadf79e384", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651796, "uuid": "cf40997b-bc32-4ecd-bdd0-4075d95898a1", "comment": "Malware payload (Dridex)", "value": "dc1366f91974d75258d2445c339981d5b77a541f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651796, "uuid": "ce9123cd-2e33-45d2-b82e-d63d282b6416", "comment": "Malware payload (Dridex)", "value": "060962dea188892b28b41f4f3aaf3ece1478db234436de5fa0f59c71fc4d69d5582df7cf67b39b6a3942d7ddee1f82f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651796, "uuid": "850cf185-5a27-46e7-957f-3f7f9e70dd4e", "value": "3AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651796, "uuid": "44503122-6118-4e43-9b6a-b1d47633727e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651796, "uuid": "5164767b-dd83-42b4-bbc8-1f96f55f7344", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651796, "uuid": "ede2854e-0d79-425c-8df8-86d0bf7d2de6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651796, "uuid": "58157911-99e4-4075-bc2f-07ea943b32d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651796, "uuid": "a2ab9dc8-df39-46a2-86af-b2e477e3aa83", "value": "b1d5aa66_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c2cb31-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620640874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640874, "uuid": "b60639a0-658e-4bf6-b96f-d27188d1516b", "comment": "Malware payload (RemcosRAT)", "value": "c110b7d722e09fb92c3c5bb96a606ac5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640874, "uuid": "153103d2-ba85-418f-b333-369d3f9659fa", "comment": "Malware payload (RemcosRAT)", "value": "40dc655d06780c3f628f6ec2c3848d797c8ba88dcc50e3397e4e464ec12aaade", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640874, "uuid": "588fc5ff-ca87-4430-a3d2-165eee6ab08e", "comment": "Malware payload (RemcosRAT)", "value": "25d1851b878f22bc4b8fd27909a24b56a49cb669", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640874, "uuid": "e0e611b5-831a-4126-a0f6-85b2b3d7b2d7", "comment": "Malware payload (RemcosRAT)", "value": "a87a4245fba0aa9e87347c745735a1f391a3141bb6bddef3cc953826c5aac3d524bc7d44f29361b0b01bb422966ba96e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640874, "uuid": "9f11050a-2f0f-41f6-8a23-56ff9acf33a8", "value": "C4F49C21A2C15433D16E1E389D5BB2388C25BF603DE454BA67F47D48AF793913D282EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640874, "uuid": "4b6f8a9b-c0d0-4380-b669-90605efdd195", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640874, "uuid": "49a522ea-7d49-4c7f-b283-2da29cee69da", "value": "12288:8rnWDrl98a7LUacm7sbiD97T5QM4Pr4r/U/Oy/:8rWnZnUivR71B48r/UD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640874, "uuid": "3ae47686-7577-4046-94f8-3137ea3e7bdd", "value": 738968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640874, "uuid": "f1a69a6a-4ed3-4681-90a7-cfd9b5badd9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640874, "uuid": "18ed2cf6-f2ad-4c68-8eb0-3e0481cf732d", "value": "c110b7d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335fd0e8-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651846, "uuid": "58d23e74-d26f-4707-89ae-4ef3dfad436f", "comment": "Malware payload (Dridex)", "value": "a9cd5727923ac83b4ce0d621bf383e25", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651846, "uuid": "78a26bc0-2c2f-47e0-8dc5-bf67a233196f", "comment": "Malware payload (Dridex)", "value": "4149474e6b557a05b824fa3f4e0ec4b4a1b0f976637e9dfcdfeeeba45c4f5474", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651846, "uuid": "a6aa45d5-50bc-4c39-bba1-40bad598398d", "comment": "Malware payload (Dridex)", "value": "51e293e485dd08a62466cd540abd6153cdb8166c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651846, "uuid": "a28a51bd-993d-4c4f-a849-8faf76b27cfa", "comment": "Malware payload (Dridex)", "value": "199b395d355c4d50e4f9e21c7426a10810c340b68978c90f13a95c45d35eb0d386897dffc0dcca2ecbd59ea0c5100ab7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651846, "uuid": "f2fa4ae1-3529-4125-b319-10117a5765aa", "value": "F7F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651846, "uuid": "f6875985-0e29-47f6-b903-9a9e361353a6", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651846, "uuid": "c533bc1d-222e-4e48-8c9f-7690d5700d98", "value": "3072:yuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:y0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651846, "uuid": "575aa40d-52c4-4bc8-aef2-4beb36b553fe", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651846, "uuid": "e9655cf2-633c-483d-8a8c-5bf26f1fddb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651846, "uuid": "d1d14acd-218a-423d-b240-04fb90c4c047", "value": "a9cd5727_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cd3a92-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620657854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657854, "uuid": "bb5b2379-6fc7-47e3-b60b-f4b1b47a7057", "comment": "Malware payload (AgentTesla)", "value": "72b2a3b0c78a50c84721b0ad26df1913", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657854, "uuid": "193f3910-e3bb-4d12-aca0-bcbda2586712", "comment": "Malware payload (AgentTesla)", "value": "41832748fbe684c0877bb05ba9954f27f6a3155cfbcf45041640a1b0943b81a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657854, "uuid": "a8501dd2-9e50-4c7e-b2e3-e1bf59440b4d", "comment": "Malware payload (AgentTesla)", "value": "a278687491ddd6d42d8a2df4644d5077affc3f06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657854, "uuid": "ee044dec-4165-40c8-9966-2b50757195e7", "comment": "Malware payload (AgentTesla)", "value": "72b20d7fe22ccc03e289487396ae11b85322b1afdd9c178c0504fa2edaa69992918169d167c3e9d2dafbdccbd2a2e866", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657854, "uuid": "01ba3e93-3782-480b-8a7f-1e829759849f", "value": "C2B4238245EAF0D9049EB2AAD5DE18441446D8E8F57242F26FBEE917E89788C3C7271C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657854, "uuid": "343ec3bb-d598-4250-bb67-3157735c26f5", "value": "12288:Aany4Lgl9UTdXamxcIta+Gh3+3Hl0Zt+E45Bfn9oeT:3tI9Ga6Z5lWtVKBVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657854, "uuid": "803fb53e-3d04-437b-91a8-fa7721d6d559", "value": 514725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657854, "uuid": "733a475b-6420-459d-b3cc-11b1868e2579", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657854, "uuid": "06add59a-81cf-4556-861b-9090e33e8df2", "value": "numero de referencia de los documentos de envio..gz....pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ba05a2-b18a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649189, "uuid": "d709a262-8df0-4b36-8eff-c1edcc654c6d", "comment": "Malware payload (AgentTesla)", "value": "79e82b4d27af135828a48fac93bcbb19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649189, "uuid": "608a14a3-1e80-451e-9685-775bd3daf1a1", "comment": "Malware payload (AgentTesla)", "value": "4218bf0457ccf385d34f3b2a9ae16a36080551441883a9bb5a42c4b95ee3ba2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649189, "uuid": "5173757a-07ac-440d-9216-2765e07575ec", "comment": "Malware payload (AgentTesla)", "value": "aeb1ff9461e9d8b1716451e6560fba383d52585f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649189, "uuid": "4c1b35c5-e335-4b68-b34c-4d95b3615d20", "comment": "Malware payload (AgentTesla)", "value": "9a425f536a8ce91a8598790cb64a7dbf3a8e15f9b97e04c5c2146e7487ccf0fb232ab8e13bf45e68eee9ffdd1dbba049", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649189, "uuid": "bc35b985-13fb-466c-b7e8-125a32253b76", "value": "68F46CAC755459F1D36B1E7663CF1C0243652234783BE90E8BA013FA5A67F172E3898E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649189, "uuid": "ce7862b4-5f35-4189-bb11-5e38141e4257", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649189, "uuid": "9215d401-c10f-41c2-8bc0-80b28f432fb6", "value": "12288:iF5li7e8lkooLLoS60/K7yh08hMxT+9pb7DczLgdWG0ZcpAmDJUTFlKmKQ:Uli7e8lkooLA3TGpHEcdW/GvDJmvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649189, "uuid": "62c69bc0-85df-449c-a67d-7ee3dcdf188f", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649189, "uuid": "cbb02e57-be8c-42df-8b1b-9da9fbbee546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649189, "uuid": "1fd78cef-4f7b-4778-ab1e-6c4364d96c0f", "value": "Nyugta meger\u0151s\u00edt\u0151 p\u00e9ld\u00e1nya 05.10.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876ff54a-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673461, "uuid": "f034270a-3282-4634-a575-029c68d4acd0", "comment": "Malware payload (Dridex)", "value": "1b2246da63bb67da2d0f783ddf891393", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673461, "uuid": "20bc7f5f-0531-4f09-9faf-4c30a9107f7e", "comment": "Malware payload (Dridex)", "value": "42496e21b07f293daca40e5630a066524b063f0faccd73121b4ea23267bfe1be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673461, "uuid": "fe9d7aa3-699f-4c9b-aed1-2e12bae23870", "comment": "Malware payload (Dridex)", "value": "0f0b3ffe1c8976318db9f73a7ad8d34e0062a6c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673461, "uuid": "1d9a4449-d3bc-4f92-a395-2a356b4c3628", "comment": "Malware payload (Dridex)", "value": "21b02de33c2a9cf6a4eb9a25ec96602c295019edf69fc012c77589488102a7ebe07b317dcb97f165adfe241be0eed4ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673461, "uuid": "4580fb7e-36af-46de-8dce-e4fd8454a545", "value": "8FF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673461, "uuid": "38d45a73-7e34-4583-8253-dc03b9b1f660", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673461, "uuid": "5fe1ac1f-47ca-44d1-afb6-09178a70c56f", "value": "3072:iesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:k4+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673461, "uuid": "0fd57bc0-ada4-4364-90c2-aa5b5221456e", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673461, "uuid": "3669a248-21d4-449f-97bb-3c7f0db6bb87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673461, "uuid": "a51eadf0-9e2d-43a6-80d8-0d77ece6650e", "value": "1b2246da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6672cf4-b157-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620627638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627638, "uuid": "c38ac796-6f98-41fe-80f6-f8477eaf41e4", "comment": "Malware payload (STRRAT)", "value": "6c67d9506d1ab38770b98b46ed33f19c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627638, "uuid": "ce8bd5c8-d5a8-4557-a2d5-f6c64e214e60", "comment": "Malware payload (STRRAT)", "value": "42511a0c969153c446c2ad8ed727450e8af45d4fe0ec17836c333fc323c44aee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627638, "uuid": "c47a3e21-5325-401b-b802-720642ac5005", "comment": "Malware payload (STRRAT)", "value": "54c29729dd15a3f89d35067d6edebe6807f83a23", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627638, "uuid": "340322b8-2b61-483d-b4a4-4490e100f9f0", "comment": "Malware payload (STRRAT)", "value": "be6b650c688de7f86d3d4f011ff3e203c1e1144d40fc72e101cbdfe976519ec8a20d152dcdeff99000c4d7bc5f4b5a18", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627638, "uuid": "6daec284-3c83-4c48-a388-2022b3072e87", "value": "E2C312B5885DAD72C84B4FFE74C9E119F81C8A9F9387890681C13C6D7E50E432B751A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627638, "uuid": "8b5544ba-7967-4c23-a084-47a0d2dc20ee", "value": "3072:a4iBw8Z58ectaZad+KGN6YXZIEjsGcyL4:LEvk4y+KGoYJIXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620627638, "uuid": "9f89c2f8-ff8d-4989-ba07-e6607cdeba7e", "value": 123889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620627638, "uuid": "c0ede169-303c-4c79-8b87-def0b21a2f29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627638, "uuid": "aadf4a2b-95a2-4af6-bfbd-f63eca24d4fe", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359f504e-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655285, "uuid": "52afad57-6f38-4e57-ae7e-ba8a99544080", "comment": "Malware payload (Dridex)", "value": "e96d20ebad71051115b05f34dc9512b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655285, "uuid": "74a42648-4a42-40f0-8371-d58b4a576f81", "comment": "Malware payload (Dridex)", "value": "426588fa049e6d47d55a0d9632b83bb7defb6c1108417e7a92a125199c4bd4fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655285, "uuid": "bda1fa5a-23bd-413a-9328-a7e7931b5543", "comment": "Malware payload (Dridex)", "value": "8ed775031734651a90f8dcfd3e3c536d43165f0b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655285, "uuid": "85399847-1e85-4997-9c14-8f82266bd266", "comment": "Malware payload (Dridex)", "value": "e7472052311ae6d98a29a6af7fc4fbc6ff4f83df13056bfb317ca4a7f04e35c461a2680b88af57cc2f998de449da6080", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655285, "uuid": "cd079535-52a6-4adb-9ee2-7a0d05bfa726", "value": "76F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655285, "uuid": "68824d96-8e1e-4d70-88cf-fd9797a30e13", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655285, "uuid": "07aae86d-f78e-4766-9e0d-637da4da24c6", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655285, "uuid": "aadc893a-d97f-430d-8b3c-a8cc82128e67", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655285, "uuid": "2659b0a9-72fe-4af4-9f8a-94845be092f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655285, "uuid": "03c790f4-98d5-4a02-9dc9-5657d15f44b3", "value": "e96d20eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8707e1db-b123-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620605171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605171, "uuid": "09ea4ae2-e3bb-4acb-bd76-0e810951db29", "comment": "Malware payload (BitRAT)", "value": "b9178202ee0a7945b827b9008836a02e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605171, "uuid": "d9f88686-1388-4bad-8422-f0ac8e106dfd", "comment": "Malware payload (BitRAT)", "value": "43490b0471bb7e28b432a908893b2e7df5036f3ee939c930c45fe158e66f5e33", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605171, "uuid": "070f5764-9c81-472d-8075-7708ac6028f0", "comment": "Malware payload (BitRAT)", "value": "faa34e8ff802da789e76e4378a14da3749052214", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605171, "uuid": "8dc55ed6-12db-48cd-9478-ba3c795ff6ab", "comment": "Malware payload (BitRAT)", "value": "8c95569b62b2dedd7771db0213f5e27b7793a509c60adddcee2daea9c50117a7610e24dc26d6f9fe9f0a8715aec319a2", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605171, "uuid": "38c9c691-9670-4ad2-af2a-02b806eda83e", "value": "D8C5CE22BD8687C5E42D33B5B136437712A1AF66BA23C62DEE943F571BB0681C33254D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605171, "uuid": "e54bbf06-7095-4454-91aa-eeed257f840f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605171, "uuid": "6bf03e8a-5b2f-4df0-81bd-838af0e1edf2", "value": "49152:/QxeC7RAC4VlbGiTxrgGwB78iJ6ywcdffkSxFCLFQi2:YxeC9mN2GwB7BJ6yw2fMSxCFQi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620605171, "uuid": "93258681-cf1a-4994-8d3c-d31448433456", "value": 2551808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620605171, "uuid": "eb6ba8b7-747b-42f3-a6b6-b8fa7c7029ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605171, "uuid": "25494b3d-ce6c-42d0-b15e-d8df64bb4866", "value": "b9178202_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be034643-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658950, "uuid": "5e1a77f7-fd80-4138-9877-fdd3bd76a1f1", "comment": "Malware payload (Dridex)", "value": "a22b0b8656d60e238128ddf43d0ceb68", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658950, "uuid": "23bc1251-df5a-4857-8a32-ce99bbb36b43", "comment": "Malware payload (Dridex)", "value": "43c1a7bba5972815d86a33764125c0794ca3f450f8b4913317cd18830e7d1556", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658950, "uuid": "3ba4f00a-9327-4185-ae5c-75c5d42cc5f9", "comment": "Malware payload (Dridex)", "value": "c912eb3b1d8378f1cb0698bd1922d844ea036774", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658950, "uuid": "1e329a6c-e828-481e-ae82-00013c33c4a0", "comment": "Malware payload (Dridex)", "value": "b71c9362370c9857de0a440585e760a55a695db4ab91e5271efb7af6f923dbbbeeb928b9bc425ed0285a410f4bd88802", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658950, "uuid": "c635ffc0-7e8e-48e6-a15c-bf76ab9f2296", "value": "A3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658950, "uuid": "11c1845a-0c4b-4c86-88e3-9e5c5259e219", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658950, "uuid": "498556c9-bb5e-42ed-a369-70716e54ac32", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658950, "uuid": "69a3ce6b-cdc8-43e4-be35-a827f78590dc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658950, "uuid": "893a2039-0089-41f0-80b7-e48f569850aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658950, "uuid": "2de528a3-05bd-4371-8fc2-cee06738af02", "value": "a22b0b86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53669dd5-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620637296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637296, "uuid": "b21eecb3-e80c-4b48-81e2-c0145bf34810", "comment": "Malware payload (RemcosRAT)", "value": "9a898b2953874a2474c74d8d48e78596", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637296, "uuid": "0699c3a9-44df-423e-a956-c69ee7eddbc5", "comment": "Malware payload (RemcosRAT)", "value": "44130b6c18abaaea8d59ba7ef447b231e2bde5ae9fd572104ca51136e5e35150", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637296, "uuid": "9cabe44c-cd28-4d5f-9d78-42790c38bd22", "comment": "Malware payload (RemcosRAT)", "value": "50dac6556f57b03f1a3165bbfa9e326de3a2bf4e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637296, "uuid": "e0d76b73-18d5-43c5-bb4e-e4e1eb371ac8", "comment": "Malware payload (RemcosRAT)", "value": "9d7b3bd9443b8599e12127f2a657f3085bef0aa881821acb1b6767b4fc830bc9f129c5d345cc652faef6285529d66904", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637296, "uuid": "afce3eaa-d41f-4ec9-86b7-348a01771a56", "value": "A2E49E21E1D04172D16F1E398C2FB6B4883A7F622DEA14B527F47D48AF7A6503E1C19E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637296, "uuid": "8b4fc65c-e9b7-4c46-94e9-8506cd82b6cb", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637296, "uuid": "96be3b86-e5fb-411f-b6da-655c51265961", "value": "12288:hrnWDrl98a7LUacm7sbiD97T5QM4Pr4rPU/Oy/+:hrWnZnUivR71B48rPUD/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637296, "uuid": "e242dbe1-f428-4315-9d69-d653de661286", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637296, "uuid": "abe331b2-6358-42fe-af11-e66c643a383e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637296, "uuid": "f262979d-290c-4e87-a94f-b8287047f155", "value": "9a898b29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ac88a0-b123-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620605086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605086, "uuid": "0c1b5cf4-3ba9-4bbc-b1dc-8283bd043183", "comment": "Malware payload (Dridex)", "value": "6c78bae40e22b7c82c7bf5fc8cdf0e69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605086, "uuid": "13c1bac2-610a-445f-99f5-6036556c10cd", "comment": "Malware payload (Dridex)", "value": "44777a39ae861f643c57dd8db1a32d0a533f84a3127f86bc51a2f1f59b34dfc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605086, "uuid": "bbd6ab42-cadd-42c4-abbe-e563e464dd26", "comment": "Malware payload (Dridex)", "value": "5daeadd6789725c814118b53ec2c4d0e8ad25740", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605086, "uuid": "67dbfe42-7b52-4cad-8bb3-8998f068975f", "comment": "Malware payload (Dridex)", "value": "e27150ed59d0e8c4d63ea8d5ddc2e6812a7dc6d557065f7c7c9b600fc7ea67d1d4c012dacfd2babded4dd2e7c159e55c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605086, "uuid": "bf98f090-9d9c-45bf-8423-e2fc2cf9adae", "value": "72F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605086, "uuid": "eafbc472-ea7e-403b-8470-b9d78bacfaa2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605086, "uuid": "e5ab5c04-5dd4-4c20-9441-20ad8cea5f7e", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620605086, "uuid": "5f161a7f-7b35-4094-863a-448ad1aed8ec", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620605086, "uuid": "d0995371-8626-4cac-b75a-58209aea76f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605086, "uuid": "17d47e56-9a29-49c3-9317-3e6d623a9f01", "value": "6c78bae4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0892a78-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673584, "uuid": "e3bc0fea-0722-4791-b1e0-29b59e7cd088", "comment": "Malware payload (Dridex)", "value": "6e6b8513e60d5d3f09ad734fe3852902", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673584, "uuid": "823825f1-a17a-4dc8-9c17-eebebaeb8675", "comment": "Malware payload (Dridex)", "value": "449b382502309a98f6b17809c5e8e9b9c309e240b5a9b4745153d7b64cf7ffa3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673584, "uuid": "fcdeef58-fc1c-4a2d-beb7-cd041ef27bae", "comment": "Malware payload (Dridex)", "value": "a36cf45c56f16f0bd5fdbc1bc8cdf8ec24a64da2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673584, "uuid": "c49a82ab-87fd-49a5-9f43-d95a9021ce03", "comment": "Malware payload (Dridex)", "value": "af444b541987a441587633c390ede15aceea624dda6bb744d235a09d5c7ad5e952b68ac41151bb0cf381c1e4556f56d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673584, "uuid": "90c3419d-40c9-43e5-a365-8212b23bc3dc", "value": "13F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673584, "uuid": "738bae04-9b58-4517-9fc6-92c5a2357f4f", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673584, "uuid": "829e2b8f-b5d7-40a1-bd30-7a59867300a7", "value": "3072:Besl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:94+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673584, "uuid": "5440c0d6-bcdb-4b2c-b345-097aee5813a6", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673584, "uuid": "ed7f6d44-5560-4f9c-a569-63d37f700087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673584, "uuid": "0d6ff9a7-6268-4447-9ac1-cbc9d5d90f4f", "value": "6e6b8513_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7899c51b-b123-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620605147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605147, "uuid": "2d699a94-06d9-405b-9f36-a0e7492f6175", "comment": "Malware payload (Dridex)", "value": "5e7ca21468f910362ac454bc34bb529f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605147, "uuid": "cfaebacd-2c7b-4fb7-8c77-e69362be8c8f", "comment": "Malware payload (Dridex)", "value": "44a178a37fda382fbc704df4f9fe892e4977cf16518c0fb9414dc70696d3807b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605147, "uuid": "d1e80788-c2d2-475d-b776-77ebe1bd81c3", "comment": "Malware payload (Dridex)", "value": "c1613cfcf4694b40a240c8f9004e91e9b87ef186", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605147, "uuid": "519fea73-825b-4027-b44e-d7fd108e54a3", "comment": "Malware payload (Dridex)", "value": "a5cd0b5e9eb2f9198a4c0c23ac533d5f0ec3ba354faeaa812524fc234ecf86ee739d0cafc7e652c98a1dd8b35ca1a450", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605147, "uuid": "8da90767-73f2-46cf-9615-ae09313b9a1d", "value": "B1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605147, "uuid": "219f7d40-5d5f-4292-8461-5e4ce46ea794", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605147, "uuid": "cc60ffbe-5c0c-4600-b65c-254bfcee3003", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620605147, "uuid": "b997b0d9-172a-4757-a51f-4d484ec60c5c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620605147, "uuid": "aeda17a9-4a2c-4448-b95a-98cdf2d357d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605147, "uuid": "07e6729b-749c-4861-9c7d-a6856b62d1b7", "value": "5e7ca214_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23ecc36-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620649025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649025, "uuid": "09cb247a-4c4d-463a-8b2d-eee4381a3d00", "comment": "Malware payload (Formbook)", "value": "79f56233111f8dcaa694b90bc28acbd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649025, "uuid": "aee95bf5-c233-45d2-98d1-c633e90228db", "comment": "Malware payload (Formbook)", "value": "456614711c0a92e9455fc588f27889ee37c509b2f5e8c901d351346e8cf6140c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649025, "uuid": "5a6183ee-5a33-4928-a21d-81d4fa648064", "comment": "Malware payload (Formbook)", "value": "fa15822ec899a63f368586e565a54b74e652a6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649025, "uuid": "876a7182-c0cc-4068-a943-73d5408b8791", "comment": "Malware payload (Formbook)", "value": "d16f391ef04e5beac5cc2b307ac24490b6c2c2c1310f4a472d15e9f59fee7428532cc51a23c3aab1762ecfb6ee84d69a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649025, "uuid": "aca1446e-00b7-4bb6-9182-3eae07880505", "value": "06546B82B14184AAFD6633B1982BDD351197AEEA6476D70F12CB7B365FF32830057A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649025, "uuid": "56db7e31-1d82-479c-87f8-ec53c0a02577", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649025, "uuid": "9c495fe6-758d-441b-8fe7-349434416d92", "value": "6144:r9X0GCKfNOTrTzIb9pcVAFiZGggvHdEyKk6EyV:F0lKfIjIb9IAGGbdEyKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649025, "uuid": "087ae761-245b-4974-be62-467a433b208f", "value": 286787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649025, "uuid": "96f55348-4684-4d68-986a-699a252f6d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649025, "uuid": "ed71d7bf-62ff-4c1d-a438-dd3f6ac9a16e", "value": "NAVTECO_R1_10_05_2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd1080c-b157-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620627513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627513, "uuid": "5e6c039a-dfea-4344-8c70-50832bc09142", "comment": "Malware payload (STRRAT)", "value": "eaba1fa171325bcbd80bd65ab1be1dd9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627513, "uuid": "ed2c3f1b-bf0c-477b-a3df-3e54c8a362ce", "comment": "Malware payload (STRRAT)", "value": "456b5427d0bf58a4f53776bfb6bcb2af7c16fcba9e3f2c80941bbba6673dc5cd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627513, "uuid": "29cd1cdf-49b3-4241-b9fd-ab6347af7417", "comment": "Malware payload (STRRAT)", "value": "cbdfe233591cf355ac57b819925cc786ce393d93", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627513, "uuid": "8d599ce9-6752-497c-9e1e-04ffbc66fbc0", "comment": "Malware payload (STRRAT)", "value": "287ef3e5ab8565f83ed423bb21c9ee77c940d4da2f55d19eff0f383a3a68165f15641ae90497bd2fcf6b324d6235d9a9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627513, "uuid": "c3c6598e-ca6c-4ab5-ac6a-5d3932edc63b", "value": "7AC3123687C85694A83CC5F9852F7C99748F914EC294EF252043FD29492A8F7FC8C4B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627513, "uuid": "7de00f90-578a-4e77-bda9-460d2a680a7c", "value": "1536:3iwG+EKU63fBftvADdv+mPZZV8irOS8tcG04sceQUFBUladMqJeBYtQNTKg+FAP5:SwF263f8ZmCZVnZjDDw6MFp+FAPgFN6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620627513, "uuid": "5fe2c5f4-eba1-45f9-a13c-0bf9695e5e01", "value": 122822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620627513, "uuid": "b544d890-f8dd-4e2a-85ef-eac2d946ee4f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627513, "uuid": "6b82854f-7b64-461e-8141-f07b48e55cb3", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e8742d-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673383, "uuid": "6d89a5e4-62d5-4269-ac67-7d4d3fc899b2", "comment": "Malware payload (Dridex)", "value": "8b9c317067cb025e6d80e9f6e80c65ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673383, "uuid": "c9c4ee22-7919-46af-9f08-69418b2ac851", "comment": "Malware payload (Dridex)", "value": "457434ecaf84e7ee71c6f12480072a1b366550dc0e8841e926edb41dc06a4f1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673383, "uuid": "33034fe0-c0c2-4594-a1a4-9657988fb481", "comment": "Malware payload (Dridex)", "value": "43ae1173309b3ae198f83a705154932691cd06df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673383, "uuid": "a9e75320-8ee1-4009-84ee-0f1af0985628", "comment": "Malware payload (Dridex)", "value": "ea62f29943b70c8b3d4469fcaa30f146072c6d153181204cbdfa121060d7d62fbe31eb65e22a825cb00507b565d9933a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673383, "uuid": "884d6059-5d4b-4b02-8a74-a6166eb2d903", "value": "57F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673383, "uuid": "ed7c4153-a915-41ce-b726-4c64da2d75d4", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673383, "uuid": "d2b10733-6945-4242-afdb-fd9ce5763f51", "value": "3072:Fesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:h4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673383, "uuid": "26cc3ad7-7076-4021-927a-592f2078fcc1", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673383, "uuid": "82ad22f6-a0de-44bd-9e56-022a053b1661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673383, "uuid": "f67a358c-6484-4dd6-8455-058be5163363", "value": "8b9c3170_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17ea81b-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620655547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655547, "uuid": "85413f0d-7c3b-4758-b8a8-3dee3dbaaf9b", "comment": "Malware payload", "value": "a8e4474fbe5c79b8471ee2404a5e07b7", "object_relation": "md5", "Tag": [ { "name": "CONG TY TNHH GIAAI PHAAP CONG NGHE SO VIET", "colour": "#0AC9CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655547, "uuid": "5449d456-83dd-4a36-9d68-c0d87a308805", "comment": "Malware payload", "value": "45841939b60dab6f96aa63fa22922133adca2080f855214c7cb5369717eda283", "object_relation": "sha256", "Tag": [ { "name": "CONG TY TNHH GIAAI PHAAP CONG NGHE SO VIET", "colour": "#0AC9CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655547, "uuid": "469718c7-f8f5-4863-89fa-bbd73f9ad5d0", "comment": "Malware payload", "value": "c766a935fd5c972dce892e22d3f7e359ade8eb2f", "object_relation": "sha1", "Tag": [ { "name": "CONG TY TNHH GIAAI PHAAP CONG NGHE SO VIET", "colour": "#0AC9CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655547, "uuid": "41b18663-f1c2-4bca-bcd7-8e132297cabd", "comment": "Malware payload", "value": "c39883445df81250a5be841e2c91fb9e2ffda98a635eb6a9c3b4924ccfa937f49c0c679f743bbae0e2279694e3832be6", "object_relation": "sha3-384", "Tag": [ { "name": "CONG TY TNHH GIAAI PHAAP CONG NGHE SO VIET", "colour": "#0AC9CB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655547, "uuid": "68273b8d-de1a-48d2-af9d-189db8afb234", "value": "1705EC9D365072DFC85BC972DEA81C64EAA0747B930F9203A41316ED9E4DA9BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655547, "uuid": "9f21c1d9-61cd-4f88-baa5-c21ea6dce7e7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655547, "uuid": "c57af9ca-240c-4a8a-8d36-268bf3bfa868", "value": "12288:AqMvmNiRlMr1dGhuWluqA2lgZ13iQUgZXz39+WCqffJRoYzqFvjUoXxeGkLjeTOG:TMvW4lFYvjsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655547, "uuid": "c9c76c5d-73bf-4fd1-ae05-35d215d2b262", "value": 796720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655547, "uuid": "9a49704e-ce5c-426e-8a5d-d5f6823ea8b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655547, "uuid": "de7d17cf-e6bb-4ec4-821e-b9a0dd0dc47d", "value": "45841939b60dab6f96aa63fa22922133adca2080f855214c7cb5369717eda283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fd028f-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684042, "uuid": "8d3a5dcc-917a-44d4-b155-6dcfe572cc5f", "comment": "Malware payload (Dridex)", "value": "7ff42c6e84c40f70b718fd18078c0e1e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684042, "uuid": "04a3c342-86e7-48e5-ac86-7e663db40f13", "comment": "Malware payload (Dridex)", "value": "458704e733f8294a64a57652a3b881607aa9aa966f1aa6bf8b401c48e88b1370", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684042, "uuid": "43a2d63a-dde3-4f93-b021-f98ec34782b0", "comment": "Malware payload (Dridex)", "value": "e883b818ebddc3b9be1a5be09c93b0483f8b2c28", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684042, "uuid": "a5db7f67-445c-4e73-ae77-da7afe271a25", "comment": "Malware payload (Dridex)", "value": "e7c74419a538d0cf6614c2a4164cdbf0a16288c2e200945eeff5a3e8858dfb34bf8ab34e1f4ec92d10231e16962dc285", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684042, "uuid": "31b45db5-661c-4517-b439-9b941b5012d7", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684042, "uuid": "bd50fcf1-814b-41c2-a5b4-dcbb2fdb4b1c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684042, "uuid": "e1a2cdce-45ef-45d7-9e6d-45994bf250c0", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684042, "uuid": "6e6bf218-5b72-4e67-9691-0b665de42f02", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684042, "uuid": "91cfe73e-36e4-4eef-b88b-54e671659253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684042, "uuid": "50193a29-f026-402e-a8a1-3f2bc3d19a05", "value": "7ff42c6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb606b12-b1c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620672797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620672797, "uuid": "6da740ba-8316-4cb2-bfbe-1f828d21cf9e", "comment": "Malware payload (Dridex)", "value": "dbf7e4dafd2e5aa151ab990387616f4c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620672797, "uuid": "027f4121-304a-4d14-a593-47f273243cf8", "comment": "Malware payload (Dridex)", "value": "458873812fe79def2d37ce6b710cf5f4bca25dd5f91d2a72139a54e9d5712a76", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620672797, "uuid": "8d59e114-187e-4b6a-a7a3-c47e6fc55b06", "comment": "Malware payload (Dridex)", "value": "0c1ebeaa1ce82d5f305f6a6ada805683fadff3b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620672797, "uuid": "9ccdad2e-fcc5-46a1-b8d5-9284e9ae4b2f", "comment": "Malware payload (Dridex)", "value": "9844dc053cca97cb2ace9d828d57206826c6507bd1fa63548428dcd03539b255b6021de5f50fd837c1ed36337caa7fbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620672797, "uuid": "8b74171f-6d5a-4c17-ab7c-896172ab273d", "value": "32F3D1629DA3D1EBD602123951CA647F362776108FF1DDAD867EECCE50832C1A4B6F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620672797, "uuid": "f38ab33d-04de-432d-9c48-c284cd8e5bba", "value": "c31147347be36a466c0c1c0ed203c326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620672797, "uuid": "62dc0022-9122-48ec-86b2-d1a13bffe0a1", "value": "3072:IKFrJRMMdZgD+TnCrKKr6K/JECImfZd1gRax5cZkJiX5CuMsw5a2jKaT:LjZgD+TCrr6KhEyG4PI2C5+5vtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620672797, "uuid": "dde81a03-bd5a-4c66-acc4-cd5dffc479a3", "value": 167880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620672797, "uuid": "b1a232d4-677a-444f-909b-9a5ce0f49643", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620672797, "uuid": "b0007bb1-a2b0-4699-9705-61023b40229b", "value": "458873812fe79def2d37ce6b710cf5f4bca25dd5f91d2a72139a54e9d5712a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb9b71f-b165-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620633636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633636, "uuid": "8e266ff6-e1b3-4b6e-8551-99cbff1dc466", "comment": "Malware payload (RemcosRAT)", "value": "84a0c62e8cf9fa26ca0d446d8883cf20", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633636, "uuid": "b138d3cf-eadc-4129-8c05-aad2b61e14e6", "comment": "Malware payload (RemcosRAT)", "value": "45f3e6d6f40de19bca584dfafdfac7a3f5fb9b481717a0997d9f9c2d78d58fad", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633636, "uuid": "eefdcc63-acea-4593-9c2c-6e7299813d66", "comment": "Malware payload (RemcosRAT)", "value": "dbae83dda1b3f3112fad3d443d36181c3161362c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633636, "uuid": "fe92f161-0066-41fb-857a-aa38bb74852e", "comment": "Malware payload (RemcosRAT)", "value": "bd0a2b842bbd507566b4f23a4f1d99745a4d803fcab4aab118a7d2d2bae998452fdb2b1590d4c7b1cb4f089be9c0fc4d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633636, "uuid": "d2a12105-11bf-4f5e-b9df-b223cce92f19", "value": "A2F45BAC715459F1D36B1E7663CF1C0243652174683BEA0E8FA013FA5A67F172E3898E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633636, "uuid": "542664d6-a208-409f-b75e-1a709ca4adba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633636, "uuid": "4d8e27b2-5a7d-4ffd-bc4c-a7ccb87f1b9d", "value": "12288:57Q582orkooLLoS60/K7yh0Kc9EHTz2WHdApYSojay9z5aiqXL6ZVoJB:i582orkooLAJEHn2IAppoj79zX76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633636, "uuid": "a3f79a1b-782e-4f0c-81b8-4bf8852722d4", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633636, "uuid": "5c728ccf-c4d7-4064-8a45-8ddb808ba54c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633636, "uuid": "59d30821-43d4-4c44-afe1-1b0e7eaf34dc", "value": "MV GENCO RESOLUTE VOY 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3158df0d-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669022, "uuid": "9c3efaa6-a760-4daf-8abb-dae68ea1fcb9", "comment": "Malware payload (Dridex)", "value": "caa97f57aafc7ffbcfbd9f26a0122653", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669022, "uuid": "d669a143-02d0-4eef-9558-a2bcf564495b", "comment": "Malware payload (Dridex)", "value": "46164c80b4e0040d03d0fbdb9500d91454b24fc08a795378e7752f6bf9dfb8aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669022, "uuid": "7e89be3c-f5f5-49a1-8cb9-bf7d28941c4b", "comment": "Malware payload (Dridex)", "value": "1b9e20e36094b9abcdfa5f0911860ba36b7e54ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669022, "uuid": "ae2c6bda-caa0-4712-8bca-0685624b097b", "comment": "Malware payload (Dridex)", "value": "db2fcdcedc1dcb779cc559f0b5a09851efd063bff2984010467fb9bd0926c94c6017530774595ecfec6a2ab3a8b7671f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669022, "uuid": "f04dc3c1-c197-43b0-b92a-8503b2e6a892", "value": "120633B8CBC19A13E8956CBE31E42F55266A0DF9E0C2923F724FB0557ADDC0F48852D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669022, "uuid": "7f3a3050-40b8-4fd3-a056-fdf7ea5f5db0", "value": "49152:xjDUKuyDM/Svg/oTFUOBttaLbWxbTLH33IJMA6shUjoD8j5/KwQvPnWFV6iVhNBQ:qKQS4ATjYKjH3qmX5tQmFVfNm/FnIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669022, "uuid": "cee4b984-65c2-4a3f-9de4-7dc98f3e0c55", "value": 3874421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669022, "uuid": "54cc2ee0-d2ec-4d35-a71a-05a9982b63a1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669022, "uuid": "e752e2ca-81b6-446b-b5cf-3221f535f838", "value": "copy of payment 0535.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3502f77a-b167-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620634239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634239, "uuid": "23100e96-af79-42c6-b972-8d80e45ee47d", "comment": "Malware payload (Formbook)", "value": "0a97784caa887980fbcdeeefa6030fa9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634239, "uuid": "c9f15b84-78f9-4075-b465-588fd99ffe38", "comment": "Malware payload (Formbook)", "value": "461d9525f0878edd59340ef9ac133f74b184d44f5ab6db95ee3d83b1290914dd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634239, "uuid": "772619e7-370e-4ebf-bc6c-ac560caed9bb", "comment": "Malware payload (Formbook)", "value": "53b88297cde8ed9611b084fe365651400c134762", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634239, "uuid": "18ad4540-74f7-4d45-b80b-e803fde4ee1f", "comment": "Malware payload (Formbook)", "value": "13feb76cc1ca6e7e86ecf96dc7666ffbad0603196f928263b39dd30f1b1ee8a6aa2eed994bbb1f6702e56ab4a071be76", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634239, "uuid": "fe85a7e4-a06c-4c41-8210-e350929d3d84", "value": "98F423A888EB39F59429B782E1616EEB5C55823F26167B32D8EC06308D7F4933F445F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634239, "uuid": "c3850131-294b-45be-b8ac-f51b28b75e90", "value": "12288:qdXnYC6P6VLsxMzt+YCw0IM54+sQQ7f+cKE4k1dOTtUpzSRmnZkh:qYDW+w0IMqz7f2E114Tq+Rmn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620634239, "uuid": "c672b4fc-4173-449e-89d4-b5fec39736b4", "value": 726779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620634239, "uuid": "4a6eab82-de93-4ca0-a97a-06c0db1cb18e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634239, "uuid": "00ccd0c9-c75a-4d90-8824-f9882c28cdd6", "value": "0a97784c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2779b1-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658979, "uuid": "14590aa2-d7b5-46ef-aa3b-3ce507fd8d3c", "comment": "Malware payload (Dridex)", "value": "520b4a5085c377ff8b55dcdc8fc2a865", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658979, "uuid": "a104f3d5-37da-42d6-aba7-82681a6eb089", "comment": "Malware payload (Dridex)", "value": "4699cecdc9fafb6fd050a93a9846f83656cc1dd1ae32c7a5691f9fbda503113b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658979, "uuid": "d31c2513-89c8-4042-8fa4-99e3e9aaba91", "comment": "Malware payload (Dridex)", "value": "e8bf360e6eada689b681bb361adf7db66687a092", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658979, "uuid": "91468b42-9428-4b1e-8d44-657a9b3b5660", "comment": "Malware payload (Dridex)", "value": "9ad312dc46b7da1a8e9663581e40e4f9f2973feeb5466a7f22c95773e6a3a8f5606473af56e2802f926af3ebf6c03969", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658979, "uuid": "eaff815f-643f-42bb-b03c-91800293622e", "value": "F9F3C141C9C5CCE0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658979, "uuid": "5ce76511-d268-4318-b278-cbbfab48918e", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658979, "uuid": "77f6d8d1-1525-4dac-8174-3d7c0ab62519", "value": "3072:BuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:B0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658979, "uuid": "bd95e79e-e7fc-4bc9-9798-c8917273007c", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658979, "uuid": "e64fef6f-3c30-49a3-b357-91917be614f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658979, "uuid": "37a80aea-3ef9-4209-838e-0f57a5a898fc", "value": "520b4a50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e87580f-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673420, "uuid": "6f987cac-6f71-42f7-a9e6-afb5afbd24e2", "comment": "Malware payload (Dridex)", "value": "ab8e1559293b0f7b88f3a1a24c8c0400", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673420, "uuid": "e6f3207b-cbf8-477e-8a92-54cfb8f36486", "comment": "Malware payload (Dridex)", "value": "47483890b2fbe613258467ee10ce6a83cae2bf474f6bb03cc1e9c2c91852a19b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673420, "uuid": "68571c12-1381-4852-ac49-12bdf1ce7a14", "comment": "Malware payload (Dridex)", "value": "24b57f17524e291a3d0cbf38a2e8898fffe295d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673420, "uuid": "a3089c1e-b67f-4c03-9eb5-68e97b9c8c4d", "comment": "Malware payload (Dridex)", "value": "8fd4141fc73087b438e4035f5d87c23282c494fb0e2d83668c935851999489e0070a2134b27778643586ed59224d81d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673420, "uuid": "faff199c-4135-4f57-aec9-d7f98e78ecd9", "value": "7BF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673420, "uuid": "b5d1a61e-73b2-4240-99c6-97f0eebca4f2", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673420, "uuid": "570669e1-6b45-41b7-aa61-5534afab977c", "value": "3072:wesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:a4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673420, "uuid": "c49db186-d4e8-487c-94d3-ff4957a471d1", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673420, "uuid": "a285e44d-b1c4-44a1-9d43-7c0cb996a00b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673420, "uuid": "6b8c7fa6-b6ed-4770-84f2-9b406a35c9af", "value": "ab8e1559_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc7dba9-b17e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620644184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644184, "uuid": "03fe6e2a-a578-4a8a-8a3f-00f80b7f0b96", "comment": "Malware payload (AgentTesla)", "value": "27a6eedc973ddc4568f94b7f22ea7375", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644184, "uuid": "644957e4-dab7-47a4-9486-260fbdfbf94c", "comment": "Malware payload (AgentTesla)", "value": "47686ba32531095dd38edbb5f77f42be52d6fce0102e857515f9e8c12ef0e778", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644184, "uuid": "80d22fc7-af05-44a9-b5df-b0cb1beb7ea6", "comment": "Malware payload (AgentTesla)", "value": "2e9bee47f1bdb1ef64012dbdbfb8803baee50219", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644184, "uuid": "79b5af8b-6c58-4d20-83e0-6efaa8bbbea8", "comment": "Malware payload (AgentTesla)", "value": "87b3ff1bbab494daa490559f1ee0005dd84db6130d2281bb25097cdbdc125b991592f9d93088b5c011b4d8729003db7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644184, "uuid": "f8c19045-08e1-4adf-9905-a274bf6022ed", "value": "7CF4D02037D8AA58D4BF97752970C54473F2BA27C322C75E6A9D904E2E32746C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644184, "uuid": "252af3da-834a-4263-85d3-b9f5462afe54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644184, "uuid": "24a75f78-8e8d-4c46-b5f4-e6acad7c83c2", "value": "24576:nHdXxPGhhh36+sLCtZomyX5V4P0//g6F3y9TKWcRz:HdXxg2EZGX5Vco37TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644184, "uuid": "1b34be78-73cd-44e9-9d17-4b4cf474ff31", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644184, "uuid": "b191331a-840d-4c03-903c-9d988f08f136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644184, "uuid": "62767530-cdbd-4a2e-ab0a-f5d2ce688178", "value": "Project_Scanned _Image001_SubContract_Dubai.img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990f98fa-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650728, "uuid": "ec61b65e-ac4f-401e-a99d-8105274acd01", "comment": "Malware payload (AgentTesla)", "value": "a5f34142169ee1225729aa7dab784a67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650728, "uuid": "07b6e7d0-e3cb-493f-a946-e987a9484d0f", "comment": "Malware payload (AgentTesla)", "value": "47a4dfa925198cf28c91b12f0e2c04039d85980fbdf3c1858a5e2cf056dfe3a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650728, "uuid": "bb2f65aa-db95-4e50-8e44-645628ff2348", "comment": "Malware payload (AgentTesla)", "value": "c6f9ab459d849baf06025e50779fdfae5d1da2d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650728, "uuid": "d063d2f9-e10a-45a9-883e-94cbe87285c0", "comment": "Malware payload (AgentTesla)", "value": "dc19544e0be0921c7bf20577d9db0a53c64e0462c61594cc32921d37040b2405db03aea8002375b60d939aaef979b555", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650728, "uuid": "1c1be81f-9ad5-4fc9-9f3f-c3c58c7de29e", "value": "AE25CF113F90D851F29E473BC9ABC60447F1BE62EA62C71F78E8325D5A32713A90176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650728, "uuid": "8c8d81d1-9f25-4c0f-8ad9-17c3b44f3e05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650728, "uuid": "6797df86-77ea-4cc1-a433-c518d31c5395", "value": "24576:LkFUTQ1OzhhhnQLXik0/5HYg53IEA8+LKXvLet:LkUTQ1fXs5HN3S8sKXvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650728, "uuid": "a60a7af3-01a5-4ac3-9655-99134ad01527", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650728, "uuid": "6b58155a-07ef-4f7d-a7cc-e569e024137c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650728, "uuid": "d6a47d58-f6f1-42f3-adec-710a7a73db70", "value": "RFQ-MS GCPL 2021 project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f33f94-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669889, "uuid": "1cca13fd-1c24-44f1-bdf6-c5cc8d630eaf", "comment": "Malware payload (Dridex)", "value": "8dc9a34ed9f109d2427c14ed05f0e03e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669889, "uuid": "f4c9a5cd-87bb-45bb-85b9-8de3a3c9ae5c", "comment": "Malware payload (Dridex)", "value": "47c8cd4a2e19e9755bafef96cf3202e516167153aab31b73167284dd9c8a44cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669889, "uuid": "918c7b02-61bf-40f4-b3db-cadd3ede60b7", "comment": "Malware payload (Dridex)", "value": "2f4df2b4d5271fe9f50ee55c51985454e850dfde", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669889, "uuid": "71806415-56ce-472a-b92d-13d816e8dff1", "comment": "Malware payload (Dridex)", "value": "9c40f5a97efba4a035c16f5ac5c731a40f509f4f5fb7a83199d15b349bbe4741954977400e2a8bb90f14929b9b933482", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669889, "uuid": "851554a0-54d5-4b44-8921-f4a839c1ae68", "value": "19F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669889, "uuid": "6a9b3b8b-ee03-45c1-9133-12c78c22732a", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669889, "uuid": "ba46a89a-73d2-4687-b1ed-07daa2f4e1ab", "value": "3072:B/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLss:7brE1kvcB74DXZ2MelZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669889, "uuid": "2f93d133-1096-48fd-9461-1634b0d1223d", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669889, "uuid": "73872f41-529d-40c0-9044-44b8719ad626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669889, "uuid": "8742b11d-53d4-47a7-bc10-cc6b8be90b76", "value": "8dc9a34e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578c155b-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620655342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655342, "uuid": "9b60b991-d5cf-4458-8989-8531d7bde449", "comment": "Malware payload (AgentTesla)", "value": "d4f43690b8833d92ab09651305edbee5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655342, "uuid": "fc65e9b8-d085-4b3b-ba40-ed167954ab95", "comment": "Malware payload (AgentTesla)", "value": "47e5951a36c1dc164046cad93957478e725b28bf6de6f4226492a16c6a191781", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655342, "uuid": "915418d1-41e4-4ca5-b5b7-07df6270e9f2", "comment": "Malware payload (AgentTesla)", "value": "ccee48cff3e2437b34106cc5964fef300f1f40d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655342, "uuid": "0b6d62db-3691-45b4-b7cd-1d55a6e678a8", "comment": "Malware payload (AgentTesla)", "value": "6598592bc5107a407d146c0767fc977d24a69471df494b8fb6894c8ea2ee12dadc702181f4cc411c59e84f2a89c68cd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655342, "uuid": "31b80a96-7657-4e9c-84e8-edca0e3e0d0f", "value": "B7353316EDA9801545244AAACE637FDC4FBB35891B733EB0F4A5F767EE00F710048A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655342, "uuid": "3f5c1dbe-b728-4f33-9198-d4e6e63cc4e5", "value": "24576:cBKfAcS6C9S24OyBjRL1KV1V45j5QkNrUuJG8PoaSOHWAITlYAHGyo:dAQCt/UR1K1VYj5QkN9FTqAITl5HG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655342, "uuid": "f1275e4f-dea0-4f00-8fc6-4b2453b336a8", "value": 1103935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655342, "uuid": "71d5a9bb-13a3-4fed-9696-7324c9ef54eb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655342, "uuid": "207fe1fd-b0e5-4b00-b01f-49533143a9c1", "value": "d4f43690_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93412b12-b1c7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620675629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675629, "uuid": "a848c425-7bab-4e21-9689-ee32e6b2b4cc", "comment": "Malware payload", "value": "46a770768dda660297cf2888775541be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675629, "uuid": "818af313-0aea-4df1-b526-5f4c257216f5", "comment": "Malware payload", "value": "48fff2f374cac9f003a48d4aacda4e048000ddf48c2a2187e9b407fef184c016", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675629, "uuid": "e557604f-6760-4925-8895-058415fb232f", "comment": "Malware payload", "value": "82927f479670d60dda62b0543b6088f872990632", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675629, "uuid": "78d23bf5-b65d-42f2-8c49-9fbbf0b21fb3", "comment": "Malware payload", "value": "8225d347955565fa3fda631eec62057d0f6dd04e8953d06f77b65257dee43ac367efdfb10e8e9dc4d6b36b318a7247e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675629, "uuid": "e93ea985-03f4-4573-b957-3d0be423018b", "value": "5083940476F8E522E86256718DF3FBCD6334BD53AE09473332A4739E1D3A0A5B941B64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675629, "uuid": "b73598a7-db42-49c8-b3c6-d70d44dbb559", "value": "384:FrMnROah2RGkO//mBMvo62kwsUOoLFHPCKGVrudR8L9wURKMxpcksPY:NMRhh2RGDb20o5v149wwxWksPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620675629, "uuid": "6c821e36-a6f3-4a91-beff-64a0adf4d754", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620675629, "uuid": "b25b33b1-1191-4887-8600-e222071a0807", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675629, "uuid": "1a90852c-dce0-468e-95b6-a1395457dc26", "value": "SecuriteInfo.com.VBA.Logan.1462.19707.8342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fc5b37-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669805, "uuid": "617b26a9-12df-4ed8-8677-28e6bd4283ae", "comment": "Malware payload (Dridex)", "value": "2861b8f25e9644d192ddf1b9fa7c490c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669805, "uuid": "c6f20f4b-632f-4496-a379-0ffacc498706", "comment": "Malware payload (Dridex)", "value": "491d60a42da5379a5f849268529cdccf16bfb0e952ba1d6d730433eeb793bb7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669805, "uuid": "c4a1cfdf-2f7c-4a72-90f5-da611410f4fa", "comment": "Malware payload (Dridex)", "value": "fb983d801f576c1b812c0cdc3ff93cdd1a085a2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669805, "uuid": "09862756-fe17-4736-87eb-e87d98fdeab4", "comment": "Malware payload (Dridex)", "value": "6a6b38e770baaacea9588ccbf5cc0d235e07a7d7ad1e40218a5c586b294754b1cb73181d486b7a14df2c614953221b62", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669805, "uuid": "7299ca4b-b5f2-4077-933a-09ea45d50af9", "value": "2CF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669805, "uuid": "b385469b-cb92-4f56-955b-80e140f79c0e", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669805, "uuid": "feef9e9a-f144-4956-9ef6-5423ea8e6d67", "value": "3072:r/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:ZbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669805, "uuid": "60d23d33-5fc6-4494-9553-fb5db555d373", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669805, "uuid": "4b11c52a-06c4-481d-84db-f3cacc613569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669805, "uuid": "30875e67-c90c-487d-b33b-89941f3b7c92", "value": "2861b8f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4304ca20-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684084, "uuid": "979bbc90-afac-48cd-81a4-629afb3995f1", "comment": "Malware payload (Dridex)", "value": "80e56ec2455ecb3d49bb040c0db223fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684084, "uuid": "002a6148-2c85-4873-8a93-bad59ce72a43", "comment": "Malware payload (Dridex)", "value": "49b1e8f723e8dea1ad939b6b300f099a38da4ff377ae7f076b8fd1f50becf5c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684084, "uuid": "d52b155c-6e11-427c-bf4a-a1e29a5f14ce", "comment": "Malware payload (Dridex)", "value": "19e3e24d153ab154f26c6773a8af95caf9edc226", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684084, "uuid": "0c8d9efb-a426-4c0a-b6e4-c24345d83e75", "comment": "Malware payload (Dridex)", "value": "d6a3d45846788efeb355bbc746c2269009babe90f15ac31ae9a59c4933de43154089974d6ac8bc312b370e2dd49e1582", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684084, "uuid": "4ab64fce-0115-4e0c-83cb-12865e569bc1", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684084, "uuid": "8c3639d8-5525-44ac-a0b2-da2e560963eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684084, "uuid": "3d2dfada-d807-47b6-a839-909d6cbb8cd1", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684084, "uuid": "acaa76c2-dff9-4ce4-aab3-caae2040b0db", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684084, "uuid": "9abf0541-2d85-41dc-84be-87d5ebf64261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684084, "uuid": "b9c572a0-acfe-45b4-ad9f-812f2b9ac5e0", "value": "80e56ec2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96da1ffe-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650724, "uuid": "4798b1c9-aec7-4f02-8780-079efb785fdc", "comment": "Malware payload (AgentTesla)", "value": "2c870adcc25ac47bef6f2f8fb7b2f635", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650724, "uuid": "fc4375e1-9938-4eb0-aafe-ec94623dd87a", "comment": "Malware payload (AgentTesla)", "value": "49b3b3f53fc7d87e4815e519a3406f571cf1677b56c8527626f9f20a33e1f6f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650724, "uuid": "d7958a34-306f-4dad-a288-f46e045535d9", "comment": "Malware payload (AgentTesla)", "value": "4f231b550f5bc4e8aab9e06befe4d8c204264286", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650724, "uuid": "dc4e423f-e57b-4b36-839a-cec58525699e", "comment": "Malware payload (AgentTesla)", "value": "5b65dd129d53b3f3bb019bf7aa9de2a4437a64de396d90f95297532fdc45d0e820c01f6d0a150bb6186f26701931c71f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650724, "uuid": "0e106653-b446-46ec-b930-12c7f4e2ac15", "value": "6FE4CF2C7AE88A05D6BE52BC84B0C13043F8BD069917E75D4EE06DEF3C77721DA11A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650724, "uuid": "c769705b-6f77-477f-8164-a744915ed4ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650724, "uuid": "5b8ade14-e39a-46e6-acfb-ccea5a3ba08d", "value": "12288:/p97EDeeCHB/dFCC/C7oCzCCoXR8zWy6ddUQ5ogFQWrLNuNE3v08pbS/oNhRs01o:sEhM6ddDeUQW+Ec8pbQoLRs0rg0Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650724, "uuid": "1c07df57-a1a7-4401-9fac-6da13770d6f5", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650724, "uuid": "cebede7a-94cc-4a99-86ac-cac549fe15a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650724, "uuid": "34866c62-1b51-45f0-b30d-b6323bdce694", "value": "yU7RItYEQ9kCkZE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f388b2-b12b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620608652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608652, "uuid": "8482435d-b653-4211-a189-4d58e230b22e", "comment": "Malware payload (Dridex)", "value": "9d6a62f3736be558e25c513319744222", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608652, "uuid": "dd73414f-b9ca-4c1f-afb5-a97f43d61824", "comment": "Malware payload (Dridex)", "value": "49b781b07b30a8bbfba1f6a93b494a85a59f7043c40f3381feb192a9a4d55ccb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608652, "uuid": "8efd15c8-0e32-45da-b748-2d50d7db9f44", "comment": "Malware payload (Dridex)", "value": "2a801cd323c57b3999ebd48d0d6abc2da41ab1fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608652, "uuid": "f2dfba69-b709-4c0b-8d4d-12ffad656cd7", "comment": "Malware payload (Dridex)", "value": "ff0b6603347f078bdc73727c41e6f21819e6156d484950d38ea28f7bdd592deb02e440332fe7d6cc6ed154a47e273db4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608652, "uuid": "66625348-b201-4f43-9feb-7ef7fa1f8369", "value": "63F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608652, "uuid": "f5a161c5-7c5c-4045-bf0c-895ad3033f93", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608652, "uuid": "ce2e57da-2c3f-4043-bde8-cb2f70339842", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608652, "uuid": "c1870ee1-5159-4a45-ae85-850a96cdeb01", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608652, "uuid": "8c5a6c0e-d533-4b70-b1a2-00648cc79430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608652, "uuid": "63c52f77-80c3-4dcf-9ced-d3e2a09d1312", "value": "9d6a62f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39f86a7-b1b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620668918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668918, "uuid": "65a9e7c3-6932-4cd3-9d9c-61de438c0dad", "comment": "Malware payload (Formbook)", "value": "78326c1e8316445d594246175e301916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668918, "uuid": "c2ec54fc-1edb-4299-8429-5362dfe4a67b", "comment": "Malware payload (Formbook)", "value": "4a41c471d9315c849aa3585f39d511ba8c359e45df6d7fb0932ab52662e5a6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668918, "uuid": "780b1a04-3dd8-4d39-a70b-cc494d55ca66", "comment": "Malware payload (Formbook)", "value": "dabe277f1f69b0dd34fd153eafdac13c3c8b9984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668918, "uuid": "e963d680-04da-4b18-a210-e59e808af4f3", "comment": "Malware payload (Formbook)", "value": "3d108ab7a7fc8b7d8e1d8906125b500756bdb6cd01ba96e464b5d4849573cf4d6789d6cb6f2344f4f2b8a3ba70a617b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668918, "uuid": "fda3c3a9-a736-4dab-8a38-0e863662a5a7", "value": "92D4D0253798AB90F17F973990B1111493F5F417D335DA8EBE9840DD78B2F818AA2B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668918, "uuid": "c8ffdebd-34d9-46b2-aeae-e4a2348a4b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668918, "uuid": "aa04ba6b-0b30-4fdd-80bc-f3b826d7c86f", "value": "12288:Pk714718VuoHpH8/yx9HbG3uHXXxiu92pxN:M7e8Vhz7muHXX7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620668918, "uuid": "f177c004-f33c-4ea6-b1ea-98b40a80c1eb", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620668918, "uuid": "67c03306-326e-4856-8b6d-108eea377863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668918, "uuid": "d3b1c38c-4b2c-4528-9c43-c1425a37fc46", "value": "Purchase Order #330716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64c43d4-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673540, "uuid": "36ab24a4-33b0-41bd-8ee9-159c4d54535c", "comment": "Malware payload (Dridex)", "value": "22a0dea53c4ae1beaf8d4c8f8789141c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673540, "uuid": "26fafc13-5b0d-4db4-a1e2-e312ecc38755", "comment": "Malware payload (Dridex)", "value": "4b0149cfc4187e78dbe8306a7b441b9a1d08a24139d1e94de21aac0d82fb34c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673540, "uuid": "dbfcab61-e6fb-47ab-94b4-13b3a46afce4", "comment": "Malware payload (Dridex)", "value": "7409c7cce0f2bae54f74352005959feacb725490", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673540, "uuid": "c3f6a2bd-4c33-4868-8c34-8f2396045b66", "comment": "Malware payload (Dridex)", "value": "59c4ce7321bb5b154ac849a8b86487d93532c14654ae7fde9c5158e8a7f1703601d22d2fcdde77c528af8b7ec4ebb5bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673540, "uuid": "7f045619-cc0e-4d5f-bf67-b1144ef858e1", "value": "34F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673540, "uuid": "48bd7d89-403e-4bb2-b866-ca63f77bb6ee", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673540, "uuid": "18829ffc-a377-4d94-a7a9-f30e862e1389", "value": "3072:yesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:U4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673540, "uuid": "c31d85c5-0451-449f-994d-08ea46352ec0", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673540, "uuid": "7e8f80b9-8bfa-4e83-a2b6-f9950107b45a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673540, "uuid": "06885a2c-62bf-42ef-96af-c5ac2fe63f40", "value": "22a0dea5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6e5448-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620630706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630706, "uuid": "57d4c5fd-91d9-43e9-818d-8ecf6554a977", "comment": "Malware payload (SnakeKeylogger)", "value": "01013148b1d06aecc4f71995fc322184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630706, "uuid": "7e5f429f-8d81-40c6-a29f-a8834ebacf0e", "comment": "Malware payload (SnakeKeylogger)", "value": "4b7b2ffc5601d2ad59980bfdf5e9076e456d1a40ca5adde771952e4cdcfcfaec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630706, "uuid": "5349a4b7-87f9-40c5-b1d8-46d5fc5a0961", "comment": "Malware payload (SnakeKeylogger)", "value": "0c2fb82451ba31213bce9d62172362e9545611c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630706, "uuid": "a7d56346-9556-4f5c-b4af-135f7077326f", "comment": "Malware payload (SnakeKeylogger)", "value": "d74a49941360445631859d7a510f96e3a63e7af25344acf1c77aaa7684ce5e969fe76fc8c3ee2be4172e121501303659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630706, "uuid": "c8817c69-46fa-41af-b3e1-ede9c6986695", "value": "10E27365BF5A42BBDDBA8FB429E242421B74FDB6B8379B0F75B04408DC171479D03A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630706, "uuid": "efdacd26-ea75-4154-9739-1dbc30316954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630706, "uuid": "5b942297-04d5-4f1f-9486-ed2d2eddeecb", "value": "96:ym7Kqkn2k8hbSQiTkv3cbIHw70y+zwTZOjAhD9LaxzNta:gFa/EsHw7P+zwTZOjA/eTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630706, "uuid": "1baf0fe3-8146-4a4b-b642-f663a4061d12", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630706, "uuid": "9a0be4ac-bca0-48ab-a61e-09d43d6c664d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630706, "uuid": "f3594447-78e8-45ea-9c14-1dd326bbf175", "value": "New purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea0dfe0-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673608, "uuid": "92a7d187-f654-418b-81e5-4e2b92266b1a", "comment": "Malware payload (Dridex)", "value": "221e20e59f9887fe0ad9a88f8350adce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673608, "uuid": "034e020a-8b81-44ca-868f-060736fb44c0", "comment": "Malware payload (Dridex)", "value": "4bf7d94edf2b07ff0f68d254a4d691552c283a92f54662f30638b64cc69f2cc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673608, "uuid": "f578212e-a284-4318-8210-b0fe863588dc", "comment": "Malware payload (Dridex)", "value": "0f47d9e006e7e27b1b1912dd02a32ccfc8e3f7c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673608, "uuid": "da141f1a-ecfa-4f15-af07-04056889dc56", "comment": "Malware payload (Dridex)", "value": "5927e635b9a9697ce132de7a42385fa21913b617b028cc8bd7a0426521b76cbd68f9ac5eb3848409f56dad9c4c621330", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673608, "uuid": "53a3b849-4f19-4de3-8c67-a043b0746733", "value": "1CF3D0906A9BDF0ED9C13CF96A96A879B073458C811FDAB4D0DE84CEA4B75B34327113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673608, "uuid": "24fbaf62-7638-4df7-918d-63ebf1faaa4e", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673608, "uuid": "4f599c62-db31-4359-839a-343d953fbb87", "value": "3072:Fesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLEO:h4+VZQpt5hyPsa1ekiEbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673608, "uuid": "58414ee4-17ab-4805-b813-bc87e304840d", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673608, "uuid": "adbea5c9-1f6c-4525-a11d-04fea7eb5705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673608, "uuid": "7ee58acf-d337-40a7-9b7f-62a8acd73796", "value": "221e20e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870dcb6d-b167-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620634377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634377, "uuid": "b4d713b7-34b4-4467-848d-268ae3d3aca9", "comment": "Malware payload", "value": "86d2ec98c133811eb56505c966d30956", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634377, "uuid": "224a2cc9-25a6-4d31-a3b9-22ac9d91555e", "comment": "Malware payload", "value": "4c39fb13e1e03fe7f020f70c6c3c32906adb125924e44cb5c0c1ff8a068ac7e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634377, "uuid": "338e9a24-19c9-4457-b1d3-d3914e823266", "comment": "Malware payload", "value": "bc714eba2bba08e49f03b3a4a088d110cf9ae899", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634377, "uuid": "f1e40846-4b65-4a2c-9866-9fd1096548cb", "comment": "Malware payload", "value": "0540bf9969d6b5080e5f1bce44e745b91c88b9ca58c8614e026b347def4be42ff5b4cd14e8d91d038f7a4a31a01204be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634377, "uuid": "dbe45f68-940d-429e-8c10-b47086035a65", "value": "22442366573379A36EC1174DCB0C2938976E759B792DDEC4B8EBF8B2420E2763A1104C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634377, "uuid": "c2641652-8681-4a39-8290-5afe379fe284", "value": "6144:2ILwTB/l8whqQ/5u93BKTkzZCVTwDIGMWhMM0yh0BI6tnJ9s:2zTBtN5uhnoV8DIZWhMTQduJ9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620634377, "uuid": "2fb783c7-75f9-4305-99dc-0a47d5d18379", "value": 253753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620634377, "uuid": "d9997baf-07c6-4573-9586-55fcb27310e8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634377, "uuid": "29693cef-a497-43e2-912e-a1b7c8826cbb", "value": "86d2ec98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd95ff24-b152-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620625502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625502, "uuid": "57e5fe53-4819-47a6-9610-74dbd04426eb", "comment": "Malware payload (AgentTesla)", "value": "52cac8a55eba0dec84564f5a7942a45c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625502, "uuid": "1094dc8a-cb3f-4a3f-a46c-63025f9568c5", "comment": "Malware payload (AgentTesla)", "value": "4c52f2b312e5be2d215c9e2b7d16b15af31dc1984e299e9e58c3cc46cc6b5e78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625502, "uuid": "2a579ac4-a955-49de-82cc-cc0dec8d8021", "comment": "Malware payload (AgentTesla)", "value": "03b4738ec48332b74b5fd0d4f46f7db005189b4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625502, "uuid": "cffd720e-d171-4f27-b2f2-94525b5d6eaa", "comment": "Malware payload (AgentTesla)", "value": "ca8359cc3ca51ea4212135279b633823101e1d160cd454d8d9ff8669d218cb09f5cc79cf608074c5cc2aac90060ab7b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625502, "uuid": "9324f141-27e8-4931-ab31-915db977f8e3", "value": "7071E7A7993818D7EF9248C7DAF6FE6899F2B45200DB9ACCB1ACDA21074B3115F714C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625502, "uuid": "8103900e-c639-4345-becf-808b9c8b9c05", "value": "96:6XEdVV2YnqaW0pWnPQqeAFUw88EMlAT+ZETCs:60dVLzW6WnPQzJw88Ed5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625502, "uuid": "d0494501-9c41-4918-9a04-2bfe9276eb0d", "value": 3754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625502, "uuid": "6af95ed2-d651-4f4b-8edd-14a49bf2b5d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625502, "uuid": "6b9a97de-fdd7-4a00-86e6-b91f0ccd8aba", "value": "AL-FUTTAIM NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd4a69b-b152-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620625528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625528, "uuid": "beec3df3-f095-499f-ab63-88711970fe6d", "comment": "Malware payload (AgentTesla)", "value": "9791735355a3c0ee87b2962605adb585", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625528, "uuid": "514affd6-69cc-42b6-b80d-ffc309fa3fd7", "comment": "Malware payload (AgentTesla)", "value": "4c6138cdeed00c74dd4663f7f4ec7aa9f0ff58f8d566e62fb082193dbc247b94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625528, "uuid": "d28a9a62-4ee3-490d-a446-81bd0e02ee67", "comment": "Malware payload (AgentTesla)", "value": "01f8bb6aac102a776a6967b48fb9d33d4dc14ed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625528, "uuid": "8a4e3cd5-bcf6-4a16-b35b-feca3c4635a9", "comment": "Malware payload (AgentTesla)", "value": "e11a35538d36b5d39422b3e9c923fcdb666176bc3f701166e3aa64a403b7dc4c98bccf53470325af1406724f4db52ed8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625528, "uuid": "88c0b587-d4cd-4782-bf32-d21a8a3caa13", "value": "7D91F9B721580947CD97E0F4C972FD271696F6AED4CD0A84332DFEB0072F2125611006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625528, "uuid": "b01e82bd-d66c-4714-8fef-37d9a57812eb", "value": "96:nRH8+pmW6y6mvdFEeCBRnqMb4BoxDj1AwV2mME6a2TDYt:nl8YmiUao9e/k2Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625528, "uuid": "199fde67-beca-431f-8be9-928a244a0463", "value": 4315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625528, "uuid": "c5bcac93-f720-46a3-8375-e040a302ebb5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625528, "uuid": "5031f74b-77f3-404a-a0e6-c813bae407dd", "value": "NEW ORDER LIST.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c71b55-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662689, "uuid": "f0bdf1e5-1cf8-43de-bdc5-b0d6447b2e5d", "comment": "Malware payload (Dridex)", "value": "215bf29077d9a3110b6889f2e4191457", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662689, "uuid": "001310e1-b774-41ce-b87c-0bc4345154e2", "comment": "Malware payload (Dridex)", "value": "4cb695ec732eb8d982493ec403e129f2a4b63a6805448dba5aaa87b06910b6b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662689, "uuid": "fa2a9c90-e6db-4de1-88df-2619855e33cc", "comment": "Malware payload (Dridex)", "value": "74cfa1ca29b81f2955fa6369a3d1b0fe31626322", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662689, "uuid": "0e56b5a1-3b2f-4450-a97c-05bc2750b9ef", "comment": "Malware payload (Dridex)", "value": "8d39e3356249ff8aebf47b205f1d0ecc0f4751d4d2007941a81add695130e357349d5d303653371bffce121012bcf0d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662689, "uuid": "fb729ceb-dd4b-4981-9a77-814bc1590698", "value": "7EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662689, "uuid": "a4051584-c5ae-4692-ba9a-f9db0b5efa22", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662689, "uuid": "5766592e-b723-4e7d-bc5c-19912f493ea5", "value": "3072:RiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ieAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662689, "uuid": "3a94d48f-47ff-4e94-9344-f4d5fc052410", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662689, "uuid": "97ddd69b-796d-4a1f-90ba-eeb3f7f8c4b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662689, "uuid": "871fb36f-78a7-4620-b4aa-bb014f58f99a", "value": "215bf290_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9aa343-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620677018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677018, "uuid": "fb3f2858-b1f5-43a6-b659-c7fdb7590a6d", "comment": "Malware payload (Dridex)", "value": "ac22aad1ae454e0efc143689c1c66829", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677018, "uuid": "d398e2c1-b774-483f-8fde-66ab7f0a9e3d", "comment": "Malware payload (Dridex)", "value": "4cd6e3e0b26ac502d8eae637748690c6fe5b7330629086e166dbfd9c685bb440", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677018, "uuid": "04a58f32-1f05-49e4-b1fd-eb0721447371", "comment": "Malware payload (Dridex)", "value": "c002a90f0d501c451c398eab62bc29aa6fa2c30d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677018, "uuid": "c05abf88-7c38-4650-b0f9-255dea2a348f", "comment": "Malware payload (Dridex)", "value": "2401c8b06ee9e854457452e750cac21a048c83d948df157c2a3dab30ae1bed4fa2d03fa071c35af0a3227d572fa0160d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677018, "uuid": "fb8a2e4d-4127-4e86-ae6d-f089ba919f4d", "value": "5EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677018, "uuid": "4c89fc35-82a4-44dd-bdf0-107f62b7d37d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677018, "uuid": "a2ad2659-b85d-42ca-bbee-83b637f67f89", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620677018, "uuid": "ec0c55e2-665e-4a2a-9f37-f9020373c3ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620677018, "uuid": "60c179cd-cdcc-458d-96d8-edea2322cf72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677018, "uuid": "f54519b7-81af-4862-afed-94e1e2f442c7", "value": "ac22aad1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077a85da-b1c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673676, "uuid": "086bf72c-ba12-4218-b92b-9c4ba29fad6e", "comment": "Malware payload (Dridex)", "value": "e9027bbed687c5e2b3bf308d8d611e9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673676, "uuid": "5e56c8d2-6e63-4b29-a299-ac0be92c430f", "comment": "Malware payload (Dridex)", "value": "4cf302cbec3b98716f7aaf8cca7de0ae11c13104b19f3742a61fa42cc7bc3ca9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673676, "uuid": "8f03dbcb-e687-4ab6-9f72-66efe3b5a15e", "comment": "Malware payload (Dridex)", "value": "87367480cb0e4e20cc13b14ad093a5ad0147f66c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673676, "uuid": "aabbcd39-3a09-495f-bbee-c0445d822ae1", "comment": "Malware payload (Dridex)", "value": "7299090236a7d851a9d13149c267fed91ac3cf59e9ff60505f83c8279829c55eaa9315e032eee8a12d5d82429e2bf483", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673676, "uuid": "63617c4a-4ec4-4362-b76f-ac6fb4cc95bb", "value": "7BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673676, "uuid": "f86c9f8c-90e3-44c1-8937-2cdfd3a57985", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673676, "uuid": "9cd80103-2220-4829-8c5c-d5144fa07390", "value": "3072:Ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673676, "uuid": "cdb602e0-b59f-4ea8-9613-b8474fa6348b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673676, "uuid": "77fa6ac4-20a0-40ac-bcd5-e5c10d9dd08e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673676, "uuid": "c7745aab-cc9b-48d3-878f-f0ca0295e911", "value": "e9027bbe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd78068-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648102, "uuid": "3698eec4-2a57-4fa2-a9d7-7679b62743c5", "comment": "Malware payload (Dridex)", "value": "af8ab28c6a3961921f26e3eb9714b6ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648102, "uuid": "af11591b-405d-4d2e-8f45-c0fd20ddd23c", "comment": "Malware payload (Dridex)", "value": "4d531aea5115b64644c17d9862a24809513fffe68181f27feab4f9825d3bbcaf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648102, "uuid": "ddaf2892-d456-4021-aa18-733ae08f0156", "comment": "Malware payload (Dridex)", "value": "87da9bfb1fa5d1ee21b8ac6a41379b4a71b22eee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648102, "uuid": "7ce9a6d5-4b4f-4adf-98eb-ed9dce1877eb", "comment": "Malware payload (Dridex)", "value": "3add7187e2c6d696cd346604ce89c93503ae7b5adafbed704d8e6e5b792c2ca640651e1f1fecde1845ef2a42256e2a2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648102, "uuid": "b07e1f66-5a29-4cc2-8a21-9663314d6b35", "value": "A2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648102, "uuid": "41475469-b212-4bc9-a7b4-36655e103124", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648102, "uuid": "dacd35ca-459e-426d-a707-da918463603c", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648102, "uuid": "fabd7032-3c62-414c-8d98-7f51230c8ce3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648102, "uuid": "51bc73bb-f467-4ad2-8ef0-3247dd7a3e2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648102, "uuid": "895a647c-2322-432e-addb-8f68c7cb4047", "value": "af8ab28c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e8483e-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620652031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652031, "uuid": "a131b2a9-ca23-4670-b6b8-7cc8a5be3213", "comment": "Malware payload (Dridex)", "value": "6326c6e07520526f8aea39e978066f27", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652031, "uuid": "9f68816b-33c9-4319-a10d-a8bb6124a396", "comment": "Malware payload (Dridex)", "value": "4de7038f24e67411feeadebbaa2472450ea530f7cf62fdee47347c55ad2144a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652031, "uuid": "49f01522-64f5-4992-b74c-24a6fe416cc4", "comment": "Malware payload (Dridex)", "value": "c97cc5ec731d2ade99d15b44925573350f457a05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652031, "uuid": "10cb4590-cbc3-43fa-80e7-11678aba20cf", "comment": "Malware payload (Dridex)", "value": "cd90c12042c1ffc9a3262618cf24c81f91a7e56bf5c9fdc8b55af46e7bff9b4a442156c68c023edb631eaa5972e75459", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652031, "uuid": "cf40bd02-902b-401c-8e3d-b0bd52010ed0", "value": "DBF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652031, "uuid": "82e9c446-60b2-4533-bf23-8c3e9cb8027e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652031, "uuid": "e0629da2-1ecd-4e34-93bb-826545751d24", "value": "3072:rA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:r3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652031, "uuid": "e43a7a99-0bea-4124-95dd-f6c5e8b9af5e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652031, "uuid": "0b949dc8-05a1-4d44-84f3-d1df84c35944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652031, "uuid": "d3dab7f9-9635-4970-83e0-4dbde6345816", "value": "6326c6e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d392ff04-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673589, "uuid": "522136ce-ad15-4c47-9712-17bbfba470ec", "comment": "Malware payload (Dridex)", "value": "079c508f55b0f8b5f9177f6e26f2a16f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673589, "uuid": "6908e416-37ce-4238-8a83-cd8309593f67", "comment": "Malware payload (Dridex)", "value": "4e2b4f93e8659260abc943d6fdbe28c5d69ab5db5cf19917bc3bf6e37d58059d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673589, "uuid": "176201ce-ae59-400a-9067-e504fb027af3", "comment": "Malware payload (Dridex)", "value": "ae9fb024985d45baa92a88278615e0f020c3b0bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673589, "uuid": "210e5154-5c99-484b-a8c6-f7c260219ccc", "comment": "Malware payload (Dridex)", "value": "8572dd035b62305ad8bcc1946afd2a3225b0d6da4ded81e9ef0d970366003a8ffb9a80d01b1db89e718c1ed28ae58487", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673589, "uuid": "368df058-4ad9-442a-9ee7-3e585961ddc0", "value": "ACF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673589, "uuid": "fcfab448-08c8-478e-816e-452a3414ef44", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673589, "uuid": "180b4af6-24c5-4bc8-a9b0-8f9edfb37d9d", "value": "3072:j/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL8T:RbrE1kvcB74DXZ2MellT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673589, "uuid": "4277d258-c5df-4351-9366-b6f97ce6f2d3", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673589, "uuid": "dd4e2f57-f5e2-4505-aaf5-0fe7793d256c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673589, "uuid": "8fa28c57-3c0f-4e66-93d5-bda6aa794aa9", "value": "079c508f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c04521-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620670152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670152, "uuid": "5383071f-d27c-41fd-b65d-9df46273f188", "comment": "Malware payload (Dridex)", "value": "cd73088aa6d07843ca8a3b7876e79aab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670152, "uuid": "41f2df37-f745-4f10-9a95-189ca7a8c9f2", "comment": "Malware payload (Dridex)", "value": "4e63f69bcdd6ca789b2c56e44bf33a3014559c2b1f2104435aa498ad58a19ffe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670152, "uuid": "51f772b7-ee97-4f7b-ae14-5d1259a153fc", "comment": "Malware payload (Dridex)", "value": "9ce237791fd0888251c594764a9641d801aca3a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670152, "uuid": "2e339dae-6d16-4c3e-a8ec-b3311eab31ea", "comment": "Malware payload (Dridex)", "value": "b5b0c757c7e37abcce8ef372141f03e9414d0b46bbb5b29351fa08522370a181eadeaaa43074a00f1baf5064a8f51904", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670152, "uuid": "e1cf7915-a92f-4186-ba73-56e522c4192c", "value": "C974231D0C3DE111DD961871D23E0F969D3656E4D2CC2724EB42D0AE2F4ABC80AEBCA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670152, "uuid": "1031c0f3-4c94-4bcd-80f5-10cafc441f16", "value": "6144:LQmpaQ8XBfXDIL8UuMwQU4AJNbNCAn2CuJFfekr64v3qA3VSpxAnwYEz+uKOIcw:LQmp78xfY8ULnAhCAn2ZJ364vpKxA4zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620670152, "uuid": "4aa2022b-2f48-4bc4-a050-8176e745499b", "value": 344708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620670152, "uuid": "8b1219fb-1a01-4156-a3bd-29b79ba2eefa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670152, "uuid": "d3811db3-97be-4018-b53e-ef58e580df55", "value": "generated payment 593168.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28dc71b7-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629065, "uuid": "161e9b80-2e6f-4aa4-b908-91e51024ba58", "comment": "Malware payload (AgentTesla)", "value": "7cd8bf64a817275205cc13e0b9099ef0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629065, "uuid": "92770b17-0238-4f3d-91e0-5a27734016f6", "comment": "Malware payload (AgentTesla)", "value": "4e7247eb168024ba9ae235793ec27cbf576eaa5fc0ba2ace93ce5465336311f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629065, "uuid": "072be2fc-926c-431e-880d-533796043ccf", "comment": "Malware payload (AgentTesla)", "value": "39c912b42d98d5552b030a9aa8ddecb9da840f1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629065, "uuid": "a0053bab-8716-40e8-9740-af47eb1c545c", "comment": "Malware payload (AgentTesla)", "value": "e5002bc2dcc00ffea1cd347935eb6783015f4a582dd234034024b9414d2600bf3270eb26cb261f871d87adf82eb23af1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629065, "uuid": "53b93ffb-50df-402d-9478-8a16054b6ec4", "value": "20F4E02037D4AA58E5BF97761970C14423F2BA27C722C75E6ADD908E1E32746C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629065, "uuid": "d1b959c4-e77f-4f6e-8574-ad6fc9477cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629065, "uuid": "f09e7b5d-b995-4d8d-a157-d47616165e8c", "value": "12288:QA0k2k3X+nX9tBVw1hhh3W8j3CZPzH7DJ/SRbJbY/1KWD5hOBxyQnA+QoWubKg:QPFXnX9PGhhhGZV/8be/13VEBxyQnNWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629065, "uuid": "a39678b1-6eb9-48cc-bbb3-7d4ecb57c367", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629065, "uuid": "3475ba9d-0665-4c3f-aad0-71582758dbf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629065, "uuid": "4005fe25-1aea-4997-ad4d-b588574d078c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19417d7-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676968, "uuid": "bc9596af-c43c-4e4e-879c-ddf34f2efe36", "comment": "Malware payload (Dridex)", "value": "eb6cc6bacb828b7e20f7491d778ef71f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676968, "uuid": "0ac8184d-e79d-478b-8dc5-0eb3a3e47a8a", "comment": "Malware payload (Dridex)", "value": "4ec5f405017e4172208de7f84f7067691530dbcee2d088c134c47e628c18adf3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676968, "uuid": "b355abb4-341c-41f0-b5c8-4372627f1d16", "comment": "Malware payload (Dridex)", "value": "7a94ba4f4930e78a246812b42bc9fef4911d9a19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676968, "uuid": "671ac9d1-d7cc-4a10-b669-06af43fe96fc", "comment": "Malware payload (Dridex)", "value": "25b77998899d7393fed2d9a056728723fc41b6d83a4b20fafe7cca767c98382f21d7f979add7d77dde6c93d40c6e0cac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676968, "uuid": "40a6d71e-0fd1-4fb1-80d4-23c7f4fe8f7d", "value": "0DF3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676968, "uuid": "1ca4793d-4005-4854-ae7d-c08c2767e4f9", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676968, "uuid": "3987a186-c5b9-4dc9-a9f7-5e3f0c60949c", "value": "3072:UBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:QuXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676968, "uuid": "6cc1cc2b-956c-417b-b217-834120a1cf0b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676968, "uuid": "490f9ac7-f08c-435c-86e1-d2bd34fa51e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676968, "uuid": "3626bca0-3c89-4b9b-be98-3d506d07720c", "value": "eb6cc6ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22a3bb5-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620625000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625000, "uuid": "1a94e1ff-4793-46d2-b146-60c4627c34fb", "comment": "Malware payload (AgentTesla)", "value": "e0a5071b1fc5528e9c03aef4c6d31225", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625000, "uuid": "36c96e0f-d6b6-435f-bdc6-1b7a7d7c9d12", "comment": "Malware payload (AgentTesla)", "value": "4f4f6819151dac871b3419d1813627d42e6c167b5d124dd35bd1c18b3d20c7aa", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625000, "uuid": "f82f9b2e-16b7-4843-b395-108fceb67b9c", "comment": "Malware payload (AgentTesla)", "value": "778b6fb783821799f8cc7717419543f7d3b27f41", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625000, "uuid": "8f2c20bd-14bd-49b4-bb67-eeb0343621e1", "comment": "Malware payload (AgentTesla)", "value": "94b12e3b4a9eb15d1a38507af19a0369cbb5c1b21626fed13b448c9c09e5f31bfcf7280e32fe3b2f6648eaf2d2b857d4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625000, "uuid": "f739f1f2-aaee-423f-9678-7cb0e221f5b1", "value": "D2B42310721C5993777C2D6E7196CAC6AD80AE469C6694CC4021BA3CAE3B73B35DCBF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625000, "uuid": "e68b4304-9bd3-4f46-9b54-7770678ae5b1", "value": "6144:51wo42ukWg/4666S0wb6wVP6jLh95BJrPKKAYKZxK16MXZnrAb6ojOhAwt3fIxuV:51wo4ne/MTlN2T5rKKXKe6MtERDagwPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625000, "uuid": "8a17f005-b881-4df8-96c7-37f4e8d19bea", "value": 506039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625000, "uuid": "2c9f38a7-7185-4123-b3b3-212fec03f1ec", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625000, "uuid": "9b0c3330-3de7-4f41-963c-cd8985175382", "value": "BANK ACCOUNT DETAILS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1ee0c2-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649151, "uuid": "c0bb9a84-a263-4dbd-9fc2-60fc36fdf1ca", "comment": "Malware payload (AgentTesla)", "value": "04885cbb30d0fca755788e87af181dcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649151, "uuid": "aaeb638d-0c91-47a0-9dbe-8b92568debf1", "comment": "Malware payload (AgentTesla)", "value": "4f6160e4c934ebea2ec7628b06c97b7995d0b4378f817adfadb15c90c3edb202", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649151, "uuid": "f43948ce-43e4-4e89-8114-d8a27cd6156a", "comment": "Malware payload (AgentTesla)", "value": "6dc11b68ba3868fc71dcf6224c819328111ccd06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649151, "uuid": "2a6e9ffc-4070-4696-a079-01904ac43258", "comment": "Malware payload (AgentTesla)", "value": "b3591887fc54de9edac436b4a8c093b2fec6d7f450f85605f7647ee188dc33569fd2d0a764374c909355b24da576027a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649151, "uuid": "f058386c-2074-4fa7-985a-0af4354222a2", "value": "39056BAC715459F1D36B1E7763CF1C0243652174683BEA0E8BA013FA5A67F172E3898E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649151, "uuid": "55dccc5a-0a40-451f-8e45-a67f37d32bf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649151, "uuid": "d9e04e36-bd87-4636-a235-73e4e384af1c", "value": "12288:zAUpEkkooLLoS60/K7yh0pKwt/uZeNsfIbETS4XjyZ0ZDG:MUpEkkooLApKamZeN5dSjyZwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649151, "uuid": "c8fab382-cd5f-4ec3-9120-7337c5612b89", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649151, "uuid": "d67f898f-5de9-4558-919a-9e0eee11dabd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649151, "uuid": "98dec8d1-06ca-499b-b09f-9a769e7f4f88", "value": "Dane bankowe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770cc1aa-b155-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620626619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626619, "uuid": "34d07176-0855-4214-9c2d-0b677c4d0cae", "comment": "Malware payload (Dridex)", "value": "970763859364f12604a529fb187e8e9b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626619, "uuid": "d2c44f31-47ac-47af-934b-500b44555a57", "comment": "Malware payload (Dridex)", "value": "4fe5a7ce168c3f0c00667a254119c84b0baa472781b17b974de2e2c63437e632", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626619, "uuid": "43ebb5e0-b202-4205-960c-e27bff7dd647", "comment": "Malware payload (Dridex)", "value": "3c121643e3977dc98d855a6311e9008453199b66", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626619, "uuid": "bd878ebc-a40b-4933-b47c-7ff94cac093b", "comment": "Malware payload (Dridex)", "value": "1bb62094e145f454bc782fd7352fbbf6b58186a66f1114de20ff44e9e9eb19f3c1fc81dcf480301f94e7cf2c94ee0c06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626619, "uuid": "888202b1-eb21-476c-800b-020f8641ff15", "value": "25F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626619, "uuid": "47842cdd-d929-4120-9ca5-51e656d3ae11", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626619, "uuid": "171193f3-3394-4d2b-b831-061d77ec7e99", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620626619, "uuid": "8145c427-1f46-4b12-ba2a-dc336a2c1cb9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620626619, "uuid": "df1f2b46-2756-405f-adaf-0f46922ec8b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626619, "uuid": "a97b31d5-4617-4b68-bd5a-fef6e19843ac", "value": "97076385_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d22edce-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620649016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649016, "uuid": "05227f81-2ead-4b73-b3f2-442ea0913e9d", "comment": "Malware payload (Formbook)", "value": "306237cff93b7d61b1f72c400a9522e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649016, "uuid": "476fcfc1-63f7-436d-8b64-730c5d2f89bb", "comment": "Malware payload (Formbook)", "value": "4ffd8307eca6e6b382c035cb0ad32e52f37f9180e092764d6224d97557ef8ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649016, "uuid": "f7c50281-c34b-477f-9335-cfa1c517b4da", "comment": "Malware payload (Formbook)", "value": "aa8942a24452ac6e95feb05f1a5038d006f08c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649016, "uuid": "4dd84225-55e3-4832-aad3-5b523232a91b", "comment": "Malware payload (Formbook)", "value": "9cb180dfeecb29cf7837dfe19206f6f48a77c059f44a39f55206e642c9fb6e5a070e41609bd377ea3e5a4833a4e06274", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649016, "uuid": "7c9501c0-b8cf-44aa-8b38-39f1f2ad1ca8", "value": "93253850B1439AECD87E26F1D6DCDC7891E5EDA28E11D2BDD69833684738F4E41EC222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649016, "uuid": "6f2e4328-3cf4-45b1-a9bc-becadfe13f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649016, "uuid": "04546c89-72e1-45a6-b19b-bff3143a4957", "value": "12288:HDoTjD7wGGPBVw9hhhxCg7OlOAiSyHesKvOFfYTFEwPAI9S93hwC3yezPcvFXXZH:jIzq2hhhxCHlOA6+s2Ti3hfL2FXXZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649016, "uuid": "eec8f9ff-9d90-49e2-a696-1bac62ca7a6b", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649016, "uuid": "0208c2c6-2c1c-4fb7-b69b-0e6502150352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649016, "uuid": "f2b6bb15-1217-4d5a-8e0f-61b5323c4a4a", "value": "T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdb7b18-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620680529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680529, "uuid": "592b5edc-bac8-4519-8d0c-541da719e108", "comment": "Malware payload", "value": "27e9c383d57016836a066d9de26dfcb7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680529, "uuid": "389e4606-9909-4a82-b6d8-2f23a44a98a9", "comment": "Malware payload", "value": "5003ad45419487e108639baa408b7781b59fb30a85308343269c788b2c626daf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680529, "uuid": "61a9f8cb-4d77-4ec4-bb36-abaad5169384", "comment": "Malware payload", "value": "aae9540a6b6af7277ccafc252c56a92f75e540fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680529, "uuid": "0a7caecf-dbb2-4113-be57-961f30481025", "comment": "Malware payload", "value": "a0550afb4d9e0dde0ab7e0e79b6b19c939341a4d42058b3a3bcd43d4d8ef48180f5e3662db91ec81082e6f78abe28270", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680529, "uuid": "47e5eee7-0e54-4082-b1c4-655a15a2deef", "value": "64F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680529, "uuid": "34866801-648d-4dd1-8608-c86ec36ed712", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680529, "uuid": "b10aedaf-5733-4aa9-9e03-c1d351371a6a", "value": "3072:1IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Oc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680529, "uuid": "bc357a26-4539-4092-ae0c-ab6812364ba2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680529, "uuid": "810fbfc9-b4ef-4eb3-af6f-61ab7ce32390", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680529, "uuid": "3dc23770-33d5-42a5-9c2d-53c91f25052d", "value": "27e9c383_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd94e6f1-b18c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620650467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650467, "uuid": "67d55a06-1952-4a47-996b-4ce9d17fdc30", "comment": "Malware payload (Formbook)", "value": "4d33cdb280dff7561f9d2f263b58e858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650467, "uuid": "323d5ebf-126d-474b-84c4-e74d25f4de4b", "comment": "Malware payload (Formbook)", "value": "501ba71db36e9fde4d0c6a8bde7734dfb5cfd5391452d301033918e0c491ebdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650467, "uuid": "3bc372cd-45a8-4869-a053-9227885e8eee", "comment": "Malware payload (Formbook)", "value": "c3ca8690ca00fd723d762faade7fb9ac4a60fa4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650467, "uuid": "93f61844-0206-4487-abfc-f98f4267d6d9", "comment": "Malware payload (Formbook)", "value": "5db54455820e73cca0b998fc57e7b12e971db38324f030c818515653de766489cf73ca86fbfa52a85e05130b05554a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650467, "uuid": "d614d715-4bc4-4a61-91a1-2e7da26de9b9", "value": "A5F4CF253388AF56D47E67391570441013F2BE07CB31EA4DBDE6A9DE0AB2F508627B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650467, "uuid": "b12350b3-b7cc-4d58-a432-6da61f2990c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650467, "uuid": "d78cffbc-44b2-43ac-963e-47b2751822cb", "value": "12288:qT73Os2iWeKs0/YfZT1c1eNpwf9V7k1VabH519vP7M:qv3OdiWufJMeNoeMH57H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650467, "uuid": "61117678-69ed-4056-ac53-6dc53725788d", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650467, "uuid": "3c0c5066-dbe1-4ed3-bd3a-bfd99a9b9f26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650467, "uuid": "68a0b1ef-81e4-4260-9537-a77812fadab7", "value": "correct invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af842c4-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620669441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669441, "uuid": "b997ec4d-8b8b-4b07-83dc-4fdb1b1ed4ef", "comment": "Malware payload (Formbook)", "value": "7243904b0c804c957dd07dc3afb75b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669441, "uuid": "f516e6cf-ba2c-4aed-b4f9-af887d824691", "comment": "Malware payload (Formbook)", "value": "503660af16b89ea2dcb7afa3537cfff0df5cbc3a3f036e4aa7bbd39783cd8df9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669441, "uuid": "58d509ea-eb7f-4d91-8572-20b74f12d0de", "comment": "Malware payload (Formbook)", "value": "9d26cd3afc5d41aa85dc3588821f0d86dd4e004d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669441, "uuid": "96da4a29-4181-4c8f-bbf8-9c89e677149b", "comment": "Malware payload (Formbook)", "value": "4b8f7f3bfede4a453934460cdf6ce710a4cc3911912673976e57065db2c0df61a97474fc022bc8c2ca1a119fc2d63186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669441, "uuid": "d1477956-7879-4c7b-92ee-7d07b77221d3", "value": "74D4E02123989F64E17E973E80B1000493F5F41BD765EA8EFE9850ED7872F819762B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669441, "uuid": "e632fa48-4ed5-4be4-88ae-be8e3f890685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669441, "uuid": "140562dc-0598-4be5-bb00-ba673c14c6b8", "value": "12288:EA1wjORxyuPcOWzgW7gp7JtsTJT/LD7fEwv4e6o1:xejORxdHuM7fsTJfDgwn6o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669441, "uuid": "4c8087c1-0d3a-4999-92cf-2cf57ecb8b30", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669441, "uuid": "136611de-54cf-4db8-8263-474d75057b1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669441, "uuid": "58384e55-75d4-4f62-99e6-981e88f5d3b9", "value": "PURCHASE ORDER REQUIREMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffe8831-b13c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620615950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615950, "uuid": "c0f39603-f865-4245-8361-e44768421b25", "comment": "Malware payload (Dridex)", "value": "b4a8c273328e5b27e6d903195c21a94e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615950, "uuid": "fecf1dca-00a7-405d-8076-e54dc4c78aa3", "comment": "Malware payload (Dridex)", "value": "5061afbb0014ec5af5bcbfd874dd25e8d953943f0cdc31d3cc0efd9252aab475", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615950, "uuid": "0f69fb2e-f2be-4dc8-bf9d-c31af073216f", "comment": "Malware payload (Dridex)", "value": "ccaf2a52be1889ea65ce7b6ca6eb8d8125845926", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615950, "uuid": "c2022247-551d-4ca3-9987-4150f10af519", "comment": "Malware payload (Dridex)", "value": "8c904d59433596a9fbb63dbc1ac26a3354ff1846ff965ddd7490dd830f011022f60141c59930a6fcbfc5524285054fdb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615950, "uuid": "c56a9d74-4e65-4712-8aee-7709528f44e5", "value": "B5F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615950, "uuid": "43d16b1d-e724-4e2b-948c-6b9375a4910f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615950, "uuid": "cc712d78-618b-4a0c-bdd7-216b9373eeff", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620615950, "uuid": "12412a05-0cc0-4d14-86bd-750d8e3ce6b7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620615950, "uuid": "97ffd651-4015-4fad-9e01-e0b575488901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615950, "uuid": "944ac8ab-7785-4962-8a3e-e55f00b31c4a", "value": "b4a8c273_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f261de5e-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620659038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659038, "uuid": "c17107d0-ff83-4ea1-98a8-b8534e1740a3", "comment": "Malware payload (Dridex)", "value": "bbcab79109ac8cd5d082b94b7ea46f53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659038, "uuid": "2cf0a563-a886-419c-bb66-449bbdb8c800", "comment": "Malware payload (Dridex)", "value": "508c9674038df309f9e61bce6e25a0275a2577924af09c98758232c8baf0e4b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659038, "uuid": "ee0f08ad-a781-4097-874a-3c12a38a9e15", "comment": "Malware payload (Dridex)", "value": "467ba34ccee85b5316153dcd58e0defc83e79e31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659038, "uuid": "c64fff05-2557-4735-8431-b804ac672916", "comment": "Malware payload (Dridex)", "value": "a78662e5ad35956e9d1178ae20bebd5fcabde9edd9975d6bfe766c632f861df0bcbf6b800719bf60f97939737f8d69df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659038, "uuid": "0fded74e-f1b0-42b6-bcf7-94555be808f7", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659038, "uuid": "c53215cb-a08f-4dd6-9ddd-f03d50ad2f79", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659038, "uuid": "f6f6f07b-d1c1-449f-b37b-cce413f3a451", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620659038, "uuid": "42667ec8-b2e3-4cef-af0c-2cb6b7734ef4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620659038, "uuid": "c005b964-5546-448c-b27b-6db892d6da2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659038, "uuid": "3f7fc65c-2ca8-4b80-a8c9-2bd304862cf1", "value": "bbcab791_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc93e757-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620658948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658948, "uuid": "1b6adeb5-a279-4837-b11e-aa97ddfb289c", "comment": "Malware payload (AgentTesla)", "value": "33aee36c7a8ff56550d39c6e35cfd0c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658948, "uuid": "bf6ee242-c560-4a67-8c0f-f37b53c82ad1", "comment": "Malware payload (AgentTesla)", "value": "50f90f15051f6b67b24f50b1f339e8eb40a513ce175f5ce12f6f2a7341d1785b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658948, "uuid": "923dda1f-40ce-49e8-b7db-8782b7b1bdc6", "comment": "Malware payload (AgentTesla)", "value": "7a8f4fac05475e3f0b337212f2bb88797361a19d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658948, "uuid": "607bb612-39a7-430d-be6f-2bf69ca3a41f", "comment": "Malware payload (AgentTesla)", "value": "462f8303a408dd65384e199ae6fa2a531da8c3d64d734361f8d210d888996bd97b8033784d1bc35dca342286be721bf1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658948, "uuid": "26888a61-a60a-4e08-9ff9-03436b1407f0", "value": "D125F7AC721071EEC657CC23DBDA1C159610217AA72FD607932303BD9A0EE57AF385E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658948, "uuid": "cdd10368-d23b-4b4a-a9fa-8edf8c3557eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658948, "uuid": "87f4e655-6529-48da-9c31-bdf025b604d1", "value": "12288:qFHWwKkty2Wi6YoLLoS60/K7yh0g7YRAaNcF6xcXle0nLzi/piqvbcv3evime2p8:4WwHJBoLAJ7N1w2/DvK3eFjpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658948, "uuid": "be8139e3-726e-4f55-8c07-61f366b13555", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658948, "uuid": "73f43e9a-838e-4145-9400-45985f4f4fdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658948, "uuid": "cf45ef12-85e1-42ac-9d1e-46cc80babbb6", "value": "33aee36c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e773e28d-b161-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620631961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631961, "uuid": "490c8e72-6609-45ff-ae48-eb42b2144257", "comment": "Malware payload (AgentTesla)", "value": "3ce5383021add82345300728bcba5e72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631961, "uuid": "1918aa9b-e049-4899-9231-1795486a502f", "comment": "Malware payload (AgentTesla)", "value": "50ff82d9c393d9ce0a664dccc013394f364e662227ea5358df6a66e80d64176d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631961, "uuid": "3049ec2c-9941-4480-a2bc-afc12948274c", "comment": "Malware payload (AgentTesla)", "value": "f0458abe488df3ba0591ea0a8fce1309e24d5853", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620631961, "uuid": "660d8d80-2248-47da-8c59-74840ee999c5", "comment": "Malware payload (AgentTesla)", "value": "f2c047ec68f79238b1ebd30d08c54eefbc36c4ff6f6a77713cae17f17d2982333546395ec89a425c85ceefa7fdeddf13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631961, "uuid": "b98eecb6-0a31-4864-bdb0-060ac1056c80", "value": "F305DF203BD8AA48E5BF57752970C54063F2BA17D732CA5E6D9EA04E1E32782C772713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631961, "uuid": "f84f8f27-5fb2-4947-87f1-efb9b1ce4a7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631961, "uuid": "e99b182a-e74a-48a0-b6db-b458d27d323d", "value": "12288:RwqR0Te97XwtBVw1hhhMr81nhhWjG/xPG/8OiYOpxTuq16j:R597XwPGhhhMGhsuxPGV0xaq16j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620631961, "uuid": "85f26ad9-8052-4f55-8f21-b765a8844ba1", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620631961, "uuid": "2ff9ccc2-0dbe-462a-87b0-9852ca13e029", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620631961, "uuid": "28d8aec4-7519-4b05-9e8e-56edfc0942b6", "value": "3ce5383021add82345300728bcba5e72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe94bc29-b14c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620622981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620622981, "uuid": "42416dc5-6891-4452-b5b0-ec927b103357", "comment": "Malware payload (AgentTesla)", "value": "a127259567201bd844e1d2e947aae1a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620622981, "uuid": "32ee1c9b-88f2-4d2b-89e2-3455e2b51cfa", "comment": "Malware payload (AgentTesla)", "value": "514eafb249e57467701d283fa0dea7af7c4761d6f60da2cbc7348c65e0c11501", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620622981, "uuid": "b1e456e6-78bc-4b32-97a7-861fdef0a060", "comment": "Malware payload (AgentTesla)", "value": "52196a873cd84d04d4afcfe614255f14efdd3023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620622981, "uuid": "06d67fe0-420d-40db-81e6-2fd02ad09950", "comment": "Malware payload (AgentTesla)", "value": "efa2cb28a57a56ba59e9d08ffac4c4470bf4d8f742f8e12c4bb103678416fbb07cb9f00d79208f8f234e4bbb847fd668", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620622981, "uuid": "4a336680-0c82-44a2-aaf8-c0184633873e", "value": "C2F4BE253398AF61D43E67391131051013F2BD0BDB32E98D7DF6B8DA5AB2F418626B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620622981, "uuid": "7920bc2f-4710-401f-835b-1e2ee7243c99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620622981, "uuid": "86da398b-cf76-4841-92ef-fcf05b3fc540", "value": "12288:3Mcjs77vz+YrMYbbcZkioedjVdnmBzJEyDpvLJKXM:M7D4Y/asebdmBzJLDNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620622981, "uuid": "038650f0-d34d-4dd3-9949-40039a0b96e5", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620622981, "uuid": "08e57128-4bbe-43b9-9509-07908ac59e60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620622981, "uuid": "c649bc4c-53a6-43b8-9e1e-fdbf98fd0b94", "value": "a1272595_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b50a82c-b123-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620605044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605044, "uuid": "b9bae0b8-85ef-44b3-aedb-3f011446723e", "comment": "Malware payload (Dridex)", "value": "d64c4a5ceb5b7e804594af210855717f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605044, "uuid": "1cd587bf-194c-42be-877a-27569c80a631", "comment": "Malware payload (Dridex)", "value": "5190037a129f5f5ad2032ff4c1bfd188fa471e0f88ad10f825263729ca409e66", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605044, "uuid": "e7fc4663-2479-4d25-8209-7627fdb5eb0a", "comment": "Malware payload (Dridex)", "value": "0dac3506353fafa0cfea97a7da8e56b4b25a05f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605044, "uuid": "e4e4a40f-c93d-4e14-814f-4f1cbf77915f", "comment": "Malware payload (Dridex)", "value": "95d868e61ebee6c2dcbb884ab60d7b41fa2c88405b71bf609fa46cec365a55503042bc6722f493d23ff7bfee346defcb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605044, "uuid": "2c1e163b-80a7-4e39-9219-97326f101d25", "value": "B3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605044, "uuid": "82f63154-775f-4959-802c-d12f36824e33", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605044, "uuid": "f27a0f18-f9a5-4114-a5b5-b0dbdcdc440a", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620605044, "uuid": "d8734fc5-73fe-43e6-9caf-65b1fbad6878", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620605044, "uuid": "eede6cd0-35c9-45f7-af85-bfc086fea3e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605044, "uuid": "e5995de0-92da-495e-a3e2-341fd5e1cfb9", "value": "d64c4a5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dad43a-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644572, "uuid": "7e350091-0c26-4381-9c90-bd6b5e9c2f1f", "comment": "Malware payload (Dridex)", "value": "f521276eadf7a209f74d7214e1498755", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644572, "uuid": "a8528d2d-5add-4226-9a10-aa12578bfd5a", "comment": "Malware payload (Dridex)", "value": "5190b41fc1842715a6380beb59c3c176cabc34868e287833854e9bf4e47e5f64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644572, "uuid": "b61ce252-5fd3-43fb-8808-daf91639ac4e", "comment": "Malware payload (Dridex)", "value": "e3b63756b269ef2e6ce89955a51e176f90aa59be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644572, "uuid": "a67312af-680f-4cf8-aad5-7fe6d039773c", "comment": "Malware payload (Dridex)", "value": "8261376f19870da386ed0f441c89a4008ce37b7f01e4ebaea474ea28f921730f8324383809f153e15f79c2649e320ffb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644572, "uuid": "799f4a76-ea7f-4c00-b35d-6f426af96291", "value": "82F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644572, "uuid": "bedfc846-655e-4935-b0d5-761db99774b4", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644572, "uuid": "a5ff28e1-aa57-47eb-bdb9-1358652288e0", "value": "3072:YuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:Y0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644572, "uuid": "629e4116-318c-41d6-b61c-c8e605a81074", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644572, "uuid": "fc0b9b5d-4f3b-4929-adaa-c25c43d6e6b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644572, "uuid": "48b01374-baf2-47df-8995-889ce19d2822", "value": "f521276e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065ab007-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620650911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650911, "uuid": "4ce5f789-67ee-489c-bb29-a1678e011418", "comment": "Malware payload (AveMariaRAT)", "value": "e21310485bca1bd298ef70efd23789bc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650911, "uuid": "a171121b-3f3d-4078-bca8-6ddef579740a", "comment": "Malware payload (AveMariaRAT)", "value": "51ccbc195992f34ea45014f5f2f47d13f5c2b6332af858ac81608997bc8e0745", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650911, "uuid": "c4baa0d7-9765-4cb7-ad9c-47eb04c11228", "comment": "Malware payload (AveMariaRAT)", "value": "0c89a55cfcc2f542923045767c6df0cc3bae3504", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650911, "uuid": "b4d8ee3e-65c1-460e-87a6-fb4bfa3745df", "comment": "Malware payload (AveMariaRAT)", "value": "605fcd958443157b1f1ef13635d5490267c7438a8d02907eb0002ebbe42a97def0700fd7fbf325691e006b26d6b18988", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650911, "uuid": "675fa521-e8de-4a0c-854f-669a45300ce0", "value": "C653EB483BD0A462024F5F7FB726A4F1F5599CB9799C0C9B8A00BC94A45D634B6E3B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650911, "uuid": "0644f725-049d-424d-91e5-eac2bacaf9f7", "value": "768:P5UwyNOYcRNPOqVe90SIh5VOn2QeUlh3gJkMt+3DDf36u2+ElXvXQ44CwGvUDhci:ewxXRNPOqVe9VnVeSO//Qk3sVcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650911, "uuid": "160cb2a4-c7b7-4bfb-af08-ea5fa4378ef3", "value": 62940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650911, "uuid": "974902ec-aeab-4fa6-bac4-5a314485adef", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650911, "uuid": "422704a7-1388-454c-b405-4b8517086d3c", "value": "SKM_Rate_MyOkko_3236858149685_Scan.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83756161-b1b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620667442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667442, "uuid": "c1dcc6a2-1d3b-4d9f-a1b3-58cde46eb5be", "comment": "Malware payload (Gozi)", "value": "b2715b04c731c53b81b7edad1299413a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667442, "uuid": "8144f9b1-eba7-48a3-b5cb-e667cddcc192", "comment": "Malware payload (Gozi)", "value": "51cfaf0e7df40e783d3636b6768fed03261cee616cc84b62da787ec4520739c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667442, "uuid": "83b727d3-a0b5-4baa-84ac-539a7cea9a53", "comment": "Malware payload (Gozi)", "value": "019c266985428e328b1efb26e803954ad9229c83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667442, "uuid": "bf6b79fe-343c-4106-b3e4-123424e913bb", "comment": "Malware payload (Gozi)", "value": "ddeaa0ed71b2c5e7deb8e68091084feae5ff69cebae6b7ef856d10da3fec11aa6c456ac016fcac1b73bb93c70c8b5ab4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667442, "uuid": "8837b4ab-c3c0-44c9-b524-3b719f5ce627", "value": "250462BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667442, "uuid": "e1fa3983-790d-41af-ac71-9fcdeec31a50", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667442, "uuid": "a223c830-395b-481a-9878-2b2160b7b30c", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667442, "uuid": "0fa13cc9-1053-465a-8bb7-431ce2e10365", "value": 187429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667442, "uuid": "73dec534-959f-4b15-b70a-be6c08f2af7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667442, "uuid": "d91b4756-bcf9-451d-abdc-71543f65e3c9", "value": "b2715b04c731c53b81b7edad1299413a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500c6941-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637291, "uuid": "ca286037-3b6b-4b2f-b7c3-289b891c6580", "comment": "Malware payload (Dridex)", "value": "a577064d5b85f1d23fff7cd891dd1e46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637291, "uuid": "a9d433ee-9c02-4bd0-aed7-1a64c84bbd77", "comment": "Malware payload (Dridex)", "value": "5252d3cecdfcdfbf748a0fc77d1f70f86408a6a9957b5ee1135e3a2e7e318f7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637291, "uuid": "78d1a86a-1b1e-4fd3-a656-57150f0c1478", "comment": "Malware payload (Dridex)", "value": "8cb975060209c35697e56cd2dd1c7e9cbc3877ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637291, "uuid": "cd32c0fd-6cbe-4325-bdb0-3c48a15f13cd", "comment": "Malware payload (Dridex)", "value": "7b89e31f12dd05356dcc268075f22f0c02564379b4ae42fbe9aa5a00b64ee782ea7ae88ee890b0bd337fad367b3ef0f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637291, "uuid": "4247693e-3b4d-4a7d-88fe-13732a298883", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637291, "uuid": "f82d152b-1b4c-41ec-aff0-c108cf2e4576", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637291, "uuid": "0eabc858-4fd3-404c-b0c9-62cad2620070", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637291, "uuid": "dc06cefe-3b9c-4ba1-99d2-f8d5da8592ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637291, "uuid": "5a0a9a5d-a3ce-4c94-9663-8adb417deedb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637291, "uuid": "e0367d40-0aed-4cd8-b36c-c8b5198fe9e4", "value": "a577064d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10df79dc-b1c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673692, "uuid": "80ca01e3-70e3-4ed4-a205-a83175a15f8a", "comment": "Malware payload (Dridex)", "value": "09d50444e7230152ba4cd4b786b05129", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673692, "uuid": "cd03682f-300c-41a5-a008-8d035c2c6c41", "comment": "Malware payload (Dridex)", "value": "52a36b6a011d18961cd9696439f50dff2d409bf21b97f392e33bfe68f1567106", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673692, "uuid": "95f9f7b3-5bba-417b-b6f9-7384ff7bce74", "comment": "Malware payload (Dridex)", "value": "4b77a8f183b4ca3e21da8f73e5a6b661434d142b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673692, "uuid": "37534009-e830-46a3-89dd-12c980f78786", "comment": "Malware payload (Dridex)", "value": "1fe5e8dec73d642472e1dafdff4555995b682f92af3d91b95c8b327b6987a02d08e53169346a06ba577be8a1f100cd46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673692, "uuid": "28c720e8-b54b-4f44-af26-4f10a6ba8b8a", "value": "1AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673692, "uuid": "284afa9d-68da-4d0e-a1e7-c6283da69b33", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673692, "uuid": "cfd2d74a-34a3-48ee-85d7-5d0f4340512a", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673692, "uuid": "4d27acf6-4046-498a-a1e8-b8dbb50bb669", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673692, "uuid": "3681aaae-5b35-4703-8862-f3e64e1e4d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673692, "uuid": "8e6ae643-d6ce-43a1-bca6-bc38137e4c96", "value": "09d50444_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70161ca-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676977, "uuid": "f05851f1-d0d5-40dc-b189-4ed64e369801", "comment": "Malware payload (Dridex)", "value": "04b2f9c182937ea710f323aec2fb4ed6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676977, "uuid": "82840fe0-da07-46ec-9260-c5c6bdf3729d", "comment": "Malware payload (Dridex)", "value": "52c12213ccb419d83764dbfb4262772aa9a769348424754e5b874c20e9ed51d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676977, "uuid": "fc424336-f308-41ad-a93d-fddbf33dee5d", "comment": "Malware payload (Dridex)", "value": "9cf9174ed3ae5a8a75f3eeb8868666717f7444db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676977, "uuid": "adb45c45-4bf9-40ed-9529-20683818a4a8", "comment": "Malware payload (Dridex)", "value": "ef79b25c85d7b1b83cec3009bc10cb7ae5d6a2aea829a659f443071599bd094802fcf3a969088250513ce0e267f78350", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676977, "uuid": "afa8478c-0d86-4e4e-9c25-cc4a96261b1e", "value": "58F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676977, "uuid": "826981a1-6faa-4921-b3a6-c471b689c8ed", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676977, "uuid": "dce25c52-7170-4a51-b771-6641c2ba24e3", "value": "3072:tiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:2eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676977, "uuid": "62b2229f-bee3-41a0-83b9-8be1bd096403", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676977, "uuid": "5c1521b5-a3f4-45db-b62b-677b77f17592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676977, "uuid": "057095c6-a040-455b-ad20-d6ee3c8ae996", "value": "04b2f9c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac1e92a-b1a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620662488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662488, "uuid": "d9bf4e90-c3cc-4110-90ed-3229fc31238c", "comment": "Malware payload (njrat)", "value": "2a8f04ddc03f8c4db0821275619b55b4", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662488, "uuid": "a9b839f4-9bb3-47ed-8e43-aa5b30f50142", "comment": "Malware payload (njrat)", "value": "531471184d5c8eb4ec97c12059b5bbc8f397b3749033f7fd80405a1b560fbb17", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662488, "uuid": "d7907cd0-d023-46f6-bc33-26bee6e7c2fd", "comment": "Malware payload (njrat)", "value": "8bf21477518f4f33bbd9f1a0f013302be516ea53", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662488, "uuid": "ac7b78b1-b075-41d3-8879-79dcd0eab3a5", "comment": "Malware payload (njrat)", "value": "1a811193956d2ddab916d28112b14ce538f3e0036966c4b0deb704654ac3b93bb03e8fb1e17a1052229d63d92a0b828a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662488, "uuid": "0b667eeb-bb4f-4fe5-bf76-9c8c8b94ff0a", "value": "84137B47ED156D43E09A93B9FF420EE4A7580599F50232FD38BE1CC62BA02437E6A53D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662488, "uuid": "efba5a5c-dca4-495c-af9c-4bea5bf85c4d", "value": "768:i3KZ+eSvs9DBZdEC+iyNaVY2gCB38r8+akw6LdbH:iSSvs9DEjaVY2gG38MH6LtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662488, "uuid": "356439a4-6413-478e-9b05-12ebb64a66c2", "value": 44143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662488, "uuid": "b87752d7-d7f6-419e-b35a-ee34cdefb9e6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662488, "uuid": "753e1f36-e8d6-4012-9048-b4918ef3387a", "value": "2a8f04dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cf7b54-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637270, "uuid": "fbc540c8-7276-4e07-b05c-3e3b2b910ec2", "comment": "Malware payload (Dridex)", "value": "dc9ae9b6c69f8591c55a83b8e36081c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637270, "uuid": "1228cb59-828b-48f8-a50e-dc36cd7bd5f1", "comment": "Malware payload (Dridex)", "value": "534b1c441f17b4d4d9dec76f955b133f8a7887eeed6e85ae9d65a75db3822076", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637270, "uuid": "aa93db55-bda0-4841-b0af-679b572c8fa1", "comment": "Malware payload (Dridex)", "value": "fdc96c72e9b77189827047b9dae91cefe5cb9fa3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637270, "uuid": "1ec679a2-3dd0-4ee1-a55e-c6ca571999ca", "comment": "Malware payload (Dridex)", "value": "703afe97897f5675b9c2340d4b06a9d0cbaa2354a3701cac16d9a3aa85d841a27458f45cb50e7521424ac37b207f1404", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637270, "uuid": "c89ced66-1109-48b1-a5a5-f5c3bafb1b31", "value": "04F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637270, "uuid": "f7c128b9-5016-4b63-b698-cde6e1d2cb88", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637270, "uuid": "20aad9d7-1e33-4592-9df2-767483e6eaea", "value": "3072:yA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637270, "uuid": "bb5fb649-00f7-4904-a515-ecf7e21209b9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637270, "uuid": "240cc2f6-82c4-4e51-a900-e3265c4b9b9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637270, "uuid": "80c8f704-092e-4ff2-98d0-605e4f9dccc0", "value": "dc9ae9b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56d710d-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658963, "uuid": "25a04ddd-0fe4-4f6f-9594-d61f2a282ba7", "comment": "Malware payload (Dridex)", "value": "ada9d0c34a91efa871e4bed698127141", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658963, "uuid": "90884992-2ed1-4abd-ae77-767a9abdb7b2", "comment": "Malware payload (Dridex)", "value": "53e33906b3f97ce293a98d2df03c3a19b8c2f13feaec6b4bf734d27adafb5ff9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658963, "uuid": "f0108d4b-3277-4627-8b29-55da2e0a56a7", "comment": "Malware payload (Dridex)", "value": "41cbe1388644ce451a5edce7e3d8a14838e5d892", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658963, "uuid": "21a42e20-e9bf-4964-b989-f6089af1f7f1", "comment": "Malware payload (Dridex)", "value": "aec5cefb02964663cc469f428cea697dee323c92e7dc19dafd6216b45faf32a6712b7ef32cb87a41f3ce331c9a15c41b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658963, "uuid": "593a49e6-c8cb-468e-a153-7b9976c755ac", "value": "94F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658963, "uuid": "ee39653c-26e0-4b8f-b81d-e5eeeda176d7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658963, "uuid": "ac301f8c-d793-4739-8fa4-260249de22b9", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658963, "uuid": "6c9cf04d-c9ee-4dc1-bae4-2ba52c7cc67f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658963, "uuid": "a4d57c23-8a69-438b-bd8a-bd2187214da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658963, "uuid": "741dcc4f-03f2-4b96-a166-60518ec9e0fe", "value": "ada9d0c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da3d38c-b128-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620607222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620607222, "uuid": "bc3d7666-61a4-4766-9e45-352b59fd7ab2", "comment": "Malware payload (njrat)", "value": "f19e306cf09252ee56caa74a45d1f0b2", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620607222, "uuid": "a126cbc3-e372-4cf1-baf0-1b6ddf2d0645", "comment": "Malware payload (njrat)", "value": "5448be68d80b4baeb66c8442e6f3eb1c8f298a7d7aebe942492e897b3406eea9", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620607222, "uuid": "122de5fe-baf5-464d-9a4c-bc040035bd23", "comment": "Malware payload (njrat)", "value": "68cdf39879b8d456b68e27e4e1d24abd5c4d7fb2", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620607222, "uuid": "4504ba92-cbfe-41a3-bbaf-7a620b857696", "comment": "Malware payload (njrat)", "value": "53631c673315d06d3ce5f382564df182abc2470e689898edb876a57c5971ed5cdc65512f319856553ab9d18e732f70ca", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620607222, "uuid": "4d350fc1-a31e-46f2-99b8-6c47362f359b", "value": "3DA36AB868A7EFD1CC5E014BB36A1E27F610325990490F640B49BD188AE91F9DE5D3CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620607222, "uuid": "fc7bc115-3e47-450d-b0ec-ddf3a5c5f76e", "value": "1536:CXyTkEkkrYM+q67jujK1jhUjd3aCEq3CBLj3js1jwjz3hx8383ArSx25GVqpYj/a:CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620607222, "uuid": "975b4719-e72f-42fc-afbb-78042cfc541c", "value": 100169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620607222, "uuid": "0663ef9e-ad8e-41c3-a693-70855c08f07d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620607222, "uuid": "fe1a6e81-cd34-4aa1-ae76-8ee5e4ff5461", "value": "PaymentDetails.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc344ec0-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669738, "uuid": "7ed1f385-46b7-410e-b6ee-f4f981af609c", "comment": "Malware payload (Dridex)", "value": "88898c260bcc136492d842b6d8c0597c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669738, "uuid": "5c078a5c-a4bf-459e-a8d2-e9d6209c28c7", "comment": "Malware payload (Dridex)", "value": "5484a78a3e77ad666fe2041df0d77bca603e28bf83d512cdff4165219370782d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669738, "uuid": "fab0c17d-17bf-40b2-8f11-d064186db40d", "comment": "Malware payload (Dridex)", "value": "158f00edfd6d22739ff3bab1d57cc4cea83885b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669738, "uuid": "11112233-c405-43c9-8e1a-7afb6fee3b89", "comment": "Malware payload (Dridex)", "value": "3acdd175c9c34f74bead9114bbfec1478093460b6bca835cb07c64a82385be6621bed793b676be6f55d69feeeb9dd0fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669738, "uuid": "85d6a6ab-0bf3-4c53-92e1-f6a43704e20a", "value": "9DF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669738, "uuid": "a8910401-d55d-4a7c-9e63-1e0f4c1179b0", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669738, "uuid": "a2875918-1957-4d89-9880-623762756507", "value": "3072:S/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL/7:wbrE1kvcB74DXZ2Mela7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669738, "uuid": "b5036fa6-0b9c-49a6-9b0a-8aaf239263dd", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669738, "uuid": "31c4b2d6-3487-4c63-b033-58f3a98134b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669738, "uuid": "e8c464d3-7943-4058-9b0c-259d35afb105", "value": "88898c26_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc0d8bd-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684052, "uuid": "c993aa7c-2a63-41fb-a0a8-307a7016d4ca", "comment": "Malware payload (Dridex)", "value": "e5ca01dfb13af2ca90870bfc43dfb9ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684052, "uuid": "fc1a6f9c-617b-4e4b-a0f8-a09c19ab8a5b", "comment": "Malware payload (Dridex)", "value": "5492be82d4411b90151e054dc54ed0b265debf0bd865a22d093d9edee1d43573", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684052, "uuid": "5c29c283-a3d9-498e-9de0-81fc7590630d", "comment": "Malware payload (Dridex)", "value": "9e9650aff1432b7b1eaae0f7660ee54975d30239", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684052, "uuid": "b315dff7-22e4-42cc-9362-3b91a3d3e31b", "comment": "Malware payload (Dridex)", "value": "e51277f3181faba9574aa14101218c9ecd879bda90f8cc1de5965dc02490a137540b3cb2ea13ea08aa0e68319d1cea41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684052, "uuid": "b23ce223-9e7a-4b76-a947-3434a164459c", "value": "9FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684052, "uuid": "782acd94-5fe1-4481-9565-9dc2f668d1b1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684052, "uuid": "86eee141-6dfd-496f-8953-64627626f534", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684052, "uuid": "b4c87133-9654-48bf-a0d0-1f655428c4b5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684052, "uuid": "91a70829-3bba-4de1-b9ff-9fdd4f4484c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684052, "uuid": "767e6040-6e6c-49af-87ac-99ab03a2dd09", "value": "e5ca01df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb20b395-b18a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649577, "uuid": "128c9442-c609-4f5e-a0bc-e416ab83aa53", "comment": "Malware payload (AgentTesla)", "value": "13cfbeb69101a14b68fd9740fe674363", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649577, "uuid": "3e145ea1-1b6a-4e82-adaf-5485e16cf4da", "comment": "Malware payload (AgentTesla)", "value": "54942c1db1a8be7a251efa0e0cd5a6fd1b4d71d4dd55b67d96882b560fdff4e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649577, "uuid": "c3dc0108-555c-4152-8168-c497a83ad99f", "comment": "Malware payload (AgentTesla)", "value": "4e3553b9b18e2c04ded6920c098727fcf09e328f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649577, "uuid": "9c6dc83c-d414-4093-b6ca-3910171866fd", "comment": "Malware payload (AgentTesla)", "value": "19729b5077f4db8d3a8731bf14c417bd3855669973be26d002d0230b55fb30eee04c01af97f4474f32abf5b7d471f03e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649577, "uuid": "4b27f99b-0532-4699-9dba-eab79a3fae50", "value": "A2F4DF2C2AE58914FEBD56BC8871507087F9BD126513FB5E4AE13CEC3D73250EA029AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649577, "uuid": "018aa96a-f273-4cf2-b7b5-91ee15372a80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649577, "uuid": "271fdc74-2e94-4372-81bc-9a61ff17143a", "value": "12288:/ViXKfkfauLZ4uUV2f3W85RevsqF58P63dXFioRC2:9hW3DGvNR3dV3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649577, "uuid": "cd920719-a325-4977-b94a-57694e69dc0f", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649577, "uuid": "4951b27a-723a-49b0-85b3-ac86885ee9a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649577, "uuid": "830cf6fe-f91d-46f1-8562-13d9a76f90fa", "value": "Order (G01-2021).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f760d23c-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680521, "uuid": "1174f73c-48d7-467d-a47b-3deef4843dc6", "comment": "Malware payload (Dridex)", "value": "a31dd8555d933855b8788d39206007dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680521, "uuid": "205aff97-67ff-48f5-a472-b294955dbaf2", "comment": "Malware payload (Dridex)", "value": "54a5e0eeb43da96e07d39a87fa17d280fc2751c581ef26e3dfc39845ad084524", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680521, "uuid": "64f9e00f-1a9a-4709-ae8c-1f37685a2bef", "comment": "Malware payload (Dridex)", "value": "3dcd3cddc4c6957c229f9f83d6a7d7b3477a2cdd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680521, "uuid": "82b1a45b-5341-41a0-9e08-073abb42c9dc", "comment": "Malware payload (Dridex)", "value": "50ef11a6882aff5020eeb2b55f07fd594e48000c831fb0a9f8421b4a5dc78fcdf6aa6b19561aa689cb7300b2a0be84bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680521, "uuid": "8bf1eb1b-1039-4271-b9bf-c616cc28d4ba", "value": "24F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680521, "uuid": "d40aef86-d654-4989-a8e4-42b64c3403a3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680521, "uuid": "cdae014e-9000-4627-b2c9-1dd64646243f", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680521, "uuid": "d61bf33f-161c-4c61-a70d-2efd9bce0713", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680521, "uuid": "f9c1090a-aa9b-4043-92da-5d9f9df9976a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680521, "uuid": "c0cf6967-430f-471c-8719-22991510f113", "value": "a31dd855_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd919af3-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620640910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640910, "uuid": "c131c463-82e6-49fd-a0d7-2fb64c077869", "comment": "Malware payload (SnakeKeylogger)", "value": "3e170ed2ce3c902949f8b0521e0260be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640910, "uuid": "2e57e8f8-6abe-4618-be58-ff00abfade2c", "comment": "Malware payload (SnakeKeylogger)", "value": "54b29e51b5f620ef52d4c1bfd5a4ba70516dce25242f1c6aac067206ebd2d5f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640910, "uuid": "94ccc72e-c3ba-4a2d-81f2-30baf6b804f8", "comment": "Malware payload (SnakeKeylogger)", "value": "c1345b96cee9e1c607b3ca7d4d8c2dccc2ab649a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640910, "uuid": "ab3f82ea-4d06-4ac3-a3e7-e9cc7ea299ff", "comment": "Malware payload (SnakeKeylogger)", "value": "28da482e5ded15d2f1437725fa3a52289023723dc03c2b47085414036f887ba0ec972c55a8fa085d0499d2118f5af3a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640910, "uuid": "309abbeb-ac01-4587-971a-f4690ee7fa63", "value": "BB3533F3367F12D052C1EC8F07515BF2E55816A6B1B941864BCAA8F341CF7B4A24A1BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640910, "uuid": "204a8a22-ed8a-41ef-95c8-5bfc024af5a4", "value": "24576:9cIAvrPV3pzTobRd3T86lGbRTpE6KXLQ9Bw1s5dWeiFoEhgHamP:9cVvKTbiK6KXLMw1kUeiFo48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640910, "uuid": "42b2016c-fae0-43a1-8ce2-f83607600ab1", "value": 1128880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640910, "uuid": "f9b829d6-08cf-44e9-9b3b-2f94ccd83631", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640910, "uuid": "8523ddb6-42a4-4677-9911-fbb7b5cd6324", "value": "3e170ed2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405b27b4-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669906, "uuid": "995951a2-8aee-4570-851c-941bb78ff712", "comment": "Malware payload (Dridex)", "value": "4570185b5ab445f6daa80bb097344a61", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669906, "uuid": "30844e5d-aaa5-46ae-a896-1eef731f17fe", "comment": "Malware payload (Dridex)", "value": "54c2e115753d2f2a862c340556ccbd139465bde4db42ff209ff4fd7394044f64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669906, "uuid": "faf8a2cd-362e-4105-a842-0c031a034362", "comment": "Malware payload (Dridex)", "value": "f02016e0c941bb26aeb7812ceaddf4fa0a4d6aef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669906, "uuid": "8c108f1e-1f45-4693-bfde-5568acf3c759", "comment": "Malware payload (Dridex)", "value": "a1d2c2b04e9ca2c284c2ee395beebb8edd0d79a1241d1b4e16686ac52a6f172c7f1fc6540fadc4bc7069efed2bc3d14d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669906, "uuid": "953163ca-87b1-43ed-a20c-953c1084e20a", "value": "52F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669906, "uuid": "4806ef2e-790c-4bc2-8776-6f5388ab7aca", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669906, "uuid": "83209c0c-786f-46ea-8c65-2b8dedeb90a6", "value": "3072:k/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL0D:ObrE1kvcB74DXZ2MelVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669906, "uuid": "57cb8550-6243-4f4a-8017-16d19486bbc2", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669906, "uuid": "81bc3dde-5055-4210-9b40-7c0e698ccde9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669906, "uuid": "f0a0ec1b-4fe6-4d53-a207-dc6b1f301966", "value": "4570185b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d7c87b-b157-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620627503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627503, "uuid": "b3f35ac2-27a0-4cae-9b0e-2a66bbcfcd91", "comment": "Malware payload", "value": "8b51eeb84c514f35021c5d1e2faa6506", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627503, "uuid": "29fa48f4-1063-4e4d-9abd-f284212ef0fa", "comment": "Malware payload", "value": "556ddd38d3a438ccda085fa683d8527a514f2e8b696f67e09bf17f6d9ee7c263", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627503, "uuid": "8adc464b-844c-4715-bf70-2850b0a86818", "comment": "Malware payload", "value": "8639222f58e7ac7ea83cf81c9e687bf065973701", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627503, "uuid": "cda0b07b-9422-4581-baee-4515f26d3f13", "comment": "Malware payload", "value": "5775f95d222980c61cda73e56d16b9ccc34e09e26a2e2deb4aa1e9181c743f4038725ee1f23cafd3c96bb2f35b87d858", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627503, "uuid": "fb39d46a-965a-4196-bc46-e14466b4c52d", "value": "38C08047B645D592938213D7955FC46685C5B774F5F4D455A408D62439680470D311C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627503, "uuid": "105d80ab-d9d6-41e7-9942-35dc873ec444", "value": "3:QWzoNbtdovT+UEipo8XB4IHMLAKcjQHZHMf77FVwMcmEKooHaNeVRYKXM9Rm:lo2rpDG5cjQHZHUX3yODHGe7wRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620627503, "uuid": "8960fb2a-f22a-4fa9-bfc4-ea8c935d9b6c", "value": 185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620627503, "uuid": "984c348b-735b-4ccc-bb96-ba7655857718", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627503, "uuid": "870cdee2-53fd-431c-8b51-6de383222358", "value": "Order-ID857662378452794.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b81e08-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687712, "uuid": "998c0904-e40d-4c4d-b126-90fddbb1bf15", "comment": "Malware payload (Dridex)", "value": "c9907bad7f458a20ab26a5c876903c4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687712, "uuid": "f1fe058b-6914-4dc9-beef-e5f2a1046b56", "comment": "Malware payload (Dridex)", "value": "55c9e480e605eabc742235ace559d6f8183f567f4cc52ef1f31dd4419d62ea39", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687712, "uuid": "93944ddd-197c-417d-8a8b-9e2839c23a07", "comment": "Malware payload (Dridex)", "value": "319ca8924fbdd8da782697809ca1cb683e10fc1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687712, "uuid": "d50995e8-4b65-4fd4-9a51-14a0a20a6135", "comment": "Malware payload (Dridex)", "value": "63b6d1a862377bfd49be224092ae0359030f6a5e356042ac9e5247b071c1fe36fbf4ca2dd06236745cdb702e4623a534", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687712, "uuid": "14d18531-cbdf-49cc-959e-b9be07b0eaeb", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687712, "uuid": "d9dd882d-7620-4c6e-b6e5-f696f37b3c99", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687712, "uuid": "6cf42a9d-5616-4259-9591-d1b8f874f373", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687712, "uuid": "16e51acb-6666-4026-97ec-1853412556c0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687712, "uuid": "ba8270f8-e536-4fc7-909d-9a6835350550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687712, "uuid": "77aa69b0-d4bb-4713-878c-b40d95ec9606", "value": "c9907bad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebc47cc-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620655354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655354, "uuid": "f2b6b66f-1b5e-4bf7-967a-772490dea184", "comment": "Malware payload (Formbook)", "value": "3b61ba00c5fb571e012b3f8c52453009", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655354, "uuid": "712c5801-62e0-4b14-9422-bb1dc6e8023b", "comment": "Malware payload (Formbook)", "value": "55cd1cf2565504ff6808f5ba8390c325e71db36e48240c877a425407df9978a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655354, "uuid": "b5257488-71cd-4022-a359-c98026688b67", "comment": "Malware payload (Formbook)", "value": "3423dc6d376ffe386a03dd137581ef0d6cc1bd53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655354, "uuid": "52b25a1a-9587-4c40-9227-c6f331657e69", "comment": "Malware payload (Formbook)", "value": "bd8ab5a2129bd9a2a0368763dfff227e4d3f578619e49a046be5ddf481b5ec1131644935cff808b791f4a18cfb87a4d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655354, "uuid": "769d228e-387c-4cca-90fd-bea539a2d176", "value": "0BB4235D0E5868AD0E574D91ED3DBD29673492B03EE60BA0FD0EC53EB52AFC950312AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655354, "uuid": "bf92972f-d2de-4a35-89ff-4b6653e4dffb", "value": "12288:3vlUdj3IOdeABSAkf0sZvGZ7T5Knsv3YtnsgAcY:dUKGeASHf0sZvGZpKsvI3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655354, "uuid": "0cbc67ea-02e6-4740-9b9b-c7fde2036b96", "value": 493901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655354, "uuid": "3e247646-a679-4501-88eb-4351061eb171", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655354, "uuid": "ece5699f-5a5c-4240-9fc3-e12e0a63858e", "value": "3b61ba00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a804a107-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673516, "uuid": "506b9acf-aeca-45c1-9aaf-8343106ae78c", "comment": "Malware payload (Dridex)", "value": "ceb5b51d69755924c77d5b91723f04e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673516, "uuid": "2f82e816-3a6b-4894-9702-5317ee416ece", "comment": "Malware payload (Dridex)", "value": "55dcded49fed93f47cda2a8315297494330452000eaf9be6f67b6f99792d1666", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673516, "uuid": "54b4e1c5-53d9-49a2-9670-767c9a58e079", "comment": "Malware payload (Dridex)", "value": "4df022d3e26d785738f731d16965ee2d92dca106", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673516, "uuid": "ed242b8c-e5a4-43ae-b9be-26de834c18b1", "comment": "Malware payload (Dridex)", "value": "66dc0aef1cf20c2beb912e16c86e6eb6728d4bf8a9db5707bf3c9c15c1b62138762740e51476a65ad6d9229bbf083d5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673516, "uuid": "df7754ac-8fcb-43ee-93e8-ad4a5e9ebeb2", "value": "6AF3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673516, "uuid": "7a8b50d1-12f5-4296-ab71-b82342d541ad", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673516, "uuid": "50351e08-0798-4d91-a609-523007b9fe8d", "value": "3072:tesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:Z4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673516, "uuid": "1afb7f2c-8adb-49d7-b869-1f9d704f6a53", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673516, "uuid": "a467541e-0397-49fd-9d30-031dae7b3571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673516, "uuid": "874e7d23-ba40-4bb2-804b-bcc7900f7e04", "value": "ceb5b51d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb27afaa-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687722, "uuid": "c182c48e-76d4-4e1a-b206-75f274ee8429", "comment": "Malware payload (Dridex)", "value": "c099edc146e32073f3f39749c27980cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687722, "uuid": "555398cb-bc74-4f67-a713-4537b3bf91d7", "comment": "Malware payload (Dridex)", "value": "563bc90caa70915640d7505f0fe88c4f9b2e627530acb5723761a99e9f543d7c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687722, "uuid": "cddf34a4-4cc2-4e6f-b497-3694c7b09aa4", "comment": "Malware payload (Dridex)", "value": "a39aa63edced402c6008526a50c638d24206ac03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687722, "uuid": "50465a4c-c8ad-4042-8053-d143d014defc", "comment": "Malware payload (Dridex)", "value": "2102b85989810ceaa979cf5647642550c27053fd2e3b4a2a406166899542c779abe91138f53237b98bc9f62e41e3610e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687722, "uuid": "6e7afb90-7b8b-470a-b724-87ea5569ef8e", "value": "C1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687722, "uuid": "fd5e09d7-e044-44cf-a4c7-c3193b11741b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687722, "uuid": "9b9daf5d-6c2e-4c77-829e-a0374a0ed0a8", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687722, "uuid": "bf66af7c-95d2-4640-9e34-13511a2985d5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687722, "uuid": "3c69cb54-3246-4c9d-aa0d-58e90bb260b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687722, "uuid": "468b78c8-712a-4f6f-b4e7-65b0865219bd", "value": "c099edc1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7edfc2-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644559, "uuid": "aca61c55-fd45-44f7-88e3-9709626439e0", "comment": "Malware payload (Dridex)", "value": "ff2a85a824adbccee561a3c00a089e48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644559, "uuid": "7ea4a454-5ab3-4884-8668-8574f86078ad", "comment": "Malware payload (Dridex)", "value": "566facde43006272aac289bddc229ac9e84886a1a140aacaf6b130a40351edbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644559, "uuid": "141438d2-3642-4cb4-bbcb-0df68657ff54", "comment": "Malware payload (Dridex)", "value": "7e40b9407531c5fb621a75f0fbb1565d24a0a4e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644559, "uuid": "b814140b-3d73-495b-87c5-29f827a4110c", "comment": "Malware payload (Dridex)", "value": "c014bb152429293df1c854b09df9006f8f952494524291cebbb713069c9ce0bf1e65f581e6cfe16492b8931801059757", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644559, "uuid": "2153eb5c-db3c-4b3f-91e3-a0cb541cd6f9", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644559, "uuid": "eb7b7c67-cf3f-463b-9da0-e02a91b85a0a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644559, "uuid": "b8cc6c49-94d2-4487-8e80-c3c6c895164f", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644559, "uuid": "16c43732-c720-4364-9f7d-abbf347cfd9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644559, "uuid": "51e73a2a-a66a-4c6e-a47b-67c81dc1fe3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644559, "uuid": "cda93c4d-d638-4a58-95a2-4f19929601dd", "value": "ff2a85a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed8cc8b-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669877, "uuid": "e769fbfd-99df-498b-8cda-944d6e2498eb", "comment": "Malware payload (Dridex)", "value": "8ab00a6096aec3a3db7b97204bc9d16a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669877, "uuid": "2ea39c63-8a7f-4ff3-92b2-f62990a4edf8", "comment": "Malware payload (Dridex)", "value": "56b60359ecde6d462f63b58bb65d95c8875b3d1d07dac7dcf70371175f688b6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669877, "uuid": "dfb1b50c-fd53-4ff5-b00c-61f2c341d875", "comment": "Malware payload (Dridex)", "value": "00263b61b63c95e307e6935043609e0ef3ca8d3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669877, "uuid": "7b89a12b-23f5-4a91-a78d-23acd30f7c25", "comment": "Malware payload (Dridex)", "value": "45bb8fa141530745ee0ab601149e82d160f1e4017869ef9d56776be4c80286cf350b8dd84a186abfddbc97c8d5d4f4d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669877, "uuid": "769f330b-c53d-4744-abf3-0e94a6a6d205", "value": "20F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669877, "uuid": "9a59b512-2b17-46a2-9131-bfcd9d4c1aab", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669877, "uuid": "87c57182-e91b-49d8-9df8-5fb07edec496", "value": "3072:y/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL63:QbrE1kvcB74DXZ2Melv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669877, "uuid": "4734cf98-9159-48b8-9606-11b4cf3b5cde", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669877, "uuid": "e6dd71f0-63df-4da5-a8df-3ab9ca387e48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669877, "uuid": "db5e73bf-6890-43f4-867c-a4e2fc589d82", "value": "8ab00a60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78689360-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673436, "uuid": "66e924fa-7b40-4bc5-bdce-ca6052caaebe", "comment": "Malware payload (Dridex)", "value": "942c06fa0179bc6359a1620d9d4a38c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673436, "uuid": "169d793b-6d9e-4627-a250-650c092f13ed", "comment": "Malware payload (Dridex)", "value": "57545e3462012368f24269c46f42e3adf2504898649f597355e7b561102f18f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673436, "uuid": "0d4c48ee-8afd-4171-b4f0-cc5298a871d0", "comment": "Malware payload (Dridex)", "value": "3c3546c5abbf388149d7a3cac797d80b6d6ccea3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673436, "uuid": "53b20a8a-aedd-4278-b18b-b3f1f3c8bf80", "comment": "Malware payload (Dridex)", "value": "fdc1601d44d28cb69dbc131c9467b9fe42d3c85a879ff2e1c86e3ececc88f0a9edb4d5a6fea9133a2a57fc892a120bea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673436, "uuid": "bb889be5-11b0-4e8d-8e60-887c46d3fb6d", "value": "AAF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673436, "uuid": "1a04fcf3-76ab-4321-a419-27ddde11d9ca", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673436, "uuid": "3f1753c6-ed6d-4b70-b7b2-2e9eba5966fc", "value": "3072:/esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:T4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673436, "uuid": "0201db65-1715-49df-a495-bd7b84c7dbf4", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673436, "uuid": "f016f95a-669a-487e-bdc7-b993ad5a7e18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673436, "uuid": "629a4a21-c286-4394-b512-d0dd5b96f427", "value": "942c06fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644d0629-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673402, "uuid": "ef323d16-f2fa-48d3-a1a6-bea2a009acd8", "comment": "Malware payload (Dridex)", "value": "91c502d600aa499c5b4a21614054b6db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673402, "uuid": "a1b61d67-464f-4520-9a44-79d0db93fd07", "comment": "Malware payload (Dridex)", "value": "57645767d1475cdcb9babe42219b14916fcbf7f412ba761cebbab833e8c81206", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673402, "uuid": "e58e03fe-9f97-410b-89bd-d26d91fc857d", "comment": "Malware payload (Dridex)", "value": "da103f9f6a0703202df1987c512132cfc2222482", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673402, "uuid": "91b298a4-fc70-4d48-a950-9db1cbfbdb5b", "comment": "Malware payload (Dridex)", "value": "934d9a80cd06762e8cfa5713a677bda016744cb13c36007ccf84c4f0e116d66275f8023b0415bdc8802cd64501c90a96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673402, "uuid": "8c09a248-31fd-41ca-8ac0-4946a3ba4eda", "value": "C1F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673402, "uuid": "9dd750ce-9a48-46f0-a113-559e703f6641", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673402, "uuid": "5e113819-2de4-43a9-b529-81c2f691b090", "value": "3072:Oesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:g4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673402, "uuid": "12479dba-66cb-4325-a0ca-f74d4b73efc0", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673402, "uuid": "b9d6cd54-4668-4581-bace-953b62477465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673402, "uuid": "935be580-890a-4e20-b6f9-239fa461347d", "value": "91c502d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7953ea71-b199-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620655828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655828, "uuid": "6dccacce-e798-4bd7-8b48-e18b900bdcb3", "comment": "Malware payload (ArkeiStealer)", "value": "62f4c7f289f1c09d51f3b16a3cda528e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655828, "uuid": "a76ce116-8fcc-4984-8fb5-a782418eb5cf", "comment": "Malware payload (ArkeiStealer)", "value": "5773763b967c6f9a15f6e91ca299eeeb8995628451d5fe224784717d0427eac5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655828, "uuid": "551c2440-1148-4faf-9f02-eb74ee37dd42", "comment": "Malware payload (ArkeiStealer)", "value": "9ff55fc2cd26c87d1aabe446be51805c00df0fd8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655828, "uuid": "1aac8f0b-4839-412b-baa9-bc428e9b903f", "comment": "Malware payload (ArkeiStealer)", "value": "4ac9d9d115a05a17a6907e339903448974ba4f362e20788746efddd5638aa9f02439350ce9dfe02991343b53d3f1cc12", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655828, "uuid": "3970b3d6-0f1c-413d-ac7f-0a056b74125d", "value": "09C412077E1FC921C6004737C59605019765EBC3B6B7D78B788E33AA98027EF8A49DDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655828, "uuid": "501f0470-db92-4530-a96d-3c9a3caa217d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655828, "uuid": "25ac2165-ce12-4e35-b667-3db8c1229049", "value": "12288:EtIEAuWvsPacuOzCqQJJ5B0kNDxegmrl0RSHw:EChu2318CqQj5BfnJalmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655828, "uuid": "df646ed0-3be3-41b1-9b76-dd9610497cd9", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655828, "uuid": "991c1e6f-cd64-41be-b06f-a75cdf801378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655828, "uuid": "18adf029-54e3-40a2-ac51-3c9824413c0c", "value": "62F4C7F289F1C09D51F3B16A3CDA528E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd3c164-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669820, "uuid": "d30b580d-411f-42ee-80d5-501a1d4d2665", "comment": "Malware payload (Dridex)", "value": "f5151bc329451c9f6047cea2ce87d7eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669820, "uuid": "4c2ffc20-d844-4993-8590-1b8d6c3ddd72", "comment": "Malware payload (Dridex)", "value": "57de5b02e0c03a7263ea28585d6367b22f04f377d2a8d06cbd663602c873ebf2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669820, "uuid": "07090a6c-4125-4650-9b69-c6e34e5bccad", "comment": "Malware payload (Dridex)", "value": "3c85105af01bf15af8f4be0746f74bee04303682", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669820, "uuid": "cf066e18-08aa-48bf-81f0-f4e41b8c813f", "comment": "Malware payload (Dridex)", "value": "f02e29e2dd8f07202412b66cbfa3360cf3e521896f73b7ecbc32c78843244a16960056bca75b7fdc258dea440ba4a99e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669820, "uuid": "4872b840-cda6-4cc7-ab3e-ab0979b259c8", "value": "43F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669820, "uuid": "eef5e694-0724-4798-abdd-c72111253602", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669820, "uuid": "8cfa2f80-7e78-4d1d-8ef9-66cd145a2996", "value": "3072:c/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL63:mbrE1kvcB74DXZ2Melv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669820, "uuid": "b10d5143-82cf-4fad-814a-33a49f578908", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669820, "uuid": "9b300da6-4130-4242-8351-a26d76922c15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669820, "uuid": "d215b603-9c38-419b-8064-5d8a4e6b558f", "value": "f5151bc3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b45ba66-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620628317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628317, "uuid": "a31945a2-ef53-4c1c-9a4f-de63f889be7d", "comment": "Malware payload (AZORult)", "value": "559dc6ccbd4b4ea55677f524f95372f9", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628317, "uuid": "9781b915-b3d4-449a-b4de-547bbd56717f", "comment": "Malware payload (AZORult)", "value": "58b8457797f88443a07f9c033039776fa7c5834eeee4d4b5af353ab159bd85e8", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628317, "uuid": "392ab5ca-7e80-4824-beaf-d2c5567becb6", "comment": "Malware payload (AZORult)", "value": "9eb64c1666f529bf8ae443008853bf6e7cf7d4b2", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628317, "uuid": "2baa9e25-a1f1-4919-a137-14549a1916c3", "comment": "Malware payload (AZORult)", "value": "70968bac217143a77ba11348987a5e09841b674ff1bce428631b638f896a6053b4c20a861467b640e754bac03712ab42", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628317, "uuid": "df3448f8-aaae-417b-a629-7bad9fa6d1eb", "value": "3B64E0492164D853D7C832706FB8DAF657B48C4E68088B232BF47ECF39FD19B6919261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628317, "uuid": "8a09a80b-f413-476b-8e7e-432cfd1b4ffa", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628317, "uuid": "7d466ddf-bd7f-4f1c-986b-d990d4e05658", "value": "3072:cf1BDZ0kVB67Duw9AMcMCtjLbfdhe3aCAF2kmHkP+1LtHj7YF2xQS4c8xw0qibgp:c9X0G0CtjffdWaz2kykP+V+TZ/qi8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628317, "uuid": "0d560a59-50ef-44ac-a9bf-dc08fd521d9c", "value": 327134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628317, "uuid": "8c039973-9322-43c7-a118-99544b9493a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628317, "uuid": "e8ff9017-02b7-4de9-a324-6e679f90afa8", "value": "Ziraat Bankasi Swift Mesaji 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d580a685-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630643, "uuid": "0d4e5342-f642-42b8-af71-576e82160c16", "comment": "Malware payload (AgentTesla)", "value": "31199abde4dbf9ad1751d58ca731ad86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630643, "uuid": "b612acb6-4222-4c66-8376-4a83df78f95e", "comment": "Malware payload (AgentTesla)", "value": "598e84a9dccd8f60e57a662199b3552c67a803b3ebce5d11245ca214f31248fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630643, "uuid": "3c149771-1f45-4e0f-8c29-ece33adb1790", "comment": "Malware payload (AgentTesla)", "value": "5e565a44ca6eb6c0343a9cb6310048dc1ca18056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630643, "uuid": "2931140d-c2ed-4eb6-892b-5057c1291649", "comment": "Malware payload (AgentTesla)", "value": "7123900e87e3c5f2618a3ce6272f81c334c8e2cee1142d8abe5e38253684d3ae31004f64d37b4ae1450065b26d70c9e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630643, "uuid": "89145c41-bdd5-456b-8a4f-85db12dbe811", "value": "05F4CF213388AF55D87EA7391470050063F2BA07D722EA4D7DF674DA5AB2F418A27B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630643, "uuid": "acd17618-8e6a-4c61-907b-55a3100720d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630643, "uuid": "29b09066-32fe-4f5f-a7df-9cce96060cd2", "value": "6144:00g7yS8cmd+SbZ9e89+OWr4HiChOd7TFm4/oSp8RTcpFSATWLSbLtKpqN4gavtp7:87o+wAvSiChk/Tp2ATcGL0pq6tX0WYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630643, "uuid": "3f9f9155-1e6d-4e61-bbd4-7c9c91b1724b", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630643, "uuid": "76b73c2d-bf9c-4dbe-bd6d-3dc9f387d32d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630643, "uuid": "fe8f0797-e6a8-4c8e-8902-f4d43a8f9459", "value": "BankSlip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92acee91-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650717, "uuid": "55119c1b-02a4-42b0-8f7b-fb3d3054a9db", "comment": "Malware payload (AgentTesla)", "value": "7a4f0d0af06a4742d15a5046f50fe0e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650717, "uuid": "b3fc3df1-e55c-49d2-82d7-659ff3230cd8", "comment": "Malware payload (AgentTesla)", "value": "59bb93fc55b4001194975c7afc12c336454301b2bae77b6087456211a3c5989d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650717, "uuid": "55c3d8d8-59da-43b2-969c-9cc65c8cb7da", "comment": "Malware payload (AgentTesla)", "value": "7f5197a069e8c4f1a78b58c4e5b49501aa903aa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650717, "uuid": "10d24b45-99a7-4343-a0a3-8eecf7caa33d", "comment": "Malware payload (AgentTesla)", "value": "e61eb13a20ccb12968a581a18b48a3f476c612f55ec35ef3c0b4ea7cf0d33460df4ddc6426585c0e994238467772e8a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650717, "uuid": "aa6ebb0d-b7cc-4f1b-967f-33c1ebc174a3", "value": "09E4D06C7BE44A43E5BE56BD8074112043F4B12E6A03F75C9EA070ED3D77760DA22A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650717, "uuid": "101ef268-c33b-408c-a2f4-0af0feb85f5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650717, "uuid": "0026d3d3-2152-4857-a975-87a1bf5c8f65", "value": "12288:z4kzmLTXVLmtoD1cm1RlefkuAllOyDWyzVR5A32:cnXJmtsFPefk3lRRXO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650717, "uuid": "8d440475-0b6d-4ab7-a436-97a0209b6e4f", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650717, "uuid": "771979d0-ab55-4b06-b986-ba1476c39c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650717, "uuid": "98b26332-17eb-43b8-8fd6-07e6a4dbf134", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93ff50a-b19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620657627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657627, "uuid": "6eff8c4e-b549-4076-ac17-ef1572f85f56", "comment": "Malware payload (SnakeKeylogger)", "value": "108686ed62b98562b44c0f273c4aa987", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657627, "uuid": "b4b2efff-6762-4611-ada0-e383b0d6e67c", "comment": "Malware payload (SnakeKeylogger)", "value": "59ea76da25a8d40a263cfdc97779417c74838b3e07fd09b57b4ecb849aa646ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657627, "uuid": "aef6dd7b-e015-4bb3-be5b-c7c62b35f310", "comment": "Malware payload (SnakeKeylogger)", "value": "a8b8b2859afc5af4683fa00885e482059a69653a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657627, "uuid": "cdd8ec96-9505-4293-befe-04e411a10067", "comment": "Malware payload (SnakeKeylogger)", "value": "31f59d942969aba3455d2396bdc17395c0e910213a94d30708828cc21efe976ba3a459448140edd137e7370a00c2797d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657627, "uuid": "dc9cccc1-b8a2-41d4-be38-1621816932a1", "value": "A5153B98B54415E0DA2B5F7263EBCC3242223D746836E50D4BD83BBB3A77F53293494A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657627, "uuid": "44526f72-eb8a-483c-aa78-cf7195e21cb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657627, "uuid": "0329a3ba-61cb-4207-b076-0f73a6f72542", "value": "12288:t7Q5PaHkooLLoS60/K7yh0+vGwlnuUTjCmL5jHniW6xP7r9r/+ppppppppppppp7:G5yHkooLANwlHnCm9jHnkx1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657627, "uuid": "5b27e2cc-f890-4132-ba6b-39872c74d912", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657627, "uuid": "f35c157e-c7e6-449a-829c-094697534315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657627, "uuid": "eed7f0e7-aa55-461b-9c92-79640c2a145c", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abf8c8a-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620655321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655321, "uuid": "b198a155-c7b2-4bfc-8ed5-c009cdcb0fdb", "comment": "Malware payload (AgentTesla)", "value": "7bc422c510f62f14685d2a00ddf26d5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655321, "uuid": "3ec46b4d-547b-4fe4-8519-fe6ee45e3537", "comment": "Malware payload (AgentTesla)", "value": "5a1d3969b603ce0bb0a936391b706caf2c867c693f1a388367a6dde5d57e341d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655321, "uuid": "1ffe110a-1b47-4990-b0b5-b539547c09f3", "comment": "Malware payload (AgentTesla)", "value": "8e85b6b2f0acdbc62dd1311f253442ae6201289a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655321, "uuid": "7518251f-89eb-4dff-aa68-b19a81ed8c55", "comment": "Malware payload (AgentTesla)", "value": "460780e19c6924f9500dd7fa23796f1f06d643c608a03fdd10552fe919cbd11c20f236c78b9a1f28c4eb94be61bddb79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655321, "uuid": "c067a352-d3dc-4713-94bb-8c6e3381f298", "value": "16F4CF253388AF55E43EA7391171011057F2BD07CB31EA4DBDE6B5DE5AB2F808626B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655321, "uuid": "5d103f7b-c8b5-48a4-833f-047e82e825ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655321, "uuid": "54833184-84bf-4748-8c57-34aa5dbae15d", "value": "12288:5u7vRC75usAR64R41d/0zf0wIySOtRpmTzAJgj1lOAoF729M:5avOwsAb4L0zR+QRpAzKgjZr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655321, "uuid": "ee5dd89d-1163-469e-bce2-6f4edc742036", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655321, "uuid": "91c6acf6-f3b1-4981-8d08-dab37001623a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655321, "uuid": "1b046dbc-4d4e-4f38-afcc-d08294fcc062", "value": "7bc422c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239f83e8-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669858, "uuid": "429d45a3-db0f-4384-b973-fd7b5a564484", "comment": "Malware payload (Dridex)", "value": "1753d14ef4baa41fca2597ff13e2eab4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669858, "uuid": "f6dc7bcb-f43c-4ec9-b89c-4710a243404d", "comment": "Malware payload (Dridex)", "value": "5a9407c92da14dc67d7005ecab56a6f502b8b356b0445c3e2357d5e10e6f8ff6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669858, "uuid": "4049815b-3e65-474a-a513-b45e2d9faf90", "comment": "Malware payload (Dridex)", "value": "7308b6d627f4655186933d0b4455b19f62992b69", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669858, "uuid": "9433cee9-e7a0-41d2-81f8-884a39bc366b", "comment": "Malware payload (Dridex)", "value": "cfa147c9d0933f0dc08008394841dbd8694f8ff57c4a37cb202b18b7d92bb34c10f073498534ddd8ac8f737fbd61e911", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669858, "uuid": "2724f8cb-cfb8-48dc-b825-162bf8aec25e", "value": "50F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669858, "uuid": "6869b05b-861f-4c1d-98a4-0503a1239353", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669858, "uuid": "ccbb9bb0-3338-423b-9dbf-614957f6bce1", "value": "3072:x/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:LbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669858, "uuid": "012aed6d-caf5-4478-82fb-9daf6d504c7c", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669858, "uuid": "84f5579b-4ae7-4758-88d8-96a21cc36576", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669858, "uuid": "fa497196-f2e1-4c5e-b1c6-dcdd28d69e2a", "value": "1753d14e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c84e7f-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640897, "uuid": "d3f36471-93e0-4cdc-8617-c0039fbe6149", "comment": "Malware payload (Dridex)", "value": "066f910b05d2416aad404716bb387fdf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640897, "uuid": "fd6c2cdb-c8b2-4a89-90f7-293d27870040", "comment": "Malware payload (Dridex)", "value": "5ab7bc22c87ce0a8a4e9147162d1ecf09f084b7b771b2d643dc6b04a6d044c36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640897, "uuid": "a25fe132-cd57-4b5a-b71e-2f7207c05694", "comment": "Malware payload (Dridex)", "value": "fec17804a3ec8a433b1b50409737efe156d2ecf6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640897, "uuid": "ddafc6f9-3c1a-4a9c-918d-c56cb40cf108", "comment": "Malware payload (Dridex)", "value": "214dcd37ea187b6f3650f8d309fa5e1cd47afef44bf18e46ffcb0c36747872f6cd3c88d641e6bd0437611379d73f6b03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640897, "uuid": "19464276-0efa-4e64-a90d-811ec4f9f645", "value": "FBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640897, "uuid": "8d719c33-3a6c-41fa-916c-9cf92cb1453a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640897, "uuid": "7b8f917e-12fb-430f-aba4-66dc5463eca8", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640897, "uuid": "afa84775-4f62-470f-9471-b645012659f7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640897, "uuid": "8a63e9ea-f345-476f-abcb-dc2989f3029e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640897, "uuid": "568dfd2b-0a32-43c3-bf74-f70c1afd79ca", "value": "066f910b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0f35b1-b12b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620608533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608533, "uuid": "58852129-aac4-46ca-9779-ab6314523dbb", "comment": "Malware payload (Dridex)", "value": "2e6829896c63e741f7a647372ebb6274", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608533, "uuid": "636fc38a-49b9-4c7b-b78c-074d563ef09e", "comment": "Malware payload (Dridex)", "value": "5af2a7b6962fae4e7ba1543aaa8a01c521e67e003df10b5405a16f794f3a2d8d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608533, "uuid": "75bad854-b78c-499e-83d4-4bb8a6c30428", "comment": "Malware payload (Dridex)", "value": "c381490161accfda72174f1157699f9d5643164d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608533, "uuid": "dabacca5-31c9-40b9-9db3-46ed291d05ab", "comment": "Malware payload (Dridex)", "value": "65ab74954891357e4042930f1a5b02a1451e4bb63d7b3cd3fbd9f9dfa2e46e21588a648b87fb98534f0b8b4fc3e233cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608533, "uuid": "5f07e18d-db4e-4a63-ab3c-4781146fe852", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608533, "uuid": "fba7cbd3-6f64-4551-8815-117a26af7cb3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608533, "uuid": "986e025f-df1a-4142-afb9-acdf9abe2a03", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608533, "uuid": "3acba083-6c9a-4965-b159-9aaa91b5682b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608533, "uuid": "c7e84e3a-bc81-41fa-b9d6-0dabb6be1a7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608533, "uuid": "eb443d9d-745a-4c0d-9508-173aa6527c84", "value": "2e682989_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0734749a-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620630726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630726, "uuid": "2ebc6f64-3d8e-413a-a5c6-9385a1901e56", "comment": "Malware payload (Formbook)", "value": "9e819bcc826e7a20b0fd139cc4185195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630726, "uuid": "6c801b8f-feae-4496-b11f-5e0d37167f2a", "comment": "Malware payload (Formbook)", "value": "5b09da58ac487c25237bf1a8ba98988af849980d5fe92dd1ca417591b977d7a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630726, "uuid": "0f312bc0-0bcc-4623-9139-e308b95d6500", "comment": "Malware payload (Formbook)", "value": "bdb33c04403e308dcc79ced36201c577a40f0311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630726, "uuid": "2492c006-7633-4043-8b69-c4629913c5de", "comment": "Malware payload (Formbook)", "value": "d0653ab2b8a5948009863dc429865f9f7e53ea17dd5a0147248a5facacad5ca3da7ff509c245aac6777941907728f4b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630726, "uuid": "d64ccd5e-4f38-4ed7-b7ad-2ef67b132bc4", "value": "97F4DFA5A344DF6BD67D4135C0121F4026F499525621EA8A3CED31EC0AE6FC207FEDAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630726, "uuid": "9ba02101-8a07-46c7-a859-edad11f23ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630726, "uuid": "fa8bdff8-4b54-486a-ad1e-590f2ecae659", "value": "12288:m/gn4mlGBkPyasxS/02yp+bqdGvCAPY4EEfySWfzC6v+qsMwWKWO:m4GeadxSB87GvLg6Ibv+ZXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630726, "uuid": "81318cf5-03a4-4213-b3f2-30d8bf6f3b47", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630726, "uuid": "8739bd2d-dca7-4cf5-9aa9-3b28174d82cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630726, "uuid": "10a3f667-ac47-4250-8644-9cda8ad722eb", "value": "Order 122001-220 guanzo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa65fb0d-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620659051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659051, "uuid": "439f3fac-a7b4-4229-978b-0870ee8dc06e", "comment": "Malware payload (Dridex)", "value": "fa1e737bbfa01b65a78849fabfda6313", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659051, "uuid": "dbead7dd-27ba-42d6-94da-526ad36bfe82", "comment": "Malware payload (Dridex)", "value": "5b0f11e945f8894f9840386f7d15af01e48e8037b5c20edec151fa0ccf8ff386", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659051, "uuid": "536e4161-7424-4c48-af84-49e55790657c", "comment": "Malware payload (Dridex)", "value": "efcf8313f8cfb5e54185623f6651c411a1ee6881", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659051, "uuid": "5b7431c9-a0c5-44b8-a7e5-0d9963093952", "comment": "Malware payload (Dridex)", "value": "ed7edf6836b719844b4980766ab1ff0f61962fd468ad3cfdc4e0f1f5ddc2c67f0077f079027e0381cb95617150b712b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659051, "uuid": "d60afb45-a661-47ba-9015-c7dac3676a5f", "value": "FDF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659051, "uuid": "eebb77fc-fcc4-43fc-abf6-97f8d1fa1e45", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659051, "uuid": "90fb4e11-3c57-4795-b6fe-016013087a6e", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620659051, "uuid": "c13070f1-d63d-40cc-b69a-b77de515f557", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620659051, "uuid": "f57d25da-a896-4a4a-b392-78d8687eb2e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659051, "uuid": "d854bef8-4227-488d-91c2-4410702aa256", "value": "fa1e737b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd08ac1-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687726, "uuid": "2a5a0e5d-c35d-48b2-9f22-0f4e75fb9ee1", "comment": "Malware payload (Dridex)", "value": "5e7f395fe742324626da490c2802e0b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687726, "uuid": "74bfc776-adbe-4973-a38f-95a28d65bc6e", "comment": "Malware payload (Dridex)", "value": "5b17e543674cb33c1a3385f431bd6ace913a97ffd0017303d0edf30bfe9afd79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687726, "uuid": "1d364842-a767-4d57-aa2c-bc39f2d9a4f4", "comment": "Malware payload (Dridex)", "value": "c4e8e430cc3249b705910f69fed05301155e9795", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687726, "uuid": "58ac57a6-345e-4d13-a831-b278f8c3247e", "comment": "Malware payload (Dridex)", "value": "1a6c797bc4189fa658c34764787c6290fadda0102cf38ff52657fef261887aac7c6b5e874ed1be0d3deb3cd232ea1100", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687726, "uuid": "c727695e-297f-4abf-ade6-4321270bffa2", "value": "10F3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687726, "uuid": "d60bd460-3a33-4700-aefa-9f2f012b27be", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687726, "uuid": "83ebcc19-b892-4ae6-8fae-efcc0455042a", "value": "3072:BuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:B0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687726, "uuid": "1547a78a-03d0-40ec-bb0a-e998af9134c5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687726, "uuid": "c8037122-85d0-4bf4-a71f-19b2a4587c96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687726, "uuid": "a028328c-435d-4425-abcd-9536983580c9", "value": "5e7f395f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6790ff-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620628270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628270, "uuid": "dc2c4492-e429-4096-bf45-be4c73085658", "comment": "Malware payload", "value": "3fc372974d1ea8158f40e7b89084a7f0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628270, "uuid": "ea333482-ea10-4cef-8398-42f54ffa0644", "comment": "Malware payload", "value": "5b596204d9e1d8c5717b1c02f4618e560ecca1ce69362064c5d3e2ae4c258c32", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628270, "uuid": "6a412677-121f-458f-9832-6074e4037bf9", "comment": "Malware payload", "value": "e35762ede9489866cb5b032eb77384447f49ec6f", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628270, "uuid": "fcd28af4-83fc-4505-8e1f-80bc9bde907f", "comment": "Malware payload", "value": "ed4a92c29de9eaf763b64da7510d179b66b695fde1afd5e80cfb913e69a7f9d14ebfa1e8019d68d894c9a49872a23103", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628270, "uuid": "6532f621-ba97-4127-ae95-2c4d6c633022", "value": "1B630692B2A5D459C94847F54CE7D3E63B36FC315F57838B3298B32F2F72680890265A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628270, "uuid": "79bea5e1-1067-471f-904b-34b4c3dbbd95", "value": "1536:XFxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAG0ewZELSPm3l+X9V0S73y:XFxEtjPOtioVjDGUU1qfDlaGGx+cL2Q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628270, "uuid": "b7ad3430-0e69-41a7-bbb9-7296ae4f2588", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628270, "uuid": "cacecac1-49ee-480c-b7fa-accc4289d84b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628270, "uuid": "987c6a38-48fb-4977-b74b-bec67f7436c2", "value": "PO_Inquiry.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722a04ba-b15c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629617, "uuid": "64787c21-3f09-4ed8-a15e-9a26e6eebc73", "comment": "Malware payload (AgentTesla)", "value": "541d6161714bc3f4f1028adb711d2dff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629617, "uuid": "7668554e-7582-40f8-a172-86f3844a236e", "comment": "Malware payload (AgentTesla)", "value": "5b72504b31eb98c34b87d9ac5d12ae37e58240292f9df1f0b33076b9862d515f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629617, "uuid": "3a602ad2-ea0c-4855-954d-b79591a34811", "comment": "Malware payload (AgentTesla)", "value": "48c6b6dfd93aeb3217a25a36757de7dc5bc0857a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629617, "uuid": "905fdfe8-59ae-4781-9cb5-0f5a5dfd4fdb", "comment": "Malware payload (AgentTesla)", "value": "1d16e6c07dc06ba0f4956998bfbc68334c8b749406fd26f64066be8e2d808fb75140ac8bd4909674949625af90b6557a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629617, "uuid": "597be10a-07e0-4adc-b052-9f8ca0b92a9f", "value": "C6F4D02037D8AA58E5BF57751970D14063F6BE27C322CB4E6A9DA08E1E31746C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629617, "uuid": "288d39e3-acce-44c4-8156-8755578c2fd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629617, "uuid": "90d5d9e9-1f3d-453b-902c-403d398cd6ce", "value": "12288:4ClGEEjf35BgXctBVw1hhhxDn77MUB2O9wpR3N+5MQxNXB5Tsi1CQvNTDhTAT0Tu:4CWngXcPGhhh57YU0vA5M+NXBmwnvNTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629617, "uuid": "ea8c7241-e895-404c-9a1c-4f9098ccb1bf", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629617, "uuid": "aef828bc-71bf-4bdc-85c6-7b08ff7abb50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629617, "uuid": "b9cff52e-c745-45cd-9d74-382e9fec5b94", "value": "KMT_009080000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640fc5a3-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666101, "uuid": "035a0997-163d-4322-a2cb-db6392f6901e", "comment": "Malware payload (Dridex)", "value": "5ab12cf940a1963f09eabac88d92ce61", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666101, "uuid": "cd9bffbf-338e-4879-8568-184fabafd5a3", "comment": "Malware payload (Dridex)", "value": "5b794946a2e82faf8f14bdfd8f310ae6dfced66e968cc7a48ee73fc0feb9d4ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666101, "uuid": "caa35eff-765f-486b-a00d-529dbe5a7d7a", "comment": "Malware payload (Dridex)", "value": "2ee5d45140f98054d51da3150fd84cf8553d7abd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666101, "uuid": "fe739bbd-3fa6-4f7e-957b-a7ab30b3a9ce", "comment": "Malware payload (Dridex)", "value": "af749bf385b01d4f24376bb896634ea81c23125333d8f3c839c7f28593b4d37d54c57acecc19a5a9002ecc435cfe0704", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666101, "uuid": "c41dba12-81f6-4aeb-918e-29612d202387", "value": "ECF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666101, "uuid": "a89e6c05-c911-45f4-bc11-bf3a9ecc629a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666101, "uuid": "4a86645e-51fb-47fc-a2bc-36c37d3c80b5", "value": "3072:4IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666101, "uuid": "835952c9-5aa6-4209-9ab0-8bd049243752", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666101, "uuid": "152df23d-d867-4fe3-b3d6-e160f4962b30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666101, "uuid": "f72e3c05-a5dc-4405-a914-6e335bb91c1e", "value": "5ab12cf9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d013286c-b1c6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620675301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675301, "uuid": "3ec42cff-f691-46dd-bb04-856358f85d95", "comment": "Malware payload", "value": "1417f890248f193bb241f6b458ae4a97", "object_relation": "md5", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675301, "uuid": "2ee93c6d-f89e-4449-9fc6-00950c65cf13", "comment": "Malware payload", "value": "5c206b4dc2d3a25205176da9a1129c9f814c030a7bac245e3aaf7dd5d3ca4fbe", "object_relation": "sha256", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675301, "uuid": "91f01836-8a1b-432d-97c9-8eaf32db2adf", "comment": "Malware payload", "value": "b2dfcbd8c3966ebed9275db7b14e359412db9963", "object_relation": "sha1", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675301, "uuid": "4b6334b2-4a66-4420-a839-1b26008dc3a1", "comment": "Malware payload", "value": "bf8a7311d5833fd3c266e56dbe32f419821beba2f39c8ed3c9193c50df49e11905f0b3735ff916694bb5b93c20eac83f", "object_relation": "sha3-384", "Tag": [ { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675301, "uuid": "6b9b26c5-9d18-47f7-8ddb-784651c5de95", "value": "30D36C17B3A400BBE0B6C639C5635A16E7B678121661DB9F03A4435B2F237D19E3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675301, "uuid": "6e1b61de-dfe7-44fc-b6ef-b644c65cf479", "value": "46e1f68bd4bdbe70b7424fd6e16885e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675301, "uuid": "e6191ed5-6e91-4765-8cd7-44e4b4750f9a", "value": "3072:lSAQPGJU7xU3+FKMI3iUbhO3CVs4jNnOvh7JWn:CPGJU7xU3+F/UROSVNYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620675301, "uuid": "1b8bce93-9e13-40d4-a276-fd00e694930c", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620675301, "uuid": "a74f3bf5-10e0-429f-b54e-3e42f90e25bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675301, "uuid": "b8e7064f-4543-44a3-8318-53499a05fb42", "value": "DriverGFX.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c9dbda-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669729, "uuid": "4450fab6-d533-46eb-8fc6-e013e8f9d97d", "comment": "Malware payload (Dridex)", "value": "868c4cbd22edf03aceae417c1ee35c15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669729, "uuid": "d046c23d-4c8b-46b4-91eb-17ad6006e87c", "comment": "Malware payload (Dridex)", "value": "5cbd16e92196a56516d61f532594b89c0d6bb2d3d38db5d1cf3221844d7c15cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669729, "uuid": "12e204e2-9ff9-4f10-939d-d6f0e9346e52", "comment": "Malware payload (Dridex)", "value": "db8e52fb510f6c8ff0c1d86a0f8871b98bdf9436", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669729, "uuid": "cb17fadc-4a85-49b3-81ae-151fe86ac70f", "comment": "Malware payload (Dridex)", "value": "c4de7b34200cd6feb88b9743206b9b4d71cd3dc48d099d54dc674f5cef6ca1211e0fc475ca828a2d31252bcc0116a32b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669729, "uuid": "adfc2de0-79c5-48b8-9676-96eb33533442", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669729, "uuid": "02293d98-6513-4e12-909e-8483f42a6537", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669729, "uuid": "37ca96f0-0a96-4407-add3-cf77d85f4317", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669729, "uuid": "12de3e33-10fb-49e0-8381-ba2641476901", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669729, "uuid": "6dd7e2d7-5656-4de2-b376-fcf7954dc0ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669729, "uuid": "11511dbd-8b31-4548-b414-dd2ab5074cdf", "value": "868c4cbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344f8e83-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669027, "uuid": "968cfef1-32c6-470a-84c8-6f8984a06fec", "comment": "Malware payload (Dridex)", "value": "5cac53a51f7533ac8eda9357c108b929", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669027, "uuid": "4fd592c2-a274-4308-b148-c6046f6691b0", "comment": "Malware payload (Dridex)", "value": "5cc765f17d362f3295d020c61dfd394ac980ea0ab81ae95bba64f528a84ce13a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669027, "uuid": "a84f83d6-3022-4415-810f-ed676269e80c", "comment": "Malware payload (Dridex)", "value": "0d0381054de677047ee127e8533039a22e4e11eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669027, "uuid": "2a503133-4781-4ae5-948e-1504d5319f21", "comment": "Malware payload (Dridex)", "value": "a5aa93cdf5a151da4bc631e8df659aa812194ec3db219aac1a0e39daded2a7fe30237bd71eeae3fe96b7dd7cf8024a2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669027, "uuid": "5132eba7-6590-47f4-9148-8c978bb60682", "value": "4706330BABCDD68CE57ADC7036BE124E38A00FECD02B59158B7DA6F6746D4C5089F4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669027, "uuid": "c9826213-7cbf-42ca-b6f3-bde0a0e07ecf", "value": "98304:dKyNty96OLPigMgvH9WsisKRCqzJ4bSMBXjaom:4YIDPZWshq14bnXjaom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669027, "uuid": "b808ce6a-ef37-4eac-b122-dd16a19caf2c", "value": 3716715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669027, "uuid": "864fa34e-7042-4887-9be8-91a020c14ddb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669027, "uuid": "3f356fcb-cd6c-41c2-b8bb-65cfbe6017cb", "value": "bill 04050.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e69337-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669761, "uuid": "9a60b115-5d75-4100-886c-90a498452b13", "comment": "Malware payload (Dridex)", "value": "fbffe8023b86626e73bf3157e9c172a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669761, "uuid": "895ffc81-3c33-4670-a33c-a6cc772715fb", "comment": "Malware payload (Dridex)", "value": "5cebd7aec3b0f1979839225678ab35ced3616cfaa49a2cf982a14eb855818357", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669761, "uuid": "e8dcf4c3-34dc-4173-90af-38e40f72d715", "comment": "Malware payload (Dridex)", "value": "ae8c03ec5948b01aa71bffa6d72958efae8611b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669761, "uuid": "b90aec5a-2ec3-44cd-8b67-f70abdc82b47", "comment": "Malware payload (Dridex)", "value": "d8fb736e42de6c45ac9f57bf82d939f529dc16ca8da9dc916c9cd4384f56ec08efe051b6bea19192002d94e5138b18cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669761, "uuid": "4d8e6b34-8fa9-47c0-abe1-4dae60577b82", "value": "C1F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669761, "uuid": "99669dcc-c535-4995-be4f-c76ef54f5eaa", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669761, "uuid": "0a7eb9af-b4c9-484e-b1ce-45e7f3595cc5", "value": "3072:Z/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:TbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669761, "uuid": "a675d99e-88de-45d6-a63e-26aa169fe9bc", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669761, "uuid": "ef2f0e86-f389-497f-8d48-32dc236c1ea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669761, "uuid": "b9597f71-1854-4fe1-b391-40195fd06994", "value": "fbffe802_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f508c0-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673598, "uuid": "a5f531a3-a312-4bfe-a99d-17fde791cfb1", "comment": "Malware payload (Dridex)", "value": "2ec2c3a2d4db24fd5f9a380d2ca7a5a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673598, "uuid": "ee581d4b-ad1a-4f49-a481-5ba11623a254", "comment": "Malware payload (Dridex)", "value": "5d22d538b6533e894ed74ddf1f0b5fb2b093b8010b49c8f88d664ee50e1a1fff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673598, "uuid": "fa2cbdbc-4168-4540-8686-40e7f5e293b7", "comment": "Malware payload (Dridex)", "value": "a993429d92d2acafda2f6bfa4a1d76459a503616", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673598, "uuid": "ea9716d4-28e7-48ef-ac71-3b104c828075", "comment": "Malware payload (Dridex)", "value": "562c7989891c0f9ef029879e1f20bbcda7094ef6c15b9e1fb3270ec15c21d8f63b86527e9fe6bdfb30f4793543ed344e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673598, "uuid": "66da5c75-a87e-4c81-bd03-4fcb71358dea", "value": "0FF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673598, "uuid": "1be996cf-6a90-4c39-a3de-bb95bac53da5", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673598, "uuid": "026ea5df-248a-4481-9060-7ce79ee18f7b", "value": "3072:V/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL8T:nbrE1kvcB74DXZ2MellT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673598, "uuid": "83c5a535-54bb-491e-8c71-a2ac746b5e08", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673598, "uuid": "eca46607-fe12-4d6e-94f0-883cfcef10fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673598, "uuid": "f0c87f79-e67c-459e-abf9-f17400db8102", "value": "2ec2c3a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5d7249-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624747, "uuid": "0813db54-9717-4a68-b954-b6ec673d3750", "comment": "Malware payload (AgentTesla)", "value": "13ca5d178cafdf76e121320c02ba1c0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624747, "uuid": "25b54816-4e16-4aa7-99f7-495297629224", "comment": "Malware payload (AgentTesla)", "value": "5d6cf1e2a53e38c09af9710200e2be9fc286f5a7ee00dac49f5f82a456b30af3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624747, "uuid": "68377ffa-a24c-4940-a81b-af74ba0a2e05", "comment": "Malware payload (AgentTesla)", "value": "c057718b951e292b076a7974721481aaa734eb62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624747, "uuid": "9d8672e8-1db7-4cff-942e-e3e5c25e627b", "comment": "Malware payload (AgentTesla)", "value": "2f5c47facef96dedea2d83400ee6e7aef0742b6d7248a990193f7c775fe9d013af095a88b084179a8dc764e923ec356a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624747, "uuid": "f8a99599-1f00-4d6f-931f-e9b9efbf95c1", "value": "97A423550C3523FE73141996BFE428A455B9CC5BEA858F6ECA73A439ECFB61809702D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624747, "uuid": "b7c2bca7-48a6-4739-8d34-ab2402e92795", "value": "12288:u33KkbvxLZEbUeYa1eW4Z0TTSBRx6UMZtUS:+xL+bUeY6Vex6U2CS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624747, "uuid": "5eb0e19d-01ca-4bff-b89a-af121cb18091", "value": 481652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624747, "uuid": "99a455d4-d6bd-4387-849e-9de366713600", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624747, "uuid": "0144dea3-264d-4d80-8824-42c7ca17eb78", "value": "HBL#FGLLCB00017.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caa6aad-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633876, "uuid": "0eac95f9-3903-4928-a85f-f2d24957a14e", "comment": "Malware payload (Dridex)", "value": "7287c54f5f578e0cc8ecfa1ec443da9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633876, "uuid": "8e072471-5bce-471c-a439-fb43a27bf241", "comment": "Malware payload (Dridex)", "value": "5d6d6a9c5299d4b5cea6d0b80533c6e708f563cccc736d91aef70573cf4b724a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633876, "uuid": "efa36a72-f4d8-470f-9b47-3f79b58610e0", "comment": "Malware payload (Dridex)", "value": "27e6371ea6769bed71aded9c81c363ac1cc56ac1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633876, "uuid": "5e9696dd-daf8-49fe-bdd4-bff21b1c07ad", "comment": "Malware payload (Dridex)", "value": "1d7d63b20a1929b6cc98b471249b880420ca5e0fea0ad1f7c0100a8ac452f86539c08286515d68d2f8bbcd52e5d0f9da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633876, "uuid": "ad75cd7f-7e54-4bce-bb80-f503f2dcddd0", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633876, "uuid": "f8967795-f0ac-4fa0-b6d8-73e7662d5806", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633876, "uuid": "bd1f2bce-8eec-4b10-b745-aa4527782a48", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633876, "uuid": "31a684e7-0883-4b44-9dad-c9ddee51c994", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633876, "uuid": "0f062c1d-f905-4408-8d5d-10359a64ab41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633876, "uuid": "c2a5ce1f-ec1f-4ff6-964d-844959ad6206", "value": "7287c54f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2febc86f-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630794, "uuid": "b580cacb-c32f-4637-b07a-a2eccd62db02", "comment": "Malware payload (AgentTesla)", "value": "ea1be429a7dcf207d80ce324a7bd6837", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630794, "uuid": "82d1d7bf-3bd2-42a0-9e5d-8bfdd8888a5f", "comment": "Malware payload (AgentTesla)", "value": "5dacbb9886e6c2a23a4673161551dc804ef1f5e68c4bb74ca6200dec019f82e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630794, "uuid": "2d0e6fe7-34d3-492b-886c-ee48d681551f", "comment": "Malware payload (AgentTesla)", "value": "aa3f7b6c1e103797a5190a5cf5ba3e76e6cfdd42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630794, "uuid": "439b084c-d984-44e4-847a-ad0b540ba002", "comment": "Malware payload (AgentTesla)", "value": "bbcf1dad7cae568c220ea871b16859ddef9f382e040e7bdd0e7c8c7926adb95a54d12e0049dbe79ed2580d6bc1e67f1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630794, "uuid": "36e16648-e5c6-497d-811f-3eaaf0af7a35", "value": "E3F4CF253398AF95E47EA7391530040017F2B907D732DA8DBDE6A4DA1AB3F418627F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630794, "uuid": "b0ba87c4-1f1a-4b71-a5e3-9d82de1fa5c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630794, "uuid": "7c3b07c8-f910-4057-b1d5-26854990ad87", "value": "12288:mAH7yWNMbjBCRTdKL+074W0U2XiPlCsIBM:mAbyWUBC9dTA4XUvlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630794, "uuid": "47f39a67-9045-49de-80e3-287c1758fb3d", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630794, "uuid": "851943f9-915c-44e6-93fb-7acf28391aea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630794, "uuid": "b5cb0200-fe7a-450d-8967-345bc45cf32f", "value": "AWB # 6913321715.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef607f0-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648053, "uuid": "32501ed5-c5e1-4bc3-833e-35d04f26f527", "comment": "Malware payload (Dridex)", "value": "a55bcb8f41c82e679dd440fff190ef46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648053, "uuid": "4aa7a57a-fd8a-4d01-8d18-f9d4f4db77d6", "comment": "Malware payload (Dridex)", "value": "5db617bda31f8fd90fa0f101deb8a4310e2c59a4c695022c1d585bee80131601", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648053, "uuid": "03508a21-751e-4af5-ba73-dcc8fb74afdd", "comment": "Malware payload (Dridex)", "value": "751ff1c4c48b0fa52a1b29ada78104202ed9e3f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648053, "uuid": "4a965951-f500-4649-ad71-384b0040bad6", "comment": "Malware payload (Dridex)", "value": "3440ead27ce69f42c7c4e11ac81467d19e1d0bda42c744d6f3bdc09b66de51b6fc7a4144c5d8341d9be816f98563e57c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648053, "uuid": "00a4d59a-9387-4aec-bd18-40ef033a0076", "value": "CEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648053, "uuid": "4cce16fd-c3e6-4e02-b5e6-874565a57704", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648053, "uuid": "b028e631-de71-4af6-bfb4-b8592b8d91dc", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648053, "uuid": "86268ab6-545c-48ef-a0c7-800fd4176946", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648053, "uuid": "881c85d2-7afa-4f39-b70f-7d32785c14d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648053, "uuid": "fd449c79-379a-4e7f-ba1a-46efb6ddaea5", "value": "a55bcb8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd94c2a5-b1a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662493, "uuid": "0977f18e-1279-44f4-a8d8-1e56f44b73a2", "comment": "Malware payload (Dridex)", "value": "3611e89f47a479c10ae2d835a280b3dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662493, "uuid": "7e96d063-ff1d-4250-bd8b-6d5355b2d3cb", "comment": "Malware payload (Dridex)", "value": "5e12323854ae640f345b1179e454ceb4c815f41ba0b89c9af06dd0f8b24d969f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662493, "uuid": "06309bd5-8b79-4202-8fe1-2129966402fe", "comment": "Malware payload (Dridex)", "value": "80c1cdc4f76f3416623f15f706bbec422d8a0ec4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662493, "uuid": "ed7ce2c9-8a60-428b-832f-21bb1a1d74fb", "comment": "Malware payload (Dridex)", "value": "154c4cb2eb86ed813b04a772db3c6c74f44317bcb7e2815e659b145fd167abfbea3e86b2999f737cd2a1b696089c9159", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662493, "uuid": "c8adf3c5-11c3-4287-aac0-ff5b4f524b1c", "value": "C3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662493, "uuid": "951035f2-3bc1-40ea-99fd-f0de88ea63a6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662493, "uuid": "66a4e6c5-fbce-4439-89f5-18d7e3f2bd93", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662493, "uuid": "6edb14d7-b6ea-41ca-8ff1-f682e59a0729", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662493, "uuid": "72ebf9df-f24c-450f-9a7b-d99098e7926c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662493, "uuid": "4e3d520f-a737-4510-b972-8dcf29ceccc0", "value": "3611e89f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc68ed72-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676986, "uuid": "1c1890f0-627f-49d0-9a68-5da28bb1f2c8", "comment": "Malware payload (Dridex)", "value": "5bd3c7e048a79ceea796eac2e8a4f2ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676986, "uuid": "86c1eff7-ffb2-485c-8ebb-490440b37f3a", "comment": "Malware payload (Dridex)", "value": "5e1aefc80f4d2a131cc1939b39df057a812aaa6fddf26671d6bec6519b5cb461", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676986, "uuid": "ec47d002-aedf-40e0-9304-4b9359ecaee5", "comment": "Malware payload (Dridex)", "value": "2718fb877c23bf2446cb2a45c12835b42138387c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676986, "uuid": "301ca375-51a7-4812-b3ba-e8addf649f43", "comment": "Malware payload (Dridex)", "value": "16a743fa8abe6eaf1ef05354d7b421d503640168ec9e9d52ba4f568b3c730db42087f7292d2d4d2c5f5103580e4d2ebf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676986, "uuid": "b76dfdd6-da6f-440e-90ed-5caec1f0e899", "value": "2CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676986, "uuid": "c1408e0e-6ec8-4acb-aea6-3a1b21c3fc70", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676986, "uuid": "10f3a8be-bcbb-47d2-8ded-defc4afe416b", "value": "3072:MA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:M3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676986, "uuid": "50942b0c-25f7-4d55-bda2-f86eb992a843", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676986, "uuid": "fe230e21-e325-48c2-8962-ae1e88a08aa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676986, "uuid": "a6f44dee-8cb8-4635-a443-3bdc1c0a59c7", "value": "5bd3c7e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef3ead0-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640913, "uuid": "22562e22-e309-41f2-bf81-d9abe38b3d0b", "comment": "Malware payload (Dridex)", "value": "c82355d0ee2be55ae655947b99509140", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640913, "uuid": "6b398533-cf5f-495f-9476-75cc15b44c2d", "comment": "Malware payload (Dridex)", "value": "5e3ab124c02ff38615f78dcba9185ff785df41ca73d8607627127d6b1d9e830e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640913, "uuid": "e47e0dd8-bb5a-4b7e-b12a-e2803cf6965a", "comment": "Malware payload (Dridex)", "value": "29d17bf4e8223f2da2a4a079a65cd50e0c995e8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640913, "uuid": "b780e1f7-19f6-495e-a5c7-aa3ed7af3035", "comment": "Malware payload (Dridex)", "value": "72ef385bdc73bf84d5e94615e1a3da860b8943b38babf80a4e81604b1e115a7a2ee6e6b5c66c1aa6e38ab924bbc9cd11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640913, "uuid": "7b37d04a-e804-4915-818b-d0c36bb53986", "value": "13F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640913, "uuid": "f05c1d60-7380-4075-86b5-1e5ac97d8b85", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640913, "uuid": "26c5a87a-e233-4e0e-9c14-bae6dedb742f", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640913, "uuid": "973b45c2-4c15-426c-a908-f16be848559c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640913, "uuid": "0aeab7ab-1eed-4d22-ab98-347e6fae9d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640913, "uuid": "99cfe121-54da-4345-b79f-3767b888ba9b", "value": "c82355d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c39ce0f-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620657820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657820, "uuid": "e7e8cd3b-197a-4122-b6fe-bafb8e0a473e", "comment": "Malware payload (AgentTesla)", "value": "e45c68ff46fcedfcd019fdb875ce209b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657820, "uuid": "d80a44cf-220b-43e4-8a9f-efb6daf2a4f5", "comment": "Malware payload (AgentTesla)", "value": "5e5783ed2dac9e02718ca9e83f96c8ab3a51866e3456d5f0d94ea16ef470a547", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657820, "uuid": "9c942379-3249-4ba7-9414-d2cb3f1d7cb4", "comment": "Malware payload (AgentTesla)", "value": "30848679043061eece3af7621a5561717d39b5ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657820, "uuid": "f7851925-007d-455e-85ed-28cc916605b6", "comment": "Malware payload (AgentTesla)", "value": "6907aad2ae0d3935a4d456e1a48775589892b94b84f6874976212588e46a43aa86f03b76fcff81e280b07c38d461173f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657820, "uuid": "5b2d0db5-0f6c-46b5-b224-53bd5f9d3c26", "value": "43C423C6A9BF0D4BD701D3EC8AA31AF4224B64C647C02D2D41F7687AACE31C591FB556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657820, "uuid": "bdcb7d21-6db5-47a1-85c5-a93254a040f1", "value": "12288:p6626gOUi8Fq+w8/zVJir2VdG6oa11sPGf51fOrfMx/WDTkiNg:cH6J8gk7VRVdGyrzWrfMx/0wgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657820, "uuid": "bb094174-d305-4f79-bd23-113e991b98f9", "value": 592706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657820, "uuid": "f1256b03-e69b-4a0e-aef4-4f0cddf1cba6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657820, "uuid": "fb209463-e19f-45b2-a715-5515120ae732", "value": "REQUEST FOR PRICE QUOTE - URGENT.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a45827c-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666192, "uuid": "cf5c075e-c9bc-41ab-8432-1d7dc43adc01", "comment": "Malware payload (Dridex)", "value": "999eac2ffa2971e219222c0fb8053391", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666192, "uuid": "694a3930-0485-4a21-bf36-01b28dc7be16", "comment": "Malware payload (Dridex)", "value": "5e9c72a3945499b9bace0a32142b03bc20a141a2a042652d0399abab9902c05c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666192, "uuid": "76580143-eff2-474e-b75b-396b8c3f829e", "comment": "Malware payload (Dridex)", "value": "de4499795543bf87e2b32aa4bdc1a50948a27a60", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666192, "uuid": "6501de32-167d-45b2-96f8-71222821df90", "comment": "Malware payload (Dridex)", "value": "7a263264f3ee440c1953576deceb6a180303e42542a8ac303e23d374cdb5bbac74192e11253ed915b82f2d5ccb92a26d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666192, "uuid": "4fbd8dd2-cf11-4579-b25c-bc4ec9166070", "value": "A4F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666192, "uuid": "d5efdb5d-ec2c-4233-a94f-d99af0c25548", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666192, "uuid": "2dbcf2f6-6679-4f92-91ce-096532c8387f", "value": "3072:FWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:F42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666192, "uuid": "fb5b93bb-e96c-4b5b-b86b-4e33e8f8975e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666192, "uuid": "2f17336e-0426-40d1-919f-3d7d909d7ec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666192, "uuid": "323bb068-ccfb-4ac2-90bc-694df7ccb626", "value": "999eac2f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabc7938-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673655, "uuid": "3fce895f-3e94-416c-8d34-6684ce43f89d", "comment": "Malware payload (Dridex)", "value": "d6b38d449555c579cc3467c48af8f383", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673655, "uuid": "961c6dfa-2667-49d6-b7d2-970ee47c3916", "comment": "Malware payload (Dridex)", "value": "5ed75cae33e53d0f061e5db53f533acf24541f600e3f541926a207345b217c09", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673655, "uuid": "55c1eafd-c7bc-48eb-909f-c9b12f76c7f1", "comment": "Malware payload (Dridex)", "value": "978438d9f64a7d92f4b552ff7430f3eb94fe9378", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673655, "uuid": "76ecb0ee-3d2e-4d59-9b43-e71b5ec6b419", "comment": "Malware payload (Dridex)", "value": "59b3a4ea1ba4a3d2df8b063166a6f155555432d6b283bfd0dd752b1dc341755932ddeed6e56ce50d8128db58f641e1a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673655, "uuid": "4ca106ed-acdc-492f-872b-3e9f18d8a3ff", "value": "0EF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673655, "uuid": "7cbfba09-3aca-4ebd-a522-d7b0791a794c", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673655, "uuid": "533eb999-40e8-442a-b841-203d77c8e3a4", "value": "3072:Yesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:y4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673655, "uuid": "66ce9add-4cad-4ccf-8800-6aaa7434f43e", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673655, "uuid": "ec45ac4c-4731-49ef-ad3f-2dffe141f1aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673655, "uuid": "433396b5-4b06-4a3c-b3fc-40a55ba0826a", "value": "d6b38d44_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4c46e5-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666198, "uuid": "a1069416-2863-4b84-a622-e90503a88c23", "comment": "Malware payload (Dridex)", "value": "86e35c078359cbffafc38c4b4cb9b981", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666198, "uuid": "2610ac80-9836-4ccc-a5e9-954a908513fb", "comment": "Malware payload (Dridex)", "value": "5f0293544dbe31cc7fd462aca2d3e575e613f2fdbe8dcdbed26b5a7c5109dcb8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666198, "uuid": "6bbb6a81-71df-4fb3-81ef-3b18af786f2c", "comment": "Malware payload (Dridex)", "value": "7ced2a1259ddd3e4a5237ab6fd9e40f9d456b2ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666198, "uuid": "3adedb82-3345-4ae8-8158-f07fa065d60b", "comment": "Malware payload (Dridex)", "value": "b7fbb2f4fd86b115308dc8ea755d5df8b69a6ca328f07c9f694cceaf887bfb645c4be6b5b5eb226ce5dddf561de4c907", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666198, "uuid": "d84c7bb6-2727-4974-ab3e-3c0942e78c12", "value": "02F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666198, "uuid": "b1e697da-54fa-4d9d-ab37-e7940b7db8a3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666198, "uuid": "babcb2aa-c797-4de7-8bde-86779ee255c0", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666198, "uuid": "d2d1068a-e512-450e-9ca0-3e1aa09e11e1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666198, "uuid": "5665387a-9ab3-45f4-8367-6fca7cd8afde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666198, "uuid": "24c99729-9028-4de0-8d79-3b04fe298402", "value": "86e35c07_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcbff35-b162-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620632022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632022, "uuid": "871ba4f6-6dc2-4815-9930-09ed2defd311", "comment": "Malware payload", "value": "e428aace4879f3b0dc26112dd778b9f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632022, "uuid": "e1a26c8c-47b2-47a5-afed-4a6a120b09d4", "comment": "Malware payload", "value": "5f0574967bb8f19b547fed4634f188ed756a2d592bd29554e60adf50fba1b2b7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632022, "uuid": "07d4ef6c-bf21-419a-99ca-11e0a6d07985", "comment": "Malware payload", "value": "5a6c01620ac0e29a14d161a746381a36fd77cbf4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632022, "uuid": "7273f56e-9bc5-4a37-bf41-f483bee69016", "comment": "Malware payload", "value": "ae8e7436cd7716ccdc502cc687c8e06be122356c53ce73380f9b227f52d07a435f825b4daf72e5685d45f8df075df99c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632022, "uuid": "ba481737-b9a9-42af-aadb-e28e298b218f", "value": "31355A35F1C3C437C8732A7C8D6BA19D94267E151D2CA85B7AE80F0C5F3A6813A2D6D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632022, "uuid": "74e441a3-ca08-40f6-ae4b-407962b0a7bb", "value": "c1ce3b770da12081af337fb11ba22533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632022, "uuid": "3c52002e-3ef5-4ba2-9aea-43dac215db5f", "value": "24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbn:sbeeGRuPPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632022, "uuid": "79752a63-e32e-4cd3-a2ef-b3de35c281d1", "value": 1163866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632022, "uuid": "44a3c530-090c-4aa9-aa76-0f91a63b5ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632022, "uuid": "a3637c9b-29f2-434c-8ed5-e67e2bd088da", "value": "e428aace4879f3b0dc26112dd778b9f4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144796a8-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620657806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657806, "uuid": "ca3b5d04-dec3-4dbc-bbd6-b21b373f81b8", "comment": "Malware payload (Formbook)", "value": "cb78b28dea109d0e11a05934e02cf9d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657806, "uuid": "62933b64-8ee9-470c-be13-5a8d1a23053c", "comment": "Malware payload (Formbook)", "value": "5f05f0816898db3798aaa6722cfbd0f625a0eac271b72d0b8c295fa056dff733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657806, "uuid": "d4f27fb6-0019-4de0-885b-9a396102396f", "comment": "Malware payload (Formbook)", "value": "caab11bc17589dc8d20805070d1e343d60192751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657806, "uuid": "c75bbf8d-5070-47ed-9a57-ba269227657b", "comment": "Malware payload (Formbook)", "value": "391b9fc2a33e44d000ac04fa5d96671de1551ada4c55e8126209cec24ce78ed0e5133ac01c25f0ec283b72554ccd3b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657806, "uuid": "2434524f-2936-4cb9-8f8c-c7a949fff3cd", "value": "C3E4CF2C2AE89A05D5BE56BC8071D13447F8BD065A17E75D4EE06CFF3DB7320DA02A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657806, "uuid": "b97b8993-cf35-4923-a080-862e344d3dd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657806, "uuid": "9d6e60e5-67c6-4fc8-8765-afa0be022944", "value": "12288:Sn149lEHIu5fXu1CSt1SrDvg2CsVdJ58ysoWL/1qS3LZ7Os:1KIu5vu1v1SZCsN58ys/L9qSbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657806, "uuid": "489c31b6-4666-43fe-85dc-52bd6b082a92", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657806, "uuid": "fa4b1ee9-e5a2-4c75-8cfe-3c4d1cd749d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657806, "uuid": "4246d2cc-899b-49b3-86fc-f51ee514fbf4", "value": "PO#6275473, Shipping.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27084fb9-b142-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620618324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620618324, "uuid": "82b8806d-15b4-4719-b2fc-cb4867aadedd", "comment": "Malware payload (Loki)", "value": "55f7593613104d3c70734156ae654d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620618324, "uuid": "888a7920-5054-40a3-8dd0-f91633e4fefa", "comment": "Malware payload (Loki)", "value": "5f333f48e9e4441893461423c2825f28fbda5e27cadee05e9b42f7c72bfba152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620618324, "uuid": "372e7d07-42c0-4287-93de-0e297cdf6e71", "comment": "Malware payload (Loki)", "value": "72952572587a4233e8552fcbda7cf44d43a106f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620618324, "uuid": "0178001e-7d60-4ea3-854b-2176dfa6f04f", "comment": "Malware payload (Loki)", "value": "5c5edd48562f2e5dde8a30b4c3289678ab449b93c28a91a7708ff878136836ec9cdb08cde5e018e6d3f8210acd416d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620618324, "uuid": "8b7bede8-201b-4cf9-8dd2-82760fb561e0", "value": "D0E4CF203BD8AA58E57F43761970D54463F2BA27C322CB1E69DDA04E1E72786C7B2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620618324, "uuid": "6d18ce67-5d0e-40ad-89d8-c1c3428e4b5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620618324, "uuid": "d5ce7622-fec2-49c7-951e-fb3f67199f45", "value": "12288:YzIeJxKFRXstBVw1hhhq8eujMwWre8IRpA4ar/ROUfgrIhRi+muyJ8tVu:Y4FRXsPGhhhq8tQ7apFI/4UIMhWuyJO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620618324, "uuid": "db2bddf9-13a3-433c-a40c-fae748ad96cd", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620618324, "uuid": "d1fbf909-2b77-4e52-96e6-7acd0f19c661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620618324, "uuid": "46ea3e83-4836-43da-950d-b4f499d20d8a", "value": "List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469760c7-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633839, "uuid": "d8cec295-6c15-41e6-8670-4a7639ce6e8d", "comment": "Malware payload (Dridex)", "value": "bb896ee6f163c26d52d2ee3324aafa69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633839, "uuid": "bd1ccece-10be-4af4-8992-bed87e7a817d", "comment": "Malware payload (Dridex)", "value": "6044e3103eaad29f052d2106633d22d12943844aae3a2f0b2dd3491696195260", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633839, "uuid": "99a0018e-cf65-4493-8ec2-4990de8d649e", "comment": "Malware payload (Dridex)", "value": "3936e849100ffce31d00043bfd09cdc79c59ebbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633839, "uuid": "cdf75533-4932-4195-997b-b24759e08f06", "comment": "Malware payload (Dridex)", "value": "42b24cb552459b4a818629a3f35002342329ad95747d8e3a8d93aada04c9be48db90ac170c1341cdd9be14e8f2abeb1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633839, "uuid": "0859cfd0-be8e-41ba-9e65-76691efe39bf", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633839, "uuid": "c1b90258-84e8-4676-b574-a2897546de3e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633839, "uuid": "e6dd57b2-2d3d-47c1-89f8-1be7c6246a10", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633839, "uuid": "23199638-95eb-40af-bf04-0aaa4984c8cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633839, "uuid": "4334c71f-2983-428a-a2ff-84ed227de742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633839, "uuid": "5d9b6e9e-9ba5-4c4f-b850-750edd62e67c", "value": "bb896ee6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e85ae95-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620630738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630738, "uuid": "9f443577-b591-4fa8-9f04-fdb6c5543b9f", "comment": "Malware payload (SnakeKeylogger)", "value": "bcc8e84149f84ac691049167f120f1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630738, "uuid": "6150303b-e836-4197-98be-e9f671256401", "comment": "Malware payload (SnakeKeylogger)", "value": "606367b05183c5ec1e848241849a990f6b47a3d25f0228da2efd9f6c8a14a8ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630738, "uuid": "e9879e67-d6e5-4035-bde3-4630ca3380e3", "comment": "Malware payload (SnakeKeylogger)", "value": "8e37af6b0bac7774b1d3e7b174d34d6ebd385914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630738, "uuid": "7bf28a79-458e-45eb-8be5-574eded2ce8c", "comment": "Malware payload (SnakeKeylogger)", "value": "d4490e45bb95c2ee7db998c91ddea982c58c0c78b253eafd1489ed656178947796be786361a8d0b8e1252bbb7e7d15db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630738, "uuid": "f70a4bd5-f059-4883-91a5-90f5c4978a9c", "value": "7EE28359BF5A42BBDDBA8FB425E242421B74FDB6A8339B0F75B04409DC171879D03A24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630738, "uuid": "0922654a-767b-4488-b80d-b10e02d9283c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630738, "uuid": "bcd72890-1d75-499d-bb18-ff8f318c99bc", "value": "96:ae7mqkn2A8hb06kkk73cbIHw70y+zwTZOjAhD9LaxzNta:EZabkNQsHw7P+zwTZOjA/eTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630738, "uuid": "61132b56-0aa6-4950-8068-7f37184a4176", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630738, "uuid": "c70cca1a-99cb-4d5d-be1c-a28c836c1d88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630738, "uuid": "ece4e7c1-ed17-48fa-a155-1140ea8cb162", "value": "PO202104-543_ Inox Doan - Trading Co., Ltd,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc786887-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649982, "uuid": "f91a9b8d-983b-4659-bc00-459fbefc510a", "comment": "Malware payload (AgentTesla)", "value": "d3a112b7db03dcaf4bb34a15cdc7d3ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649982, "uuid": "e340a38f-362e-4ac4-b66f-5e69054522eb", "comment": "Malware payload (AgentTesla)", "value": "6092426b9644101b4d123ac00ae1b75c272d0698f532b86b2280de5996c69e7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649982, "uuid": "f94ec21e-3ed6-4adf-8472-76bbc34840a9", "comment": "Malware payload (AgentTesla)", "value": "005f9e5e2a9f7124e58b3414ca345650704b241f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649982, "uuid": "0e693531-1793-4670-9c98-e390791be9cf", "comment": "Malware payload (AgentTesla)", "value": "a3cb985581d0d53f5afa30f75430a1b6b98cbf780a8d9b6cfdfdda4859f28a58ec22fdcf50af42cdd3fdbff5d8619df4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649982, "uuid": "b3277247-c3bb-44cf-b81d-ea2cc95a1050", "value": "8E055BD8AE9A790ED16E6378706041FCC3E77C2205CEA7EA07D3FCEA1B6321095516D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649982, "uuid": "9049da32-635f-4763-9d58-1f39ae589b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649982, "uuid": "a1587568-3874-4810-8d7f-973fd39d4667", "value": "12288:EAxbEVPBToOU+8Hq+6a/zV7i32VdGgoa11GPGfBXfcrfMxdm7ICfLc:4xBTT8KG7V9VdGw55UrfMxdFCfLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649982, "uuid": "99f2a372-b620-469a-b21b-53a6b22cca1c", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649982, "uuid": "965509f8-bb59-4f24-8efd-64837407c2e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649982, "uuid": "a8c0326f-15a7-48a1-bd81-afbabd0b21c8", "value": "REQUEST FOR PRICE QUOTE - URGENT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97f5f8b-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673519, "uuid": "0afd83b8-c36d-440c-b36a-c1894a2db857", "comment": "Malware payload (Dridex)", "value": "eebfaf286b6f5f164b97620dc015895a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673519, "uuid": "be7c7576-25fa-4ff6-a698-351e06329bd7", "comment": "Malware payload (Dridex)", "value": "60b9658bf03bf2db828e3b648c50253b3fbe3e2b10cbb91237ffb8d15ec3b9ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673519, "uuid": "bbcc6403-628c-420d-af06-9de541cf6aed", "comment": "Malware payload (Dridex)", "value": "dfeb6eb791e0a3369fc0e56e6551c9c2dcfa043e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673519, "uuid": "fd5ce3f8-3537-4972-b6f5-505e3ff8faf1", "comment": "Malware payload (Dridex)", "value": "4533283dc8e9d5b5d40b69e4ef3daf6f07b5ee79645fe8e3d6e7c5fa65835019b2fa4912ee0b4902b44a5e2edf28e438", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673519, "uuid": "dbf8061e-5126-474b-8236-c597a05cc3e8", "value": "2BF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673519, "uuid": "e08777a6-9c3f-4c61-9a41-208960fd3852", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673519, "uuid": "f19d0247-51ff-4454-a859-415dbfe13d9a", "value": "3072:Besl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:94+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673519, "uuid": "c4fd8639-cbc6-4cc8-b69f-62ce2ffcfe6c", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673519, "uuid": "45f2f5fa-431e-4da9-92c4-50f0efd88f30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673519, "uuid": "4f95a8f7-eeca-4018-b530-d34bccf5031a", "value": "eebfaf28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a500f80a-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640869, "uuid": "b8efce69-3eb4-4b0f-8c1c-1dde068b0a6b", "comment": "Malware payload (Dridex)", "value": "7db811d8485ab57f4b95df18aa917d1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640869, "uuid": "135623cd-3288-417d-a67b-85f68db8e867", "comment": "Malware payload (Dridex)", "value": "611c84f437c654670977bc40e47b84b919f7e818c7aa4ded153f1cfb77925e1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640869, "uuid": "480a8a7e-6dfe-4c7d-92ae-d9eeb517f28e", "comment": "Malware payload (Dridex)", "value": "daab03e48512494c88f6f5c022aa9d098f5567d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640869, "uuid": "2a210d22-587d-4289-8cc5-c1febb2faba4", "comment": "Malware payload (Dridex)", "value": "78e774f07549457553744aedea0b989f8bff99699c067946d6d97a0bb3b977054c43c07a61779aabae1b2f84ceff9d49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640869, "uuid": "10b629f9-8d04-4ceb-b864-f96077b11a8f", "value": "4BF3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640869, "uuid": "1854b440-3cd8-4243-bc35-639e8a8e51b5", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640869, "uuid": "bd9e0a17-ca31-440f-8387-8039c84c572f", "value": "3072:RuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:R0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640869, "uuid": "45705a76-340b-4e9f-8421-613cb037daa8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640869, "uuid": "176fe93b-25e3-4fe3-85b2-29c39a123dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640869, "uuid": "00d6f435-ef50-48eb-bbe7-288ac61a021c", "value": "7db811d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e529f148-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669753, "uuid": "9d930ac6-8d1c-4049-b113-ee873df943f5", "comment": "Malware payload (Dridex)", "value": "adb4ac60fe5b390cdd2ccac3f7085fea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669753, "uuid": "9680676c-f913-44cd-baa3-73a1f03c57a7", "comment": "Malware payload (Dridex)", "value": "6139ae243d7ab18505dbeb94ccab42825e0472e25165db9174c5915967801da3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669753, "uuid": "45f70ac6-9dfd-48ca-9b85-ef961ce1f1fd", "comment": "Malware payload (Dridex)", "value": "1019eb830527bbacf61b6be1fbf8ea89e3396200", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669753, "uuid": "af0fabed-622d-4a9c-ba34-d1d3f0aa5af3", "comment": "Malware payload (Dridex)", "value": "1bb03bc690b30a8d5988a1f57fee4c196aa718370712da186bf3ff92e4fb02c5471fbd311b40ad54b257595ffa8692db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669753, "uuid": "a2ae0c03-3f57-4473-8c61-b431cb1adf8f", "value": "9FF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669753, "uuid": "644007da-af41-4613-96e2-42b1c394cc71", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669753, "uuid": "08cf14d7-5763-448f-aee4-eabae28498dc", "value": "3072:D/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:xbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669753, "uuid": "2cf55647-0337-44fe-b96a-0bf6a82059b4", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669753, "uuid": "20d608f2-15e9-4acc-89c1-544d5d0ad15e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669753, "uuid": "b76e3cba-b4c6-44e6-af9d-d9b09d09be3c", "value": "adb4ac60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3092c07-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687735, "uuid": "2d1b0ece-5032-4ad8-a2cc-f5160eec6235", "comment": "Malware payload (Dridex)", "value": "4650f52c4188b6ffcc2da8e5d3d400e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687735, "uuid": "e09dba27-022a-400c-a92c-2333a3b93542", "comment": "Malware payload (Dridex)", "value": "61439fdcdb88cf47fbdf8094d29a912d0ff00c361e7de70966d431a4108f46ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687735, "uuid": "2618b351-5610-4dc7-917f-36e409b5b127", "comment": "Malware payload (Dridex)", "value": "8a26e34ab5b6918d9c2818358307d9cea1edf6a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687735, "uuid": "bd09bba4-62b5-498a-a557-8158246cead0", "comment": "Malware payload (Dridex)", "value": "31b9e194abaf27c400ce1d2606e85a2243459ba44cc80733df656518f1f6a705e1e4a54497b03b15c8022df5c73f5377", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687735, "uuid": "2750d75f-cc9c-4f4d-8f01-6eb4274d6279", "value": "ECF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687735, "uuid": "e102432a-ffe0-48fd-a5b4-a89ee071eba9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687735, "uuid": "8298cccd-d421-4663-9c24-952a66a8d788", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687735, "uuid": "d6041abc-5232-4271-a204-2e5ad1605ba4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687735, "uuid": "d484c145-3073-41ea-a09c-90fe2efeb1c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687735, "uuid": "56a4bcc3-d263-47f1-8f4d-c16a19be812c", "value": "4650f52c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b76622e-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673307, "uuid": "be6208c8-e3bb-446a-a661-473b286da81d", "comment": "Malware payload (Dridex)", "value": "117fdc94597543b1d68155bbc080d917", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673307, "uuid": "464069fa-674a-43c9-b2f4-00fba9630f6e", "comment": "Malware payload (Dridex)", "value": "6146daa0b059fe7f6a0650a6728b1cecd7199182266a7eca86b3fe81c4ca58ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673307, "uuid": "5f2d6aa9-289a-4763-adec-8875180ac279", "comment": "Malware payload (Dridex)", "value": "8fdf8b68f91bbae96fc4c945d3906bd3a3b00bd5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673307, "uuid": "ed264ee8-f1cf-4846-8bee-06537843a6c2", "comment": "Malware payload (Dridex)", "value": "2f9d94c5362d8b81bb646c34b14bae5a34fc5b0ecbb49f7100b8a761e8955c081967d5f7ff4ac8057c684847e3657522", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673307, "uuid": "95362d2f-73d9-40b8-a576-6ae4c52539a6", "value": "56F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673307, "uuid": "f6d9f4f1-e72e-4bea-bb3f-e1c85b7dbeb3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673307, "uuid": "069925ca-d5d8-45bb-b67e-b9022c82b2d5", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673307, "uuid": "3ba7f3e6-e2cc-48b3-8ac8-c61ed2bef8bf", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673307, "uuid": "10935f23-47b1-487d-9d75-2b3414ffdaf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673307, "uuid": "fb13d54b-d3ef-4cd5-8ae4-8ee7641a4bfe", "value": "117fdc94_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4984e905-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673358, "uuid": "191ce32d-6a79-456a-86cb-6d5e6c9f0a21", "comment": "Malware payload (Dridex)", "value": "c31f261f89352f0539f0a75272e9b6b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673358, "uuid": "69663778-95e8-4f4c-9f5f-3e685f21bc4a", "comment": "Malware payload (Dridex)", "value": "61690bd757444aca3e92da338383cc152c125597ec910d36075962a02ffbe960", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673358, "uuid": "d2d25f55-e518-4c6f-bce2-a0103fe3c35f", "comment": "Malware payload (Dridex)", "value": "2331c892385d8b72fbb913f86f101adf83ac38bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673358, "uuid": "9f4005d5-1c30-4b1d-9096-cf6e4acd7358", "comment": "Malware payload (Dridex)", "value": "b3611c3ee002cfb6fb002e53fcdddd0d5fb6f0b2b7fa7acddc02c852d0d1d27b7d399cc2c1a5b74b3c9286e3527876ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673358, "uuid": "a73a0f2d-3b4c-4111-9ec1-bd52e46ef856", "value": "25F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673358, "uuid": "6e371e1e-3913-4c0f-9d14-87dcba29988f", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673358, "uuid": "c9ccec8c-de34-4940-9a3f-49793b6f60c6", "value": "3072:w+esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:ww4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673358, "uuid": "1724c3fb-3255-463d-be41-23713de410a8", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673358, "uuid": "1b1e4577-28d0-4753-84c0-006d53895d1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673358, "uuid": "f809b1cb-3dde-4a68-8188-40faa440c16f", "value": "c31f261f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae75159-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676984, "uuid": "7f6d36c8-ade7-4fe5-ad54-318c0681ef55", "comment": "Malware payload (Dridex)", "value": "6c33c45d50576ff42af08d32541f61d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676984, "uuid": "07b69098-fa7c-4e70-af7b-a37849591452", "comment": "Malware payload (Dridex)", "value": "61936caa59dd1481ec91fab28d53a8b1ac9df7cffb2332769f47fbd2ef6e1da0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676984, "uuid": "14eb9206-509f-4096-90bc-607fb0b57441", "comment": "Malware payload (Dridex)", "value": "bf0d45567ebe6c4245adee3e5ba691df93db60fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676984, "uuid": "7554565a-7240-434c-9eea-98876a4490ec", "comment": "Malware payload (Dridex)", "value": "95086bd742a418f8d40fb16598840458527b5555ad23083a61ce9af200be48062dd5de167434fe39e2c6e9a986e9b3ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676984, "uuid": "c8d149a2-2a9c-4b90-9270-48c4aff26c82", "value": "E4F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676984, "uuid": "e8469f58-1129-4bd7-8670-5af68d6b9e04", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676984, "uuid": "e98f913d-f547-4ede-8a61-ba8c1b4a8ce5", "value": "3072:qWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:q42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676984, "uuid": "bd2987c1-805d-483b-8e81-bb62ce291020", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676984, "uuid": "878c8b3d-c98b-4c27-95b7-323d498af2b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676984, "uuid": "73336b73-d609-4173-9a1f-9e749094e075", "value": "6c33c45d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3c38fc-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687695, "uuid": "94726f75-4f52-4d9f-b6b5-78ab2e7962e5", "comment": "Malware payload (Dridex)", "value": "5acb32b81f439092c2bc5affaae33808", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687695, "uuid": "971d4448-079f-40a4-8f27-76427c631fcd", "comment": "Malware payload (Dridex)", "value": "61b7d155e5eba6303a2e764e129f40c74fcbf7524dd6db07f183846d7225d7bc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687695, "uuid": "8ccaba87-6309-4137-bb3e-5da6a9fcc485", "comment": "Malware payload (Dridex)", "value": "5bd0c98a484aeb066890c87d0868093f8914c392", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687695, "uuid": "1a13f4f5-adbc-47eb-9c13-d61baff95922", "comment": "Malware payload (Dridex)", "value": "f73d48e5ea1826be32310b880e3bd1796119c74cd1cbd44c20e89c860f6e1eecf57c8bbfbbc4b66d6206e99ed868635a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687695, "uuid": "bd3f9c68-4519-4432-9a83-208436a2f4ac", "value": "2CF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687695, "uuid": "6796ac9e-2a10-4c08-b4da-f916171abaa2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687695, "uuid": "8f553c58-7418-4ee4-a177-48023bc79c52", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687695, "uuid": "c4d68fed-cfde-48f3-94eb-1bf824af97d6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687695, "uuid": "da1900e1-dcb2-403f-9258-fc85f4d95176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687695, "uuid": "7b46b12b-4ab0-4832-a2c9-23206cd8ffa0", "value": "5acb32b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c295f743-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676997, "uuid": "9425a689-2225-47ac-b55b-e1c35a164074", "comment": "Malware payload (Dridex)", "value": "84967d61b6138ad4c10a3708da8b45db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676997, "uuid": "c967e8c2-874d-4eff-9660-7e64411fa518", "comment": "Malware payload (Dridex)", "value": "620694d880981e680c9ea364d6b6bc35386a9b9c536e699a0456c595e652d3f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676997, "uuid": "aa3c48c3-1614-4228-9cc9-1075b95f4e08", "comment": "Malware payload (Dridex)", "value": "01e6bcce6766f796782495ea686a2dd1f36a7139", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676997, "uuid": "8a687328-20e9-4428-87c4-4e0019dcee6d", "comment": "Malware payload (Dridex)", "value": "ff94b7a7d57935351309560db8d973878de030163b890099889e416a8a15391b56e1758f8370be398c8d9467c43120ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676997, "uuid": "ddaf186e-61c1-42fc-b5b3-30b7108c4ea8", "value": "90F3D0906A97DF0ED9C13CFD6A96A879B163468D811FDAB8D0CE84CEA4775B30327113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676997, "uuid": "7ced9815-aa5a-456a-aa14-fe6b9bd280ba", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676997, "uuid": "b58910b2-4458-497a-96a7-9a5b83781d94", "value": "3072:Hesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmm:r4+VZQpt5hyPsa1ekiEtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676997, "uuid": "4ad5fc11-ba7b-43af-9398-f7e1cefda157", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676997, "uuid": "518d930f-46ec-439f-a426-cb90c97479b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676997, "uuid": "f6e4b15f-be2e-4297-810d-e6b4187ea46f", "value": "84967d61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9148a95f-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648138, "uuid": "5d2e5361-a509-47e4-96c1-93ad7e237655", "comment": "Malware payload (Dridex)", "value": "4565702e5b55ad3cccbe6d8565acea5b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648138, "uuid": "93daebda-2c3c-4596-8d66-3bb524f54872", "comment": "Malware payload (Dridex)", "value": "625660e85712d109c4daa05a8967afc2b1150daf6dd592de63c1026a7047e9d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648138, "uuid": "149e0dfb-b640-4e32-8e74-d83dad024f89", "comment": "Malware payload (Dridex)", "value": "9a3205fa3862b05e51a43d4f0143013dbbd227eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648138, "uuid": "e3ed4288-e25b-4c35-9dc4-0573ad2c54c4", "comment": "Malware payload (Dridex)", "value": "afaf44e006b3e9db4529249c31e56c019c2ea65291e6b76fabcf6b602e67338552d1195948eebf6d6fc690008202d646", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648138, "uuid": "6bb5043f-eedb-46d3-9494-1f5e8c25c4e3", "value": "EAF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648138, "uuid": "474858f1-8d7e-4004-b401-7822c7e1ec6f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648138, "uuid": "b16c7d4d-e4b6-4f24-973d-a77a60f474c3", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648138, "uuid": "0780912a-0806-4632-9044-acbf3a6552fc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648138, "uuid": "dcb593a8-7f00-4549-a0bf-f2fff7c26e23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648138, "uuid": "07eb2433-90c1-4548-bdab-99cae8d7ce53", "value": "4565702e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce58c64-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669015, "uuid": "1b35156c-a7b1-41bf-a2b6-37b738d5536c", "comment": "Malware payload (Dridex)", "value": "65a5f80bead7657a5c14641f145f8748", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669015, "uuid": "2ad65aeb-2c09-4edc-b48e-5c91d7278389", "comment": "Malware payload (Dridex)", "value": "62b36585aa3d18c2457c639ae79049f4b6459fb38b251a40165b657c49cdf5ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669015, "uuid": "56cde8c8-8b90-4421-aae2-f815c2d7ab10", "comment": "Malware payload (Dridex)", "value": "e571d18bd8f32fe90da74aec8352afb538f99dbf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669015, "uuid": "94dbb4ac-3bca-40ba-929f-78292455c19c", "comment": "Malware payload (Dridex)", "value": "fa1c4cda84a0a234008301f1ee58fb7899e5c7b228c756bdb934ea3637f574b45914f4db78616f2fcebd8db2495a9a30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669015, "uuid": "8b2494ae-b59f-4b89-85fc-cf5d03e1e3f5", "value": "F106336FD281E270D6B3293F8D1DBC456536D1231077ED493AB7B8286A26C09F5F28C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669015, "uuid": "c185c51c-b6dd-49d5-8939-d504aeef36b1", "value": "98304:epi1Br6aqo3GvoCrjE8Me7fjZqyA6V6McL7:si3r/q2qje5XMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669015, "uuid": "72574c42-0813-4f53-829a-68c77bc90d44", "value": 3830914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669015, "uuid": "a815bae8-7877-4263-8447-513a13a19dcc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669015, "uuid": "d1a508ea-5f28-4308-8a56-16c656b7a512", "value": "export of bill 896621.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dae565-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649061, "uuid": "5b1c4535-9b11-427a-a9a5-65df19646752", "comment": "Malware payload (AgentTesla)", "value": "a27830fbdc33e7ac9bb1053add26d846", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649061, "uuid": "c117c41b-1186-405e-8274-a6b73b4a7dad", "comment": "Malware payload (AgentTesla)", "value": "62c11da90bf85835b8d3ec232dfcd4fbc3542e5b80232789017e0c172fb83289", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649061, "uuid": "ca0da264-1ddc-4387-8f0c-c69abd391c17", "comment": "Malware payload (AgentTesla)", "value": "9e575c7b04ac69485d5fd0fe94ecee6cd40e581b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649061, "uuid": "5a9cde40-bdc9-427e-ab89-b0e658511575", "comment": "Malware payload (AgentTesla)", "value": "02a47de1d7914975f8ef67dabe03d07364cb926d4dbff5d47c011e9b8deb4907d8357bb881767685347ab552afd82786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649061, "uuid": "c6740980-0528-4e26-aaa7-1d774f0cb028", "value": "02F4CF2037D8AA98E57F97752970954023F6BE2BC762CA0E6D9EB14D0D32342C673B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649061, "uuid": "e653f09b-18f3-4d1c-8e68-187d7991f40d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649061, "uuid": "83bf8bd2-36df-44b7-b84a-30946b4a98fe", "value": "12288:iWZvExKT2X6tBVw1hhh+JRX0c6n5jUk3tYT2N4Vhmj0sZmg/5q:ifKT2X6PGhhhKREcStm2Qhmj0sQ6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649061, "uuid": "bc51dfe7-a10b-4c73-aaa7-0c794bf9b67f", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649061, "uuid": "d0e4c425-2820-4c67-adaf-69971e379648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649061, "uuid": "8d219d51-0211-4d41-8e5c-5085cb278a28", "value": "BELLOW FABRICATION Dwg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6ada8e-b17b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620643054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643054, "uuid": "6e0c148d-0e1e-4b89-8e2d-8104977aadb0", "comment": "Malware payload (Loki)", "value": "edbfda723ffb18a11faf9bd670cb6e5b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643054, "uuid": "a6e37db3-c5aa-4ada-8231-a9af94257482", "comment": "Malware payload (Loki)", "value": "63ddba84b3c3724417657e094d78911de7cab1dd8c794fe567588a786461766c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643054, "uuid": "15858ae2-5fc0-4c8f-964d-a8b3cf4268a7", "comment": "Malware payload (Loki)", "value": "14955f3e14b826878046b47ae85fa918f296cbf9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643054, "uuid": "64e1d4cb-bc5b-4c44-a641-0631f7c245b5", "comment": "Malware payload (Loki)", "value": "a74aa1f46f60b765c1f02227356e90ddc2ee7fbd1eb3a4c48dfdb125abf7bbe1642e7c0bc46d51d9e94923396c02a587", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643054, "uuid": "bbe5343c-e839-4115-a668-2bf7783f455d", "value": "FEE4CF2037D8AA58E4BF87761D70D55063F2BA27D332CB5E6999904E2E32742C7B2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643054, "uuid": "84f1027e-b25e-46f7-bb5d-fac7d39c0745", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643054, "uuid": "0e0b3eae-34bd-404d-bd28-809d9a68c9ea", "value": "12288:sAlBDJlbOXTtBVw1hhhLDf817BEzAroGVbAQCnXw+Sj3f+JAxbZ+H6:s0lbOXTPGhhhnIBg4TCnX3F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620643054, "uuid": "81b99cfb-d3b6-4a44-9aae-246c47735270", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620643054, "uuid": "36365ce6-6456-4603-b1ff-f258dc5db314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643054, "uuid": "15aa66f2-c38d-4945-a3cd-71d818f2dd04", "value": "purchase inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3451061-b1b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666744, "uuid": "5f354251-0b87-4b35-859d-9be4dab9b977", "comment": "Malware payload (Dridex)", "value": "2089ddb364e94e29c87df30a036b6082", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666744, "uuid": "1b0856bc-730b-495e-ba0f-908f05c2240c", "comment": "Malware payload (Dridex)", "value": "63e5ead32667412761253975bf82659e66f53a5fcf6d90782b682ed3195a47fb", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666744, "uuid": "735c45d4-b505-4a1c-842f-1c8fc35487f0", "comment": "Malware payload (Dridex)", "value": "0331c2dd859646f2932a0cf2bcc3b1864c181a3a", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666744, "uuid": "57d17677-22fd-40d1-9846-69603315986c", "comment": "Malware payload (Dridex)", "value": "f787da75fbcd89127cf9d0d0a99add8bb0773110ace2ad3ba97e592f9eb85497b072888ff98d4e663a996647aece9cc4", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666744, "uuid": "10390d70-68e7-467b-901c-277b19fced97", "value": "3C0633D620C79625C5BB593C5FA78B92AC681073C25FC0EB7599F17DF8CCE4A12C0A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666744, "uuid": "d48dc316-b10e-452e-875c-b227827e7a8e", "value": "98304:kRlDakixMO5apanaMjslq3NoP+xuaufWcO4+3B6FNGoxXTFItaV:kTDakmoarYq3NKwuauf3+3s6oNTFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666744, "uuid": "938a531a-262f-4874-826f-dbc0c6590da3", "value": 3905483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666744, "uuid": "9b527e16-85b1-405b-8ce8-7d0907a37e2a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666744, "uuid": "c8748bd7-f9ea-4cb1-a90f-e6ea296acc9b", "value": "copy of payment 786442.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc141a50-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673657, "uuid": "eb8ccff9-c73e-4f87-a283-e50ab8f760ae", "comment": "Malware payload (Dridex)", "value": "63427f96222242ce458e77906c2e2bd1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673657, "uuid": "acca5cdc-f748-41a9-b48e-2544701532f5", "comment": "Malware payload (Dridex)", "value": "649522871ce4e888d40a924d2da8c908678e2f968b3be8657399994c25631477", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673657, "uuid": "a87a7876-edb9-4c33-82a6-25c6ec89e4d1", "comment": "Malware payload (Dridex)", "value": "b95a61cb59f05d8942296907d6b079782313bb47", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673657, "uuid": "abdbcb49-a357-44b7-aa2e-2cbd644d9f98", "comment": "Malware payload (Dridex)", "value": "b71c25a4525efc384f73bfc54c7fb5bda0fd982ecd8466387981a6bba008fd73d374786fb98e880666945b4c3004aeec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673657, "uuid": "fc230f22-3ff1-445f-b3f4-986790d7e7d4", "value": "39F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673657, "uuid": "a1c2908d-933b-4217-a2bf-5f0e19109af4", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673657, "uuid": "ce83ac24-4b76-4cc3-8859-76fc496e1e67", "value": "3072:yesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:U4+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673657, "uuid": "bc15b3e8-5066-40c4-b94b-f25b71aa3102", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673657, "uuid": "2203aa96-3da6-4fbb-b07c-a38d6af36376", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673657, "uuid": "9e94e0c0-23c4-432a-ba4f-22923b212ca4", "value": "63427f96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46492350-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637274, "uuid": "bd312361-f004-4709-a2cf-7f3f153be270", "comment": "Malware payload (Dridex)", "value": "be10073a895f9426cb485277a27b3d7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637274, "uuid": "a5a818be-96bd-45c9-b742-b825952631f6", "comment": "Malware payload (Dridex)", "value": "6568daa8370cc50b53e8892a1fb20dfbcee787286d10ae5ffbffa275f0742ea5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637274, "uuid": "5c7cb234-2cd6-4381-b8c9-43851de2ebb6", "comment": "Malware payload (Dridex)", "value": "cfb0c2a1fda31a1f53413e46189e5c0e0b1e7399", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637274, "uuid": "2f982a4c-5c0d-45fb-b420-e2b0a8771687", "comment": "Malware payload (Dridex)", "value": "4cbd981b3264760fc6dc92f4e9a45e60dda1fa4861d9d8a9d280fcc09247a92f09cb3e8b6481ddfe6ed4c0ec8de3b7f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637274, "uuid": "ca14c45e-4d44-427e-a3bb-77a7ca996ca7", "value": "E6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637274, "uuid": "01135c1d-350a-4414-89cc-9745f4a0e6fd", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637274, "uuid": "9076054e-d504-4e2c-a692-d1b768db31bb", "value": "3072:6iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:5eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637274, "uuid": "8db80940-6ed2-4bd6-b00a-260b4e965831", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637274, "uuid": "1edfc60d-74bc-4100-82a6-2c4595026ac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637274, "uuid": "db7a06a1-75ea-46ce-bb4b-8d6938ea30ba", "value": "be10073a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c42614-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "0512b547-e4c7-407d-a8d4-a9b267a44b63", "comment": "Malware payload (Dridex)", "value": "cc0ae5837832e8094180fc0675a5239a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "a8ab5882-8a00-4f52-a5b2-999262b42c39", "comment": "Malware payload (Dridex)", "value": "65b06761d23d20dce6290d23dbd2bd4f685b588d79ffa3496defa732d33e790a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "030a0021-8ec5-48af-a7bc-decd3424cd53", "comment": "Malware payload (Dridex)", "value": "72af3940c8637f4e897608f786e258581bf6b367", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651843, "uuid": "3eedb532-114f-4153-a16e-25fce6eb5ce8", "comment": "Malware payload (Dridex)", "value": "d137b2e347d78cc8f445a2df9b52b771b2fd79ec0042586923e54fb941815fe1fc1e775ea1a3e6493f0a13dc2fecd2b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "e82c4df8-4c0e-4c62-94ae-15fbbcbe4734", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "a72fcaf3-d65c-4a64-9035-19c20af2aa97", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "6728366d-a721-4474-933a-dc31e9889556", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651843, "uuid": "5133455f-3499-41da-8d7c-05644d5e55d7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651843, "uuid": "16047366-2660-4b62-89a0-e1ec7c6c2b9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651843, "uuid": "11203801-1378-4d21-a1b8-cb0cd79ca3da", "value": "cc0ae583_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0b2685-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680472, "uuid": "e80ddcb5-7795-40d8-a134-a0927257a179", "comment": "Malware payload (Dridex)", "value": "2c8183ece462f7ffd7e438aedc83fad2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680472, "uuid": "254e851b-24e1-44ae-9f3d-b7f08788d424", "comment": "Malware payload (Dridex)", "value": "671d25f64920dc690fb8d94bad0d8ca294f30b90f0cbea246c8b4a6624aebd62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680472, "uuid": "1f31670f-a9fe-4ae3-afb8-87295df59c58", "comment": "Malware payload (Dridex)", "value": "afd15e48b257e876efde80ab599f951efe4c210a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680472, "uuid": "183f941c-95e6-4000-82e9-147786dec7fb", "comment": "Malware payload (Dridex)", "value": "dfe5fd9e0cda51bc56cf6ad395a95303e33124fcb204e86b0bbd215d31441208d6d8db0a20e60ccf18fe04b3284b09d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680472, "uuid": "895a6f2b-4adb-41ab-beca-cf8fa74ba30a", "value": "A7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680472, "uuid": "dcdb5371-1c02-4632-9e94-3a4707c103e8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680472, "uuid": "1ade5bf8-5bea-4058-a74a-ba623043ff96", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680472, "uuid": "0c6b824d-5413-488e-91d9-e5d5a7fe96b3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680472, "uuid": "bb3bf1fd-b5b2-4fce-9aea-c92645821e5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680472, "uuid": "c6a4266b-5cfd-46cf-af00-14ecae61a796", "value": "2c8183ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0000cc-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648075, "uuid": "ca05d84b-8488-46bc-84f3-80e67c9b1cc8", "comment": "Malware payload (Dridex)", "value": "1a5737da7b4136a97d3c26d25b67bf74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648075, "uuid": "2740cf79-f5a3-49c3-b297-d079d6f7a2b1", "comment": "Malware payload (Dridex)", "value": "67449829769c7b834b710bbf3d9157ab61e58d6f8386a674ece1f420e47d8503", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648075, "uuid": "c5fc85dd-469c-4dc7-9b58-fb94b83f1ef4", "comment": "Malware payload (Dridex)", "value": "04ee5b7a97fd51dd886e2df64f965b5b1d617801", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648075, "uuid": "513bed3c-4486-4e82-8793-ae8afa10a2b0", "comment": "Malware payload (Dridex)", "value": "4536fe4fe5d3892e49adcbcd1e23079cbe0905ce724c69d64d1976b68617f8c9af02f0d6d1615110bf4d70ca8a29aedd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648075, "uuid": "35215048-7efe-42a4-958f-b3359be38134", "value": "6EF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648075, "uuid": "71ce79be-91bb-4a25-bc19-f2055f93b3e6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648075, "uuid": "5cdf63bd-b44e-4328-bedd-523f2ec8a579", "value": "3072:0IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Nc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648075, "uuid": "8ac2d2a0-0c3e-47da-86fd-0faa68591a60", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648075, "uuid": "b2d132c1-86f3-4133-808d-c021b0142220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648075, "uuid": "baec1b06-14bf-4d35-a391-b3b31a273f1e", "value": "1a5737da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffa8452-b1b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620667302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667302, "uuid": "3540f0a4-e264-412e-8a71-4e158d0e8f38", "comment": "Malware payload (AgentTesla)", "value": "3bde41238c5520477847ab69aa014366", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667302, "uuid": "5cfafab6-b9a2-44ef-8888-36d8edbf71ea", "comment": "Malware payload (AgentTesla)", "value": "676f9e765f4ee9ca07059ec5f71cced42ca552d821f35356cda4e1dd8ed4849e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667302, "uuid": "b4446581-892a-4f49-a27d-dd767b193e77", "comment": "Malware payload (AgentTesla)", "value": "15bab283ed37f395ef12151d758e4edef479ed67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667302, "uuid": "915e672d-347e-46d5-b464-c75b3e4d5427", "comment": "Malware payload (AgentTesla)", "value": "8ebfa1291a048d0654c3753587e52afe9bb7d40724003290dd569971bdeb56e55ee5146809f8eb14546999b9edac9cb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667302, "uuid": "8b00875f-8549-4549-b980-e13a39f060ba", "value": "04E4D0203BD8AA58D57F87761970D54063F2B927C332C75E699E904E2E32782C7B2763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667302, "uuid": "ab1ba665-287a-42ea-a99c-fc3cd2c57e3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667302, "uuid": "e539fa60-010f-4dcd-a4c7-2323ad7c9275", "value": "12288:qgrc49TyqXUtBVw1hhhRZKO2QnhluvDfwQOT7qhKcSpJ:q+TyqXUPGhhh3KxQ3uvbwlTehKcSpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667302, "uuid": "4adb57e7-c921-4fb7-a98e-62ceb3fc629b", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667302, "uuid": "44fbd388-40e2-4e58-b313-db5e38611984", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667302, "uuid": "c11115e5-5e43-435e-b036-164b4027ed1c", "value": "3bde41238c5520477847ab69aa014366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eef3d68-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684104, "uuid": "59212077-1954-4721-b0b5-66f54b435e07", "comment": "Malware payload (Dridex)", "value": "992800d1296a4e296c79253cdda49be4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684104, "uuid": "7e5e9b9c-e3a4-4a30-a0ef-c6ca29e03100", "comment": "Malware payload (Dridex)", "value": "677f456a42d829a8036236b737c3b40e2c6b3b81c07b3e1fe05710cd0ad747e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684104, "uuid": "4a4d6dbc-4b97-40e3-88aa-5de0624478e4", "comment": "Malware payload (Dridex)", "value": "5318405e0d81b99f43bd221ffab2852542ef4d0f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684104, "uuid": "6db62a79-a1c8-4b1b-bc35-ab6e822cc609", "comment": "Malware payload (Dridex)", "value": "73c5d4044697dc63a78079306b930e661014e55e88ef81651116c37b7990f8bdd785132143228202472c9f17a32a29d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684104, "uuid": "39f864c4-062c-4d11-8c57-caf43c0b65e0", "value": "B8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684104, "uuid": "a3298323-4fa4-4fc7-a8f2-54c90cb0a3e4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684104, "uuid": "0abbdb58-be0d-46bc-bf27-24b2037e2351", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684104, "uuid": "b1c6b68c-0f20-42d9-9237-066b4268fe63", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684104, "uuid": "c6c80877-73d4-46c4-b93e-b761f18288ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684104, "uuid": "7e746377-746a-4de5-b26e-a97577e91903", "value": "992800d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a719efb4-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658912, "uuid": "8ef8ea11-df84-42f9-bdb0-37d2f388ccb1", "comment": "Malware payload (Dridex)", "value": "66221bcf6fb553ac039a3ef4aa4fc73d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658912, "uuid": "c4d79a77-342d-4bb3-9c5b-e289aa451e3c", "comment": "Malware payload (Dridex)", "value": "682a8083578934f52c4bc14ea1b47641d4d3099a5374a5c4262c1bac13aaf65e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658912, "uuid": "6ce88505-5b83-4cdd-89a0-2cecdafcd513", "comment": "Malware payload (Dridex)", "value": "1f345fda40a091c908fe8a3592931fd96c052eb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658912, "uuid": "cb8a0c1c-9e28-451f-9064-309e68fc73de", "comment": "Malware payload (Dridex)", "value": "277746b2b7f35acee48a7a6eb977ec17de62b987b2f33b4199be89c4032565781d70f40c83ae740272480bd4457ada5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658912, "uuid": "f77a9838-3d15-4b58-810f-f5cd331e3145", "value": "06F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658912, "uuid": "9a8fe007-c9b1-4096-b2e1-19f78b5d35a1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658912, "uuid": "f0f13547-4df8-41e7-a84b-d4cf72e30d77", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658912, "uuid": "f6e7da9d-b773-4c6c-92bd-9b3b8b7f767d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658912, "uuid": "4e37262a-e081-41e7-9ee5-ba9c27f84e4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658912, "uuid": "48ee2907-5185-4638-ad58-b27a2c0fc072", "value": "66221bcf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40aba913-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684080, "uuid": "bb8a04bd-0740-4055-a05d-94bc1ccad3bf", "comment": "Malware payload (Dridex)", "value": "d2cbcdb630b27ebf86504b4de68497c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684080, "uuid": "8544d9e8-8158-4795-8aa3-7380ad09fedd", "comment": "Malware payload (Dridex)", "value": "685e7bc0335fb117e16875276214d3016a3140834092c7825e2535610bf0f56a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684080, "uuid": "35d3e09b-6b1e-495f-802b-67d48b9fd076", "comment": "Malware payload (Dridex)", "value": "3cec2b024eb9bb9163232d8789bf464698dc3b8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684080, "uuid": "3a16d9a6-5b9e-44b8-acc6-da8a37038938", "comment": "Malware payload (Dridex)", "value": "857e6816afc737c6ce05b7c3f2a7fe0aeb0678c2c37e4d486147fed16837f8571d0e117d25d40cf36c23d448f02d6a8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684080, "uuid": "51bd37cb-d2a5-4dcc-b820-584ddac4c4b7", "value": "EEF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684080, "uuid": "d8ea8d34-2b85-448f-a7ba-9423955efbff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684080, "uuid": "13e4e66b-cb11-4c29-9900-27078020d499", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684080, "uuid": "7600d3c1-6193-409c-a2d7-640baffa9de7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684080, "uuid": "146331f4-a2b0-4ec5-b193-72fc0f63c70b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684080, "uuid": "15d7ab6c-8e81-474a-b6e1-d451419a3973", "value": "d2cbcdb6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3916ac-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673362, "uuid": "9e73d372-886d-4419-854f-175f5174a46e", "comment": "Malware payload (Dridex)", "value": "b0af4f9e9ae62e9ace8863bca416c28e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673362, "uuid": "6c065943-6c5e-4cb0-8dc4-e3f3f62f3f2a", "comment": "Malware payload (Dridex)", "value": "687062d59f07423bdbd5d4512e2c2aa1bf3d0c53310f18b6f043b1c9bb0c5752", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673362, "uuid": "2ad47579-f9e7-489f-b67c-0ef20fa9dd80", "comment": "Malware payload (Dridex)", "value": "a32d6a479c84bb1fab90d8fea292cf64c2509478", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673362, "uuid": "3699f5f0-a40d-4b17-923a-c7b2d8fc4e55", "comment": "Malware payload (Dridex)", "value": "845807461ae13d8d510a8b7cd1ea5ad4bd03a1b17c2b45cf8281fb1bf1b57c39977ff62f25ed10e5b799c392008aac30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673362, "uuid": "0f109a19-7db7-46c6-9a5d-512004bc8f1a", "value": "94F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673362, "uuid": "3f8db3c3-6b75-4298-98a2-a34f6680bce6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673362, "uuid": "dce6823c-a1f5-4ce1-ba02-4ea0fe9ecba8", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673362, "uuid": "ac4c27c9-fc14-45b3-8cb2-7c4d49e6a0c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673362, "uuid": "e0b00721-a1a0-4953-9610-c37bd4424318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673362, "uuid": "dc787829-a8bb-4f2f-b180-5180d18086c9", "value": "b0af4f9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee27c3b-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673662, "uuid": "98ae00b3-4ddf-40cc-b70c-7dca6205e51a", "comment": "Malware payload (Dridex)", "value": "94c76147009e27dc00c2ed14a9c5d717", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673662, "uuid": "8b11fccc-a79c-47b1-a5f0-0b2331889eda", "comment": "Malware payload (Dridex)", "value": "68926f382e9b7e0398bec256d19f14590be4fd2bc12c1ee4f517c584616324b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673662, "uuid": "2d46296b-ffa1-44e8-80e1-1426e4498a71", "comment": "Malware payload (Dridex)", "value": "7bc7b77b06815356c8f031d2abfffd6a5e52436f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673662, "uuid": "e7de75a6-a4a6-43fe-b335-d50aafd59328", "comment": "Malware payload (Dridex)", "value": "27e51e25f34e31efb9fbf03f584ccb65fac99d000e43ce3567da70ac7c068dbbcce3fa4410d339ba64f1b67699baf4ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673662, "uuid": "3b92ca62-7c8f-4422-b32b-cbd3ba5b06ee", "value": "05F3D0906A9BDF0ED9C13CF96A96A879B073458DC11FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673662, "uuid": "11e3acfe-204f-4f0c-9f3d-906a65e45d40", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673662, "uuid": "21fc442a-8c13-497d-a9ca-5edeb96751dd", "value": "3072:Lesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicL7e:v4+VZQpt5hyPsa1ekiEse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673662, "uuid": "fab57911-740c-4e1d-967a-23859fbff2ee", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673662, "uuid": "2836ad36-2653-4cbc-8918-ca140efc97ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673662, "uuid": "89762f01-ebdf-4b57-bdcd-1d66dd752eee", "value": "94c76147_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c79f777-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669873, "uuid": "6a71aa55-e6cb-44c9-98f6-e1854f77cd9c", "comment": "Malware payload (Dridex)", "value": "4a6f9c2c74faa6cd2d13cf51768b9ad1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669873, "uuid": "e8bd266f-f7fa-4475-a250-bf40f9b95161", "comment": "Malware payload (Dridex)", "value": "68b0e185bd77b432cb1dc83b61790f8ec14beef5a3e494a2e76742b12be39952", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669873, "uuid": "59cbe0f3-9d42-45a8-8a70-34e300f82afd", "comment": "Malware payload (Dridex)", "value": "7685c329f7597a7dcb14264bf00afee7044f4714", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669873, "uuid": "dd0c456e-4faf-40ab-b8c5-735f3ff052c5", "comment": "Malware payload (Dridex)", "value": "7ff8db63fdbdefaaea57ca8502647853a9678d158eda9e6a4e9f4d8946be000ae9c79a01aea77816f8d8cd2683902bb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669873, "uuid": "c6cf4906-8ddc-4f86-8540-e36cabb24db9", "value": "CAF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669873, "uuid": "6eb175f6-211a-4ce0-bba8-4738fd799436", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669873, "uuid": "0a5b2734-e8e6-4155-bb52-e330e532ef56", "value": "3072:U/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLss:ebrE1kvcB74DXZ2MelZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669873, "uuid": "02a0d631-8952-468e-9dc8-35116c3c919f", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669873, "uuid": "524e7e7d-151c-4e48-b2fb-bc165db97621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669873, "uuid": "ee6d0993-57f4-4346-b434-f4cdd41fd26a", "value": "4a6f9c2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b419522-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620649013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649013, "uuid": "63efc9b9-968f-4a30-98a2-71385d5642ff", "comment": "Malware payload (Formbook)", "value": "74e4eb9afbf8f9c9b285a46ced831979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649013, "uuid": "f82b90df-8d2b-4262-8fb0-225bd5ddaffd", "comment": "Malware payload (Formbook)", "value": "68c72cdcc504fcbffe3d6219cbeeed9586e0e362f073070eda7c0b4ed962d14a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649013, "uuid": "44b1db0f-7ab6-42a8-8945-9dfb7e098795", "comment": "Malware payload (Formbook)", "value": "8d65df9dc971c859f0a86a158d9576f528603410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649013, "uuid": "aa16c7c7-f8a7-468c-b5d5-1da36d515ead", "comment": "Malware payload (Formbook)", "value": "a0e8d6d7101ba749b3a0f3ce154873fb355d96548bd67bddd807f0d9564aba509336621c45dd25fc0d467d4a8f79dbb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649013, "uuid": "7b06a9be-670e-423c-9422-da6298a08a72", "value": "CB746C81EA9C2CD7E41116B24837A909305BF95B43B30E9F93AEBA3559732972037D37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649013, "uuid": "37408480-ede2-4ae5-b55d-b5f3b70d4adc", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649013, "uuid": "26fb292c-aed3-47ff-a915-79ac1697d410", "value": "6144:f9X0Gni/KtKNZIcxjbzR/ACYRJq8uTGAli4EKVvBMSk6:p0MtKNZlXR/36JQTXvvV5MI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649013, "uuid": "d0bc589b-728f-4fed-a713-afc1b3af59f4", "value": 344003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649013, "uuid": "eb40abda-d5a7-49c1-853f-87107cbc746c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649013, "uuid": "bc6c6ef6-ebab-4d73-9c23-f241e6b2e504", "value": "New_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdf4d51-b16a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620635787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635787, "uuid": "33c943b4-dba5-4e72-bb1e-470645140a48", "comment": "Malware payload (AgentTesla)", "value": "1b00607781e33139732ddf82fbcd7b5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635787, "uuid": "06f19e4b-5586-4731-80ef-3869b84c9bd5", "comment": "Malware payload (AgentTesla)", "value": "6913f1380708d91bbfaeeb18f435b1017d4eff0541e5ebd3a00d5d6c9655c644", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635787, "uuid": "b23cfbe4-e757-4ebe-be02-cd26563734b4", "comment": "Malware payload (AgentTesla)", "value": "6b6642526367d9a56cd10c2d339802bcf7681b1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635787, "uuid": "74c5270a-66df-4d7c-a1e3-a08c54a9eefe", "comment": "Malware payload (AgentTesla)", "value": "c20e3da9d433749ddcf65363bcfecc1d9987b24aba69eeca381c73488ba3e63a5c24acb283e3f805155b1610102bb93e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635787, "uuid": "c4b5d1f3-fc99-4c71-ac46-f28775b95db2", "value": "C0553AA831D063EEF2168F3297C91CD096102F75532A8507923F33BD993ED779AE44A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635787, "uuid": "86a4f8bf-89f4-4750-856e-f9f226116d14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635787, "uuid": "5c7118dc-dce1-4f50-9c59-46f328e2e4d8", "value": "12288:gmmJMSnoLLoS60/K7yh0YgDO9ZM/O/V1QllA7gfX8mz+OmgQG1NxETyDOihZfPZO:MHoLAYhZoO0ll5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620635787, "uuid": "17ef6833-57d9-48dc-9c2e-23b023797fb3", "value": 1313280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620635787, "uuid": "512bdee0-f162-4fc0-932a-0eae94feb8be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635787, "uuid": "7b50fcbc-0eb3-4a88-b314-89158ab06f7c", "value": "Purchase Order Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa19945-b15d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620630177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630177, "uuid": "2ec5ac41-4c6a-400d-a759-91d0c3353741", "comment": "Malware payload (Dridex)", "value": "113f28000e766391d0b66091dba67abf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630177, "uuid": "97e76b4c-a063-468b-8089-8c78420c0328", "comment": "Malware payload (Dridex)", "value": "698db7a4d5c5b1d3c2dcc32dd17d8434ad098d8747f9dd216899b5d18b571621", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630177, "uuid": "beb710a8-ec11-49f6-a3ce-22db8d1ce4e6", "comment": "Malware payload (Dridex)", "value": "b0d69f7b8f27970a2c66e223d04ca0b37572c0fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630177, "uuid": "170b47f2-d6f8-4e84-8ab6-e1a09ba21fca", "comment": "Malware payload (Dridex)", "value": "9e6f57970bbe72190f97917e5676cd6804cd1bb3cf60f988da7000d00504913a47f53acdc975bc0385706304f79fb299", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630177, "uuid": "f4a9e5c9-f4b5-4e29-8991-cdc42eb154c9", "value": "1EF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630177, "uuid": "4b7bbff1-c403-4441-8d3c-682c68a0578d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630177, "uuid": "253f5d93-663e-49bf-b6bd-bd7b33d7756f", "value": "3072:UWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:U42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630177, "uuid": "83452a87-53ed-4ae1-af1f-6db6d0507d82", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630177, "uuid": "f6c446f4-e5c5-43fb-a4ce-9639c2e8b3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630177, "uuid": "10a0970d-6bf3-441e-a245-f9e8021a2bbd", "value": "113f2800_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45a0e97-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620630560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630560, "uuid": "7e361a23-4d8d-4aab-b73a-2c6c97678ccc", "comment": "Malware payload (OskiStealer)", "value": "f7806771779eff1504460750b98e1b36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630560, "uuid": "86929de9-263a-42a2-82bc-13d37c78854b", "comment": "Malware payload (OskiStealer)", "value": "69bde69e3d61156b312d0c178573b3e46f4160219c969c8482b531827720c0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630560, "uuid": "222f8b18-2e64-41c8-b4ba-0afdee181c4c", "comment": "Malware payload (OskiStealer)", "value": "2086e9896d12b1b47f34f248da913dca79da9045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630560, "uuid": "1544744b-4550-4c56-b78b-7c8383bec0fd", "comment": "Malware payload (OskiStealer)", "value": "67260e2ea5c2633f425c19b341badfc80ec9e02b4be088a2174771aa7fc31d879b60636389429b482a2fae7792b93116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630560, "uuid": "e03a7615-5809-4764-a2e5-a31668746d0b", "value": "EB45199C7650B6DFC867CD3699681C64EAA078BB830BE243A01715EDEE1D987DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630560, "uuid": "1e9f08f6-691f-43c4-b02a-bba0587024ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630560, "uuid": "360e7999-f2ca-4134-a7bf-2f674281510b", "value": "12288:35XdfMQVFk1n3yZAuzQEMgl40U0ba/G3k/uekjzpASsMPx9sFivl1/DsrFlr0un7:3bEsGneBVMm470baP/nwzpsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630560, "uuid": "b701b9c5-b226-4495-a796-18a1f42e9540", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630560, "uuid": "b2d9a122-5211-4c95-aaaf-626e9db9e6e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630560, "uuid": "ebc055dc-d36f-42b2-b697-025843c341e1", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5395fcd3-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633861, "uuid": "835b6616-2141-4607-832d-aff2633ca6c0", "comment": "Malware payload (Dridex)", "value": "9f311c708a8ab60c7673d2ad2290b0ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633861, "uuid": "d4166b5f-5630-4419-a230-b8029f494140", "comment": "Malware payload (Dridex)", "value": "6a19ac428a95d43a6df20eaf20e8b691d6bb4c0abb53eb51d84d1909523f436f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633861, "uuid": "f6166aad-c2fc-4d9a-83bb-b15d8e005d4f", "comment": "Malware payload (Dridex)", "value": "c9d193d14384ff126eeb506ce8287d6002904672", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633861, "uuid": "28141943-92cc-4ec1-80c2-0236b44a9398", "comment": "Malware payload (Dridex)", "value": "162b08145596f65faf136542b61e02fae6c1e18dba157cb43872eae96423c5813c758cc8649e7128e3e5692c2a9ff4e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633861, "uuid": "9afc458e-6d82-40cc-907f-5e6fa19c3f14", "value": "39F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633861, "uuid": "95e53124-e2f6-4561-825b-b357552febf4", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633861, "uuid": "206c35d1-58d9-4b5b-98ba-b150fbefd1a3", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633861, "uuid": "52aad2a8-9dd7-4cb8-ab1b-fffb24cb258a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633861, "uuid": "697f1118-3ea5-48a1-aa03-eeebbf0724d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633861, "uuid": "30d387fe-b2b7-4ead-b936-c35f4e1bd2ca", "value": "9f311c70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0c29b7-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655325, "uuid": "c614e148-cb51-4e86-8f8a-2d10e3e98787", "comment": "Malware payload (Dridex)", "value": "d4aed0eeb64376b288eae812650303c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655325, "uuid": "ef0b80d7-2bab-439b-a8f5-c91729523ba1", "comment": "Malware payload (Dridex)", "value": "6a300012eba6775d8c433def5fce17dba5bf3247f0aa0d078ab3918b6d179d03", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655325, "uuid": "252f8e03-04dd-4acb-8a3f-1f8a7178f84b", "comment": "Malware payload (Dridex)", "value": "d831fd447582a00c6e84e32d6d8355c396f9c1a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655325, "uuid": "2d009ff1-2038-40de-9b13-885173b0372e", "comment": "Malware payload (Dridex)", "value": "068bfd6b907f99e0f494760d67c793a622c3aee76d7c8fca0a1f5f94b494cd23a9dfece044c15c0427aad9f0b233bb8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655325, "uuid": "4502ee69-2fb5-4919-b139-b25c3987fd6b", "value": "A3F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655325, "uuid": "75e84d77-eeea-4f5e-b585-45133c7815fc", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655325, "uuid": "90f7e122-17a8-4e5f-a49c-cb4cdb71895d", "value": "3072:fBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:JuXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655325, "uuid": "7f8d06db-16b9-4c84-9e01-210b139ead24", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655325, "uuid": "afe92eff-e85e-4b1c-9bc4-ac0c7cce1dd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655325, "uuid": "27e593c3-0e91-4ee6-8e12-adf757803e33", "value": "d4aed0ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3f4231-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673471, "uuid": "0f2528f2-2dbf-4d8f-a217-975e106cbb66", "comment": "Malware payload (Dridex)", "value": "313ee61a53504fe6ac5f4563bd1bb0b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673471, "uuid": "dd4a740a-c52c-44b0-a785-31f0ac707c2c", "comment": "Malware payload (Dridex)", "value": "6a81a622d87e5a0e5a2682472422f45cb92ad6d856ce1ff395c4bd97f62c6c5f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673471, "uuid": "dd1c889b-1516-4726-b803-568d9ca2f5a4", "comment": "Malware payload (Dridex)", "value": "d684df317738e5752468d84f67d2d6d7f1a6ffe9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673471, "uuid": "e4756223-9011-40ab-92cc-0488cbf8a5ee", "comment": "Malware payload (Dridex)", "value": "229f67fadbbb09ce0c3e896bfd8492e789be2f7e1e60b10d05b973cb9075df85ab336e133da93b12496a2a5989b3c0d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673471, "uuid": "12daca1c-b1ca-4a2b-ad9a-702992394c4f", "value": "28F3D0906A97DF0ED9C13CFD6A96A879B163468D811FDAB8D0CE84CEA4775B30327113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673471, "uuid": "41f21df4-5fc6-4b4d-a36e-fff77511149d", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673471, "uuid": "7733bce3-8d40-45d0-b12e-719159371a42", "value": "3072:Nesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmm:54+VZQpt5hyPsa1ekiEtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673471, "uuid": "225ccd45-04d1-4212-bf7b-09c7eb1d0a49", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673471, "uuid": "83fc32ee-1b03-4319-a90a-051e9354a235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673471, "uuid": "c2f178e3-de62-4333-b71f-adf0a8a257e8", "value": "313ee61a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07bccb5-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620652029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652029, "uuid": "92ae156f-0458-4f6f-b65f-8eafa74bb548", "comment": "Malware payload (Dridex)", "value": "acac32eeb7af485034bf8cd07d705ca2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652029, "uuid": "34df08a5-72d4-47a3-adca-eea23991c561", "comment": "Malware payload (Dridex)", "value": "6ae1dbcab7d643255afdfab9e1701906da28c5d46871fd53003437953509a693", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652029, "uuid": "13bad9da-28ec-4885-8680-f6f6dc16bb73", "comment": "Malware payload (Dridex)", "value": "a09d80d858a180462614f9ca41827194179dcdb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652029, "uuid": "7c57cd6a-6f60-41ef-8570-f5993dab1d91", "comment": "Malware payload (Dridex)", "value": "bfdda7eac854161f7aa461e08eeb6485e8231f14ce1084a545040150f79883df9d85948e6d841a62ba40103d835b9583", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652029, "uuid": "9467fe39-d622-47f3-911c-7cb31332e7c5", "value": "E7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652029, "uuid": "1f794912-9769-43ab-8988-a14a01cb5c9b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652029, "uuid": "8f28bcc2-ab9e-4bba-8ec9-3653b0d62731", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652029, "uuid": "f0ea4f56-5395-4a48-a989-66b53c6d0988", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652029, "uuid": "02eec8f9-b8a1-45e3-b8e3-fbceceb99c6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652029, "uuid": "ba5ce4d5-0dc2-4345-ad6c-9d403db42aad", "value": "acac32ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15c30fa-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620650017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650017, "uuid": "8ff820b3-6b5b-4d8c-ade9-719e542ef48c", "comment": "Malware payload (SnakeKeylogger)", "value": "69a090b8628c40e12d04b123b63ed431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650017, "uuid": "627e8d10-56b4-4005-9c9b-9965ca353087", "comment": "Malware payload (SnakeKeylogger)", "value": "6b91f5d2fe0e0ffcf7f562772ec56b2c98b5d9e7496f848e04d1c61ccec0c282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650017, "uuid": "d3826404-f13c-4d6c-8fca-f9de9556c346", "comment": "Malware payload (SnakeKeylogger)", "value": "50c5627641f4904d0a573373bc8e3adca7c71faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650017, "uuid": "1e220030-19af-41ba-8fb1-fe5a1f39959d", "comment": "Malware payload (SnakeKeylogger)", "value": "3ddd742ac74d6d5b4867629fb2b3a3cddd1a8ae369a3d005d6f3bdf4d4a0811a1db07af11e22183c523854460ec335f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650017, "uuid": "b041087a-b5d5-4752-8bfa-1d3105336c6f", "value": "DFD4D02C3AE89A05EABE57BC90B5112047F8B1065917F75D5FE020FC1CBB721DB12A9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650017, "uuid": "b0516b4f-e9dc-41dd-ba19-ce166101df1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650017, "uuid": "9cd075dc-5f5b-4043-8b24-f00b73eb4c8c", "value": "12288:ZveIqYiWCUF8supfniV8IQOqlRDjRHCjUOR8nEYd2YpHtvqtwp3M:tqPWCY8su1nBrOqX1i4ORJeNvWwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650017, "uuid": "d3372baf-2981-4dcb-84c5-e764df57cc66", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650017, "uuid": "718356b7-57b2-4499-993f-87e058ccab51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650017, "uuid": "fe2a402a-4006-4c11-b4a1-2a3245f7621b", "value": "TWI-SHA 202102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a58870-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620630344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630344, "uuid": "8135e5c4-6d51-4a7c-81e0-6e5ffb415eb9", "comment": "Malware payload (Dridex)", "value": "6ef4478812f99a3723ac7dd0a88f04c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630344, "uuid": "02b9d229-35aa-417c-a8a8-b51de27298bf", "comment": "Malware payload (Dridex)", "value": "6bcc15cec038446d3c3e953b9ef7be5ef89cafef24789599cfd0699f63b885de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630344, "uuid": "731912a8-f2d1-42bc-949f-c09696795fb2", "comment": "Malware payload (Dridex)", "value": "d458ec42566008d4ff1c8fb42d9e18ddc36886ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630344, "uuid": "fa5977fe-1ac3-417d-b1c8-1e3746b136c6", "comment": "Malware payload (Dridex)", "value": "1cbbc344d7e862bc595d7fa81f9961b59fca3e12bd9d73a06701b432fb71fb7b0f025e5a182b59e08e697976ba8d22c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630344, "uuid": "dcfddea7-01c4-46cb-8722-2dd19f129d54", "value": "5CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630344, "uuid": "d2ef8c5c-751d-4888-a056-92e9582fb551", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630344, "uuid": "25c0cbde-008f-4d8d-953f-216db9bb1fd6", "value": "3072:6A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:63J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630344, "uuid": "fd2d8a0e-ce26-427b-8c01-7f29fbb4eb17", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630344, "uuid": "bb4259f2-8e90-45a1-907a-0698ed2612a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630344, "uuid": "3a77c0d3-944c-45e8-913b-87c3cd23e05b", "value": "6ef44788_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f1c56a-b17d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620643906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643906, "uuid": "f9649b91-0068-4ef5-81f8-d2d9b8231498", "comment": "Malware payload (AgentTesla)", "value": "ab00a2b6e072cd6a7adac6a227e129fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643906, "uuid": "15cdfb64-c264-4365-99bb-ffbf7e8ccf8f", "comment": "Malware payload (AgentTesla)", "value": "6c3e2de1ae1bd65297af6ae24897368d24db8f74a1bb755dfa129dc203691543", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643906, "uuid": "51b969ee-11e8-4f4e-b829-8e505312f37d", "comment": "Malware payload (AgentTesla)", "value": "33a115a303e9a12fefa325821c791f42746c45db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643906, "uuid": "52777765-2ed4-4a2e-81cc-22c43c9f5dc1", "comment": "Malware payload (AgentTesla)", "value": "c468b0e7262be999d00a24fa18386c8fc9c589a5ec9477b705bd9a1dff9d0032fefa08fdc4a6d0f4e3264f6913c48df8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643906, "uuid": "89f72594-088c-4039-b5a4-f81a0e368285", "value": "BB53D05EF050BC71C0F3BCBD8314C0CA554D6C09904E7E1B7288AD4E595A2EAB2EE3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643906, "uuid": "81bdff27-bcaa-4247-8db2-f5a301f63f2a", "value": "1536:wiuXOQOTO19mChPUH6I/YrShnDkY37Xw1cl+mcCE:wXJWHDwM+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620643906, "uuid": "cd85b2ae-fbaa-42ca-b2df-61578dc4b94f", "value": 62013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620643906, "uuid": "b9318cdc-7154-4275-8726-697bdb600c1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643906, "uuid": "59dad6e3-2039-43f1-be08-753487ac30a9", "value": "SCAN_CRED_SWIFT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166ac1fb-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650938, "uuid": "a2e8733b-3032-4eb1-8fd3-bac3af0da0b2", "comment": "Malware payload (AgentTesla)", "value": "e63ed0c7946b6c89294cea0d1987b671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650938, "uuid": "a36d7bc3-5394-41c8-8099-e8e714955075", "comment": "Malware payload (AgentTesla)", "value": "6c43ac41372f9ff91e47ffa81a9c086e16cc32014d0b6f7c4571fa31a8fecd3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650938, "uuid": "d01a5d91-bebf-4e53-b911-a7187d0343b9", "comment": "Malware payload (AgentTesla)", "value": "c5bb5c60fc10518ba7a41b7bfe3416f926857863", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650938, "uuid": "dc5ea41d-3f1a-43b1-9db8-e4c04ee6e151", "comment": "Malware payload (AgentTesla)", "value": "5b03e94df2903d419f9dc993b8a373c5673885dc1780c0d0cb76b657790d0f4bbd96c1fea9df728d48f2b4adeb1b3f6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650938, "uuid": "43237aa5-8e0c-40a4-a46f-cdc2d2c0c21e", "value": "8DD4BE1826A44B45D5FEA67CCC70D3204EF9BA06D517EF1F7AA070E81CF7712EA0295A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650938, "uuid": "a57daa3a-b192-460d-96c5-0ad4d160db29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650938, "uuid": "4100d259-0449-46db-9b92-3918b3bd2491", "value": "12288:kveAzZ8C8NQ8Z+5/kkOB1bQST5ysXuzU:KQXo5JOfxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650938, "uuid": "7da07ca8-db3c-47d8-a8bc-30fa5eb57ff9", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650938, "uuid": "3addc777-7e45-49ee-9510-217adaa01f85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650938, "uuid": "64194202-74d4-499e-ac08-2454fc52ba8b", "value": "guluh4pYFQybxL8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3461b8d9-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655283, "uuid": "cdf683f7-b25b-427a-bdaa-9ac6825d05f9", "comment": "Malware payload (Dridex)", "value": "eac9cb2456f3edb58c02dd71137d6a9a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655283, "uuid": "59d9352f-a7eb-46e3-9d32-3796ede4cfca", "comment": "Malware payload (Dridex)", "value": "6c519da4b21f247c14c4b1fea6287591bb05e288a3eb85bd119af8c418c9d63d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655283, "uuid": "a2e3461d-fafc-4b9c-a63a-97cad32f8dba", "comment": "Malware payload (Dridex)", "value": "f2df8f6ef22a3ac76ef0862225648ae028d7b08e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655283, "uuid": "c6b6c060-15cd-4017-833a-1e08e3d91663", "comment": "Malware payload (Dridex)", "value": "a106415089cb3f9872c1828a2af318219fd91bc8db7e1d201b33a9c96e9d2a3d7d742dceefb0ec0606197f95f9f15b18", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655283, "uuid": "de60a1e3-6cfc-4e5a-99ba-169374f1f20e", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655283, "uuid": "9b2f6760-8d72-4e6d-9e49-4b6d5f3a09e3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655283, "uuid": "1f753a2e-8375-4dec-8c51-8ba3445cb49e", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655283, "uuid": "addcb6e2-563b-4316-87cc-1123fb5aa7ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655283, "uuid": "89e75f19-b819-4b07-890c-0968597d2b01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655283, "uuid": "5a4fbfaf-50ea-4d73-a1cc-300af963fcc6", "value": "eac9cb24_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c039e2a3-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640915, "uuid": "8a8fbef9-87c0-4c9a-aff6-b07944c84990", "comment": "Malware payload (Dridex)", "value": "f1126c0df7ecc9445bc54c34ab05e2b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640915, "uuid": "da9cc5c2-f2fb-45ad-b94d-d4899a6a6ff0", "comment": "Malware payload (Dridex)", "value": "6d6a9dba3805b02eb96d067046722873cea08c323af99a6d6218d3fd6c11742f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640915, "uuid": "a963869a-91fb-4471-b92a-61f588bead50", "comment": "Malware payload (Dridex)", "value": "f9c4fa2d9e231245f68eed7112ddcbb8b6365a75", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640915, "uuid": "abc1aa00-e9d6-4972-9bba-e1bfbf7bcca5", "comment": "Malware payload (Dridex)", "value": "7a7dd1196444a44107b444190d587a05a6cbbbd949ed531f6b99e8deeecfff8661918d38d38bd5e45f9fba713b1be2ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640915, "uuid": "d9c481a9-43ba-4a29-a93a-57828a3c7761", "value": "FEF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640915, "uuid": "c8833e6f-b732-4ea1-bed7-c7456eb1aedc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640915, "uuid": "8e5a40fb-62d2-4af2-9769-94be11ad2ae8", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640915, "uuid": "4d85a27c-a79d-4200-a996-819a4d66c650", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640915, "uuid": "81ed7775-164d-4c2b-b885-3e4a97faf3b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640915, "uuid": "f7cc8cc8-8b5c-4534-8845-eec652a9ed99", "value": "f1126c0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae662d1-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655294, "uuid": "2a75ec14-1544-48b8-aaf8-fbc242dabc21", "comment": "Malware payload (Dridex)", "value": "4444ed30f033840ea3d34be84f7a44ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655294, "uuid": "1a97d099-63ba-4cbc-8b09-3faf271bd239", "comment": "Malware payload (Dridex)", "value": "6dbd84fca8ccd9a68f543e83f7e29e683d571f966d12ca03dcaf7498362fa5aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655294, "uuid": "7ddaf46c-c774-4197-b9ae-e2cd9b5f8978", "comment": "Malware payload (Dridex)", "value": "2112e4bec0d838ad9f41cd8ab23ac6e9d26a33fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655294, "uuid": "0c6f5ebc-f9a3-4b3c-ad17-40aff9e42aa7", "comment": "Malware payload (Dridex)", "value": "4b062450c645ebe5bef57d81b78670d8f7aa3bf467621f7d46674092cb50518f619325801a82d65535447eb815909045", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655294, "uuid": "b9425060-ca90-4161-bd6e-e77bae272b2d", "value": "B8F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655294, "uuid": "4d62df63-ebcb-46db-8bc2-95fc8226559e", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655294, "uuid": "5522d3b7-64d3-4de3-8ba9-45d76e2f8dd4", "value": "3072:NWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:N42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655294, "uuid": "dadb992f-57e9-4010-b1a0-11813cabf5e9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655294, "uuid": "9ee66c5d-ffcd-4afe-9d72-7d814d619544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655294, "uuid": "cc4e6537-d49f-43b6-b5a6-143a0f2af6d9", "value": "4444ed30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e71f30b-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620630872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630872, "uuid": "a2881dd0-47cc-4a1a-bdc1-b3184b99dfb3", "comment": "Malware payload", "value": "7f588f23275319ad6a147b6d73846917", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630872, "uuid": "b36230cf-9cf5-489a-aa7e-96f415108e98", "comment": "Malware payload", "value": "6e2c9e01d28242ffa19e65d46f7347338a7a9456d10ae682a1114a641a41993a", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630872, "uuid": "77937e64-75d8-4aa4-be65-5c1fc8fe8b1d", "comment": "Malware payload", "value": "78e1bba5e763d2bd47247e2f0c03c2ffddc6eef0", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630872, "uuid": "80551e60-dbf3-42dc-aa86-8ffd857e1115", "comment": "Malware payload", "value": "0d80ba191c19168bded575dc676110406f2cb19bcda79085e2d6133acfac3c2883fb3ceb2296d70db0ce013c80a481f7", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630872, "uuid": "b6c65190-dd0c-40af-81f9-394e35c3e839", "value": "41950138F78B6D81F0B88B374D689B18DB5EDE04123AA33F5022F6959E762461B351CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630872, "uuid": "992406c3-cb45-4715-9b70-1d51db4c4538", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630872, "uuid": "47de928e-577f-4243-aca4-286e241cf07d", "value": "24576:V1XAPwbMvTm4Z3kSHPLJ6CBg5Yr3rEa8BL2ujLDva37ZDRPND2PqDUbfKCblJm90:5gvTm4Z38YXL8BL2A3Ed11kbjub4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630872, "uuid": "bcb8fcae-f77f-401a-93a8-db65b31869e6", "value": 1875421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630872, "uuid": "6645907a-7044-475e-bc9f-24cbf8343b75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630872, "uuid": "15d5438c-591e-4fb3-be69-1c3f614df662", "value": "QUOTATION FOR SPARE PART.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45df63d2-b14d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620623100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623100, "uuid": "62aba1e6-51c3-4d41-8b55-077eb2d038c8", "comment": "Malware payload (Dridex)", "value": "c72716fe1ccb39dc9dd73a0c5597d450", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623100, "uuid": "c6cf2f6f-c7f2-4eb2-9227-0d8ff86ce24e", "comment": "Malware payload (Dridex)", "value": "6e45e0c1225eae038973981e7dc4d1fdc68f62d59f100ddd906b30b08573459f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623100, "uuid": "e19f9f41-164e-4feb-a512-56de34263821", "comment": "Malware payload (Dridex)", "value": "24b6db2e7cc94f59b4eb0e3cfd07900b97898a88", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623100, "uuid": "91abed52-b048-42d9-81bf-e82aacb18f72", "comment": "Malware payload (Dridex)", "value": "0d79a6fa1b6d70f5ba5e83a7b4a58e36e88e1b84e57651ae8be0c528017067717329a03f5e23c5446a953c6e64a8e78b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623100, "uuid": "6a4eca15-1a29-43f3-90f5-287130c9697f", "value": "A8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623100, "uuid": "25fa9978-814d-42c0-b56e-778d3efac5b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623100, "uuid": "d533df64-6692-424b-8a02-59ff378f47de", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620623100, "uuid": "a508be04-a149-4a41-9b75-2fff6107fa42", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620623100, "uuid": "50f376df-ce87-4bfc-9def-a4bb903806e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623100, "uuid": "d6b512bb-f197-4f9f-8095-0760b93729e4", "value": "c72716fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d65c7e-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633831, "uuid": "6d3ab656-1109-4b85-937a-9da874f17fe3", "comment": "Malware payload (Dridex)", "value": "f27aede5d77630f107d16e20cd8f5292", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633831, "uuid": "ab58aeea-3a20-482b-a140-4137c4b682c4", "comment": "Malware payload (Dridex)", "value": "6e7c80629a1cfd23851468e8dd76942b5623a235d9fddb9bc1ee1de04a080751", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633831, "uuid": "3b2407eb-ebdd-4e13-aa48-acb2b73a3fb7", "comment": "Malware payload (Dridex)", "value": "d0b8bdc7888a5fab81809eb73307547617212e2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633831, "uuid": "fde6868b-6446-4c75-826c-36efbe052a7f", "comment": "Malware payload (Dridex)", "value": "d6166d6be1ec09a554ee7b52b556048bb05f915fe80ffea432a2ee551d0f60082c737084fbf427bae11b0e17e65d905d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633831, "uuid": "86238d16-e8f6-4b2f-b741-3a26406d1a58", "value": "03F3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633831, "uuid": "5dc26846-6437-431a-89ce-113be8dddcd5", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633831, "uuid": "f939459a-680f-4993-bc42-f96e9f6eeca7", "value": "3072:ABoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:0uXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633831, "uuid": "5047e257-c95b-47bd-aee6-69766eef4a66", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633831, "uuid": "f7321c67-fcae-45ad-aa3f-782b671eb9ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633831, "uuid": "c2dfdb91-d62e-4c69-a0f2-6d1f6703a9b2", "value": "f27aede5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dd2294-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620657801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657801, "uuid": "15965181-4ac5-4d39-a5dc-1782fb48b928", "comment": "Malware payload (Formbook)", "value": "370813b3c983de5d28427287c9831642", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657801, "uuid": "a7b9b490-9366-4911-a9d2-283e7d3ecdcd", "comment": "Malware payload (Formbook)", "value": "6ea0a9b8e93a62155f9d7e179c35dea54c6404d455d584976a7e3041668c53ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657801, "uuid": "dcb2b0ef-a3f1-46c5-8ab8-5ed65736bc1f", "comment": "Malware payload (Formbook)", "value": "5d68ef34ddcd0a1a2259d6f8ed95b80ce145e47a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657801, "uuid": "39b99d6f-e3b6-4ac4-b07c-7b4fdb7769d9", "comment": "Malware payload (Formbook)", "value": "4157de2da957b41a6a39f3834ff3a5d9dac1cade718e192e80efff0289d88fc4aea427db21fb9d672e7d294894c647a4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657801, "uuid": "8bf7f0c9-5266-486f-93a5-e1afdaddb4f5", "value": "6AB4239C2948415C5331BDAD214BFE55F44512CA03FE2A9ACABBF17FD32988E0A69913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657801, "uuid": "a0caa2d8-5cd2-4555-85cd-7af65c07e5fe", "value": "12288:9gr1thuJNWZBc05H+FV/B1qqZ5kmlRNuwsdBYVItSlqbBgV:cYzWZ+Uef/BZ55D6cItWoOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657801, "uuid": "360056cf-ea17-4cfa-afd2-004c7c1df26b", "value": 541672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657801, "uuid": "7ce25e62-f2dc-489b-88d2-70a3a1b28f88", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657801, "uuid": "b3649a22-5a4a-44fa-ac53-fce0dd803042", "value": "PO#6275473, Shipping.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f952c421-b1a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662486, "uuid": "905a8855-6cdf-4a34-806b-4b40c128983b", "comment": "Malware payload (Dridex)", "value": "0c1c9a1b6c973c046c374be8ec883093", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662486, "uuid": "7e034e91-9a4d-4179-8599-6287f750d628", "comment": "Malware payload (Dridex)", "value": "6ead5e71fcce3e8b56ac941bd8cb637340072cfa84ae7131eebdaf9d4e583acf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662486, "uuid": "c821fa71-b6cd-4a03-848e-d3000bb75a1a", "comment": "Malware payload (Dridex)", "value": "204021b0f259d9e9d7ccacd718e4049d1fe42891", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662486, "uuid": "a7230bd2-2162-435a-9faf-10ba7742f462", "comment": "Malware payload (Dridex)", "value": "fa31f84b8ce892ef7850b2c4aaa174589eeb53bbc0138f0ee7b772d4e62083160bce6599e4d35d6fceebc7193f196069", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662486, "uuid": "d1578ead-276b-407b-8978-168649b61bea", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662486, "uuid": "a992868e-dd42-43e9-8746-a1ce218d4917", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662486, "uuid": "89f45e22-9e04-47ab-9af7-0f18dd86ef25", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662486, "uuid": "25057b82-66cd-47b3-b842-baf337589871", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662486, "uuid": "ba9121f1-75a9-4df8-8202-9efd1c347e12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662486, "uuid": "738bbff7-4ca3-4e6b-9484-8f74851bdc82", "value": "0c1c9a1b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5cf53d-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620677015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677015, "uuid": "cee70099-c26b-4b57-bb46-867af24cbcb9", "comment": "Malware payload (Dridex)", "value": "7c24f5ea56782c2219e4fcfb6a250a7c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677015, "uuid": "a6052a0f-9335-4831-8ddf-31dfe4f48f4f", "comment": "Malware payload (Dridex)", "value": "6ef10b3064d5cac3e6c852533d9f9b8d1efb0cae9b32a7eec424eeb215fec69f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677015, "uuid": "6f7f68cf-d16b-4763-a0cb-72ac8bd9b2eb", "comment": "Malware payload (Dridex)", "value": "fecfa32fd0e1351b16222e05b90fd8434ae98659", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677015, "uuid": "afb970ad-1c64-4736-8a6d-3be2b15a6867", "comment": "Malware payload (Dridex)", "value": "a44d346f3337564ddbcba62cb688fa8ea260e6044129d73e03779c43152689b62c1eae3dbb7be4be8b7a2b9f903b2e9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677015, "uuid": "bd51b385-ef3f-459d-bf26-fa0a5fbb363b", "value": "A7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677015, "uuid": "204f5ad5-d21b-4e46-ba9a-2aa04a8547b9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677015, "uuid": "5ada79a9-2c8c-4d45-8852-4475d1ab61c9", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620677015, "uuid": "855e5978-1f27-410e-9a66-79aa7d47bf4b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620677015, "uuid": "0b8dcb7b-6e55-4521-a0d7-57f19eb6ec1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677015, "uuid": "4d2c7f2a-a48c-4288-b948-913fd73e2820", "value": "7c24f5ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc97b10-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620651299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651299, "uuid": "63b2db67-da9a-44d5-a1ee-61d667b43daf", "comment": "Malware payload (Formbook)", "value": "d4e1ec4ec4ca6e4807739df8d64f4943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651299, "uuid": "9ce81dd1-ff7d-4c89-ac2b-779bcb67af9c", "comment": "Malware payload (Formbook)", "value": "6f30586ae0f10f48d85d4c59c351756df1754de806b4aa52078bde8d792437ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651299, "uuid": "ceee778d-d1fb-4508-8329-7dbdfe1f24e9", "comment": "Malware payload (Formbook)", "value": "de5e4589ed7c9b727ae72abdcd80f8c3afa5e051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651299, "uuid": "1f429110-de61-4715-a293-a55ddb56c0f2", "comment": "Malware payload (Formbook)", "value": "43990c0d7dce0345e3f327fede74da92fdfd4c479e244f2dea73ee1f47094fcf2a110ab43b5a1bf258732a379e9536f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651299, "uuid": "d8107b35-aa30-4bfb-8cc2-a527f90e920f", "value": "8FD4D0FECEC48D02C69D4A7C7099411CE3F8923A65C7EB50DEDCA1B45E967B1CA124B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651299, "uuid": "8f116330-54d2-47a2-b969-cb8f5b78aef0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651299, "uuid": "cd608590-02fa-4a26-abe4-8f4f9ba1e612", "value": "12288:RhAom2XD7fnubg3SoKRUgkxubKAlpuoZbKvfpg81Z:c52X//5VP6zZbufh1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651299, "uuid": "0c8b7b16-541e-4e1c-80db-6b9d4f795378", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651299, "uuid": "fc567e94-b81a-471e-a141-86b6099bd564", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651299, "uuid": "ac28939c-d9e8-41e1-b918-9349f7734999", "value": "[RFQ] New Project Items 7519 Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea16d001-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680499, "uuid": "ee2b425a-530f-4f0a-89c0-a30bb1c5d9c8", "comment": "Malware payload (Dridex)", "value": "70ad44f47f3e208f98b0da1e4db77f27", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680499, "uuid": "6c09f5bc-f7f5-4479-86a8-6d357b5f9667", "comment": "Malware payload (Dridex)", "value": "6f920d2d06c687435d39fc1158ceb2399a5817ece913c3e7ca97479e0b6dbf2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680499, "uuid": "c83feb59-83b0-4d32-b9c4-e92dede834fa", "comment": "Malware payload (Dridex)", "value": "70f3634f1873bb36f764db8b3d3c6be15a534967", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680499, "uuid": "b904b41e-054e-4456-a052-c7d5182408b8", "comment": "Malware payload (Dridex)", "value": "814feb627f591aef11fbb345ecf1f23e27f6a3e9103a6c2a9df6c3bb094b5ed86b4ebbc34a65b719e489d970804aef5f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680499, "uuid": "0de96734-bd08-46bf-9a01-d9437a8ca4f2", "value": "ABF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680499, "uuid": "100f5227-3652-4470-b2e5-07409b67f3db", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680499, "uuid": "00d91ade-9f8d-4f36-905f-ce83dfe25fac", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680499, "uuid": "b50a7012-e785-4242-ae3c-02d41da486de", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680499, "uuid": "e1fe9d68-ae02-4d79-8819-9fd5e3c7a331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680499, "uuid": "675e8ec7-3c36-489f-80a2-a635827e4e3f", "value": "70ad44f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed71009d-b152-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620625529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625529, "uuid": "6f16b1d7-b4c2-4e77-95f6-13ca9e02c679", "comment": "Malware payload (BitRAT)", "value": "9be9591e2ae745498247017e47e39c96", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625529, "uuid": "bac89c83-bea5-4beb-b64b-e8c0c25bc2b8", "comment": "Malware payload (BitRAT)", "value": "6fa2dbb14d97035e18591f0de0e08f274f7ea45061be3816ddfbbefa8e04a695", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625529, "uuid": "be14e70e-baf0-4834-aab0-ceecd0626632", "comment": "Malware payload (BitRAT)", "value": "0fb0b3c73d32464f02a4a792a2d4951c805e3e1e", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625529, "uuid": "ab20c78c-5908-42d8-bf05-b621c8084c39", "comment": "Malware payload (BitRAT)", "value": "dce69913ba81b127914edc839b796a1e40d1fda2e7cbfa564e7b08eceac1aed8b4304630f42dd00d1e59733285ed1c3d", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625529, "uuid": "f15ba539-f6d8-43bc-9a06-64a62b12f36b", "value": "77F5222522B86F0DD9BE6BF711F1010013F6BC06972EE50CBEF7749A5A72B808965763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625529, "uuid": "ecaa3ab1-8f70-47cd-b43b-39ee727e58bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625529, "uuid": "68a6eb40-e8a9-4dba-9bad-ff740ec9fceb", "value": "98304:RQrg0UEqoAnMXiqDlNQEclNZRLGYxqb9pcQl/:QLEMyq3YjAY8ZpcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625529, "uuid": "63cafce6-8ccf-4c6d-8c84-c164fec3af2b", "value": 3479552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625529, "uuid": "9aff5455-f022-45c6-9347-7d11bc6a3f4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625529, "uuid": "290c27f5-9476-4581-8817-41355a6bd3bf", "value": "r20210420L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0eb4d5-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673546, "uuid": "e5ce80df-ab35-42cc-874f-52fd3a3efb2d", "comment": "Malware payload (Dridex)", "value": "6823a5529379203b6984716f32279cf4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673546, "uuid": "350d3d0a-c9e5-4622-823d-3856f75ad8c4", "comment": "Malware payload (Dridex)", "value": "6fb50ea578d0944b4d3c7a7000bc3e118137f385281662786c447e73346fea23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673546, "uuid": "f587549d-3db2-480c-b3b7-697495ba05f5", "comment": "Malware payload (Dridex)", "value": "f849176e573871a7062202c690c136cd5514cb6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673546, "uuid": "1b19164c-f337-4c6f-8890-61770a3d38b6", "comment": "Malware payload (Dridex)", "value": "67a27808f7132ce9f5a78ff4620b9800cc38123d9b9277250aa22aeadd8b6cd2c25cca91a9e10cb12e2d22a4fd274d4c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673546, "uuid": "e4295325-b6d7-42c1-9952-dfee384d3ea0", "value": "62F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673546, "uuid": "fce4d78b-b2a1-4e3c-974f-604e2474baa7", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673546, "uuid": "7e6a6325-7d61-48ce-8d85-5fe4aa0f0473", "value": "3072:Aesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:K4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673546, "uuid": "af760ae5-12cc-447c-83e5-5ccd05d1eda8", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673546, "uuid": "484de4e3-0c3c-4239-a8d5-42d9f6486f3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673546, "uuid": "a2b37f4c-3b10-4462-9bd3-724f4790ae67", "value": "6823a552_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe66d08-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620673341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673341, "uuid": "da625797-7fa0-4fae-82fb-f46c98318fd6", "comment": "Malware payload", "value": "111972e29a339879909e8aa6cd89da90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673341, "uuid": "628953f4-076f-4807-aa18-6c6785258c2e", "comment": "Malware payload", "value": "6fb9ed70b110771d404e6b704b9b3b00a5b6ba8f489b747894f13c71e112aa1e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673341, "uuid": "c09649c2-a635-44e7-87c8-b22b3c38d3a1", "comment": "Malware payload", "value": "3cdf46a6d5f061f533c79b351ab141693c21679b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673341, "uuid": "59009792-0c94-490e-b372-68d629b93bd2", "comment": "Malware payload", "value": "16ba494d797a4d20ea4e38a5b97107ce8bfa758b1d3877354a9637841d9901963fe6062fad89559c4a2594a1066d7fce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673341, "uuid": "3f8c5758-7940-45c6-bf14-34a6573fadc7", "value": "05E2F1FCD1FC418BF528BAF0B1A4DB5A913363DD8B860AB1344516B55EF8ECBA44811D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673341, "uuid": "32f8bc6d-bf88-43a0-8c6d-7659c0be6ce8", "value": "768:ZR09P/oXerAIw7I0TKl4jEV/Z5WaAXUamOtlp3If2CxtqGNCypwCv:z0BCerAIGFrAVZ4nXUamI3Ifttx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673341, "uuid": "5f42d5c2-8cf5-486f-82bd-5e6a0d7be065", "value": 33141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673341, "uuid": "a72299f4-e074-4a82-bfbc-19d09d8cabc5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673341, "uuid": "b75757ef-77d5-41ac-84a2-a474842ef977", "value": "111972e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f7a936-b15c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629779, "uuid": "780db2ce-38c2-4257-a386-16ec78e15221", "comment": "Malware payload (AgentTesla)", "value": "ddf6e324218003974bfd3d9928072f2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629779, "uuid": "19de99f0-8d0d-48f3-a68d-79189e7fef5a", "comment": "Malware payload (AgentTesla)", "value": "7010651eba38ffa85ea56ded29f124959b733b895388269ba2d25cf8f07284b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629779, "uuid": "dc72367f-b098-4177-b947-348837530c11", "comment": "Malware payload (AgentTesla)", "value": "dea9f222ff3894350d374ae85dbbe045fa4cf4d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629779, "uuid": "9fcbd7d0-1809-4b4f-83e3-f85d5918cbf5", "comment": "Malware payload (AgentTesla)", "value": "6e85a48d5c8583a734958862478f1b0866ac009498e0dc5cc0d4a91e7fff880dfb8739a839b1989da49e867f8958a3ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629779, "uuid": "128211c0-8eb3-487f-b3a6-f4638cd06ca2", "value": "D8F4E0203BD8AA58D5BF973619B0C55423F2BA17C322CB5E6E9D904E1E71782CB72713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629779, "uuid": "778f8dee-2065-4596-9a95-a8fa06b59db6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629779, "uuid": "478b6768-b778-4c88-b973-a183d4ab62c2", "value": "24576:VfpgiX+PGhhhCwZefB+ggBR6usnV34GQgNdBK:ZpgiX+fA6+g+NsV3TVNdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629779, "uuid": "bb2fb262-31a4-4c53-9d96-bddc4526bfa3", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629779, "uuid": "deb9295a-3ed0-426f-9870-abde55188bc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629779, "uuid": "99952de4-7e14-4d1f-b702-7529fd91b4ec", "value": "Invoice Ref # MY0499876 + BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e071e4f-b155-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620626630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626630, "uuid": "eaf84b5f-b741-4d0c-9d20-ba9b36829faf", "comment": "Malware payload (Dridex)", "value": "5428169bd9198d3c0eab57870c26e1c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626630, "uuid": "b787f509-d398-4894-87b9-a885f1760790", "comment": "Malware payload (Dridex)", "value": "704638a756aa6c409ea05e9dde35585e1197ff05a60debf4da9a371ea1c91679", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626630, "uuid": "28e9fc47-b46f-4750-b121-68962aff3db0", "comment": "Malware payload (Dridex)", "value": "a7f44e9e4e3054537af89a09ca9ee231ee3c8362", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626630, "uuid": "7a973461-00fe-47e7-abee-4529af94c7ab", "comment": "Malware payload (Dridex)", "value": "1ecc3177917745d6c95f67a67d31938f09334c2aa3a4fb797945580005a6765ead1d1fba7151b68b26db8ab153b64bd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626630, "uuid": "06f32cea-4e6b-457c-b39f-4c9875e48a58", "value": "E3F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626630, "uuid": "31f1ecc1-dd34-4e8a-a7ac-2735d5b90dcd", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626630, "uuid": "cf25c997-a776-4afd-8dab-a3d7b31a5b66", "value": "3072:MWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:M42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620626630, "uuid": "85189c60-9d46-4fd0-b939-91517c38e073", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620626630, "uuid": "b199de42-c86d-404c-a3b1-c3a7c0b9f303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626630, "uuid": "e2af6c98-2485-459f-b63b-8f77128b8d34", "value": "5428169b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4d2790-b1b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620668852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668852, "uuid": "e9f9177e-989d-48f7-b472-dbecfaf32beb", "comment": "Malware payload (AgentTesla)", "value": "66212e2db8f6b58ca93f9c26584274d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668852, "uuid": "1b90cca7-a5b4-4693-8f38-4d26ab64633a", "comment": "Malware payload (AgentTesla)", "value": "7071588d0af3cc4308eaa26692ec980ac46f3c7a7a5553362f641b2ead8ce20e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668852, "uuid": "d9b59e0f-449c-431e-9d85-4c7a6299b6cd", "comment": "Malware payload (AgentTesla)", "value": "c626f06cceb0778840d31e1c35ab2dc6aae9b625", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668852, "uuid": "cab6635b-7b01-499f-9ac5-dd97dd8c11a3", "comment": "Malware payload (AgentTesla)", "value": "e71beffaa89411c7eb25ebfec8eb304db67831d7841def8fd60e807519fac314b49495461d51c24c44e0367258e27215", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668852, "uuid": "c0f5dc0c-d736-4b57-a75e-567f8308dadb", "value": "FC05D0253BD4BE14E5BF0B378CB08590A3BAFE03CB63C66D68D5714E5A72B849621317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668852, "uuid": "50c6cb58-9bfd-4381-871c-7eb8a91f81d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668852, "uuid": "6e35b07f-36f2-480f-94b3-0e71d0a9c9b3", "value": "12288:3dMI/0Sr52pfBVw9hhhbalx3gFJULtM5ARgN4i70xZTD5/zssRkIMIXTf6XrM:as0m2X2hhhba7gHkO/J29oFIT6XrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620668852, "uuid": "b21d0c36-0fef-44b8-85bc-476cd9aa8a7a", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620668852, "uuid": "3643d2f6-63e4-4355-80a9-6236b6ffde80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668852, "uuid": "6bc41581-506b-4b3e-8dbe-e64080efb041", "value": "Payment_advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7700f78-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680494, "uuid": "7101d3c6-aeed-4668-8dd2-800794241de7", "comment": "Malware payload (Dridex)", "value": "34e57a220bfc5e8be352e5f71d902feb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680494, "uuid": "7fc10fc7-62e5-496e-b105-8a030bb77888", "comment": "Malware payload (Dridex)", "value": "71569e550b7dfa1c34136cc21e400d79a4098e9c2a713493d3b37f49f4440712", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680494, "uuid": "0ce6dbbf-3ab8-481f-b390-e6c1870d2cc7", "comment": "Malware payload (Dridex)", "value": "57d7d5bc201672c11db027faa55d314c8ae5df4d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680494, "uuid": "38eec1e0-13c3-4b77-a1b6-536b3ace3aa0", "comment": "Malware payload (Dridex)", "value": "2bd38dbf5f2d989c14caaa026b113add85c8cfe4e43c1d80f88142fbdbbc2ab83caab4ed329d0f22f78395b33706e199", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680494, "uuid": "85905a35-0136-4d9c-812c-f8a9270bfed8", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680494, "uuid": "c10b49a6-5100-474e-8ad1-f9252cbd14ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680494, "uuid": "044d5b77-c136-4e0b-9dc1-8f484beb63c3", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680494, "uuid": "37f0bae8-074e-4f6f-ba81-5c951607196c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680494, "uuid": "f187518a-44e7-4cbb-83eb-4d9c072c8908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680494, "uuid": "c272a9dc-ab92-442e-a002-135597153db2", "value": "34e57a22_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2b500d-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644537, "uuid": "a00e89dd-5e1e-49d9-bd86-f969304d777a", "comment": "Malware payload (Dridex)", "value": "8d746a5f191f1a12fd539e72b17b9a65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644537, "uuid": "53396a53-6b9f-4075-8a5a-30bd3819bb7c", "comment": "Malware payload (Dridex)", "value": "7197e5d28a4287d57cfd66a559cb55e4c333d92e483343c7b87daa62e1d3e0e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644537, "uuid": "58c1b41b-5dc0-4d01-8404-67dd0c9da813", "comment": "Malware payload (Dridex)", "value": "8ed35fc0afb23de28de7122501266372dac70169", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644537, "uuid": "f8c87037-c5b2-4cdf-83bb-1a22f2b963a4", "comment": "Malware payload (Dridex)", "value": "c8d45df0ef5949060804f3bec96a06b088070113f9661474403e02e3e5cb5a745fa00691475a0a0af263b0bba0b375c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644537, "uuid": "b35c44eb-18e4-4af5-a630-6f3281ea49ca", "value": "19F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86DA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644537, "uuid": "def6cea0-0db4-4aaf-9682-0a9ec7c228eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644537, "uuid": "83d54883-41a9-4322-b870-7c2b1e75a6f6", "value": "3072:3IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644537, "uuid": "1290b889-df88-48e3-ba5e-0f89c0396c6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644537, "uuid": "9a586de3-4369-4a32-af87-521864eb2a6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644537, "uuid": "dab119fb-7585-4dd5-99f1-7177fc30d486", "value": "8d746a5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c808ce-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620673247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673247, "uuid": "fe90089f-9a9a-4a35-b3a2-2b36b9d3d85d", "comment": "Malware payload (RedLineStealer)", "value": "7dba85a4920b25645867b6cb50dcccd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673247, "uuid": "01146cbb-53cd-4ebf-9fa9-f9d47e1c88c8", "comment": "Malware payload (RedLineStealer)", "value": "71f02c2c42215c3cdc78cf61bd5f26eaf50c532d74e284c0d850a525cf8d6fa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673247, "uuid": "3a88fab7-9121-49ac-b0aa-b3e3bf608501", "comment": "Malware payload (RedLineStealer)", "value": "640784e9a780182bedb1229f495ffa18588ff590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673247, "uuid": "2f60d43e-4059-4007-bff8-e92820f62e24", "comment": "Malware payload (RedLineStealer)", "value": "6ba8cba151de6f3548134edfd94d2c99f26b8eb5132c0b3126e1f22e3502ab2a10ba748f8860ed5d4881fe787d47fccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673247, "uuid": "74ba70ff-2274-4898-8ae6-b1fdbe9ec66b", "value": "FF861B0967DFE168DEA3BCF047CD7A8B879FC7F260BC344119840A905F6ABD1985271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673247, "uuid": "bca16e6a-81d1-4488-a097-72e956757280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673247, "uuid": "e82e7cc6-e063-4f3b-9a2f-51cbd6e0466b", "value": "1536:2KyU3XR3ebrcXYumrifYYtF1Cr3+4IZe+0WjjLLjCs2zAIox:2W0AIox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673247, "uuid": "a86fd628-c665-4bdf-a434-c7463ffe15f9", "value": 7903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673247, "uuid": "3a73294e-d382-407b-bd0e-e798a453fcd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673247, "uuid": "6269c745-20eb-4fc3-b281-1e7dc652d3f6", "value": "7dba85a4920b25645867b6cb50dcccd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed50f176-b162-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620632401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632401, "uuid": "f0800018-c11c-4562-9575-654907a2123b", "comment": "Malware payload (Formbook)", "value": "f6e56a72afa365ae2b4018648e048940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632401, "uuid": "150c2885-f203-4d95-856c-f665037ef90f", "comment": "Malware payload (Formbook)", "value": "726a3798f80c7e482b512dc777bc692965136190990a5fed138934a546944121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632401, "uuid": "4ebfd2e0-5f1f-48e4-9193-3f771954d735", "comment": "Malware payload (Formbook)", "value": "9e9a454762c2ecfc6326efadd83128bf3b49aca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632401, "uuid": "2869cd97-6eb8-4f09-9d33-70b38c2c3e84", "comment": "Malware payload (Formbook)", "value": "7b630c131383757681454dd3980e1098b53983a82ec05d6e6e72366735c8d756df7a93b51081bd7338488b7f5a0f3c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632401, "uuid": "c2b85beb-1aa5-4e0b-aead-fca48900776e", "value": "0034121E4290C5B3C8231B311C796F2EBFEFC3052084595B5BA46FA978836D6272F765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632401, "uuid": "2d95c3d7-8964-4377-917e-81df99dd6ac5", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632401, "uuid": "b99e087e-4615-45fd-8098-62a290a0984a", "value": "6144:L9X0GgpHIYgtoJiW3giRorQaB7yUL4+NlqygtG3:l0VpHIYSoJiW3giiUaBPZa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632401, "uuid": "8c951695-529c-42fc-aa72-0a41ad83fca7", "value": 231933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632401, "uuid": "eff94df5-c317-4939-98c2-f436103e1aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632401, "uuid": "870c7223-4e5a-4824-b5eb-2ad39f3c90d4", "value": "f6e56a72afa365ae2b4018648e048940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dfcba1-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620677004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677004, "uuid": "a3781d73-4175-4c7a-be2e-e4db284ea9e4", "comment": "Malware payload (Dridex)", "value": "7daa94963be299aa4130a0bb3a11c2d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677004, "uuid": "70fcd45e-7ea0-45f2-bd8f-cf6da146c02b", "comment": "Malware payload (Dridex)", "value": "7293bbfb877743ccb040339c0d70087d41950465750c1f6b8273d567108e3524", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677004, "uuid": "550f5e1d-0ad2-4172-bf96-dbf13e217256", "comment": "Malware payload (Dridex)", "value": "160c929b76f73cfbe249c5a0dc3e49ce861b406b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677004, "uuid": "8fbc3ae6-77d5-4901-b8e3-fa5fe7bbde13", "comment": "Malware payload (Dridex)", "value": "5b679e90353bdcd7bd958d38accb59763eaa0f28265e1675f303118dc56c43d7a9876c94f1760c784b8aa35eecdde464", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677004, "uuid": "077c44fe-92e1-4396-a930-0b0003180aa0", "value": "28F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677004, "uuid": "e31debe4-1108-4ac8-a802-25d44a436ebe", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677004, "uuid": "15634539-a080-4ad9-a6c2-73334dfdfef4", "value": "3072:wuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:w0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620677004, "uuid": "384d552a-e46d-4e5f-a089-3d7cca0e0013", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620677004, "uuid": "e4d764c9-5538-41b6-a005-607e2c3c43eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677004, "uuid": "a4fa2077-8055-4712-a9eb-078174d53bbb", "value": "7daa9496_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0908f6d-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658954, "uuid": "40ae2787-17ef-4e7e-acd5-dce2e83b0301", "comment": "Malware payload (Dridex)", "value": "a8d3caaecfcb9800cfaafdd4aa5866c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658954, "uuid": "e4d136ad-49f9-407d-9ed2-76b98bcaa2b3", "comment": "Malware payload (Dridex)", "value": "72d2562b2bfc51bf41c80113b0e8e2a2093c790a08a9368e0ba3464dedbea297", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658954, "uuid": "b0000405-f909-49e8-9018-5d1f737b68f5", "comment": "Malware payload (Dridex)", "value": "86032b250e9ceb3934589a52d61ac04969dda114", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658954, "uuid": "1807f5c9-5894-4119-b344-76c06cdffa60", "comment": "Malware payload (Dridex)", "value": "8c86dfe42f2050ebc714e7d5119b3aa0e1b0ee6d428e4bba76c9671ed73eb3cfc8580f19ac12bd7d0ae3e11103590b40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658954, "uuid": "8740fdec-deed-482d-be79-e6a99a12c579", "value": "7DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658954, "uuid": "6d84ff38-baae-45a5-8178-82ab4dcf2294", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658954, "uuid": "f8f6b687-93b7-489c-a1de-d7253289da67", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658954, "uuid": "d8e0c489-d48e-4a42-b1a5-6bd4cb976ea0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658954, "uuid": "9c1a2f5d-9526-40d2-9aa2-84f8a89107a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658954, "uuid": "8208bd9a-a212-45e7-aa3e-31e844c3e5ac", "value": "a8d3caae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6e589f-b14d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620623056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623056, "uuid": "95aeb20d-8b94-4041-829e-e625057f9c6b", "comment": "Malware payload (Dridex)", "value": "b32f23f13b5247d72c8bf1e147600b70", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623056, "uuid": "115f16c1-2089-49e5-8ed1-e8021f041f4a", "comment": "Malware payload (Dridex)", "value": "72e468e45040321fd83440fd33fc14b4bcb21cbb88d90677a46128436c98cbe5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623056, "uuid": "0bf5abd5-1c26-41d3-b604-356113fbcc58", "comment": "Malware payload (Dridex)", "value": "8061b8c5a21ac1b87062b969888b493f404fc3c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623056, "uuid": "90931d59-7cab-42fa-972c-32a7ef66db3f", "comment": "Malware payload (Dridex)", "value": "7092661b3f04362ef4de3bade77ef9467a4bc8e2ac6efd6f89e0b27cab5ebf973df08160c0f4e5f0120a0111662aed22", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623056, "uuid": "eb35a48c-5eca-4056-9579-709e76519e1c", "value": "27F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623056, "uuid": "f103472b-5574-4003-8c60-84dbf1db490d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623056, "uuid": "3c40b1a9-8595-4d21-b15f-7cc401e7ec91", "value": "3072:HWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:H42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620623056, "uuid": "d3dae44b-113b-4ddb-99c0-a0f50102a128", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620623056, "uuid": "58df4cb1-ac3e-4577-bac8-13a41716d9b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623056, "uuid": "10105fe7-4299-483e-8ecb-8f4cead7adbc", "value": "b32f23f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91857fc-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650781, "uuid": "98fdcd52-ae1e-4bf1-9c31-4a566b04c596", "comment": "Malware payload (AgentTesla)", "value": "ec15858291554fbf483714230c25a394", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650781, "uuid": "3dc908ef-14f8-4c52-8a73-352673af4c4c", "comment": "Malware payload (AgentTesla)", "value": "73109a8da6ec06221d707955dce0ea93f17273ea582673f5d4cbd63ad20820fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650781, "uuid": "c116cb9c-bfb6-4de4-8002-451ae68a9423", "comment": "Malware payload (AgentTesla)", "value": "29ba7654e06cbf13b29a3e8cd500b3b57ac13b8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650781, "uuid": "964ad782-23f0-491b-a41f-2858dcc9410a", "comment": "Malware payload (AgentTesla)", "value": "78e72f77fd2df370c0256d5938e8b10819e13457d67d3598237eac093486c98584e04725bfe2386c16daebabc7b95f78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650781, "uuid": "8d4b678a-89cf-4542-8aba-52a243fdcffe", "value": "A1D4CE2C7AE88904E6BE56BC8571C13043F9AD065903FB6D0EE16CEF3D77B21CA4195A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650781, "uuid": "d8ff9061-bd00-4b36-ac34-a3c48863e764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650781, "uuid": "a7364847-e716-44b3-9809-a86dd8fffde4", "value": "12288:OAf6aEUtuGq+PhJPX6YU0si1HbkBEWIswwdXCTz5:Ntjq+ZJiCmEWIswwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650781, "uuid": "7c141a67-88c3-47bc-bc3f-27704ce2c08c", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650781, "uuid": "496412ec-9ab1-4ea6-b14f-9b764a9803cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650781, "uuid": "44cb32f1-f647-470d-a717-8e98767b7a11", "value": "AD1-2001028L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6960b386-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648071, "uuid": "bd8e39a7-4393-441d-8ea5-e678cd079f3a", "comment": "Malware payload (Dridex)", "value": "bb7b547131e0937c3c4d9c9d62079d3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648071, "uuid": "c0526ff6-d448-4ff4-ac27-b08d4ad3e73a", "comment": "Malware payload (Dridex)", "value": "73882a4ad89348657744c9ec7e2b41ed013e38bd1700573aa8aade87e6ac7897", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648071, "uuid": "a2bfdeea-e93b-4e35-b4fa-05534213d34c", "comment": "Malware payload (Dridex)", "value": "89557dc7be10b1a9287b669782a9aa9907f9fffa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648071, "uuid": "0639a173-bf7f-40d5-ae26-25741a8ad00d", "comment": "Malware payload (Dridex)", "value": "ec6a32f3d684c1d16aa17c5bcd18458b8cdc298911605cecf9ed37250b5c47a8e1171cc7509d8bf4aed81f8d424c3545", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648071, "uuid": "3221b5e4-d528-4889-8e24-5a11e6130bc3", "value": "22F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648071, "uuid": "30035756-fca3-4742-826b-0e88e367c3d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648071, "uuid": "bf311576-4eb1-40b0-b9b9-04728fbc2084", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648071, "uuid": "443bc157-1226-418b-98d1-ce2b1a829746", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648071, "uuid": "b1be3206-9bc4-477f-a478-7ff97a0ff5d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648071, "uuid": "a0a5429c-cff5-4f63-b709-9b1335b0435c", "value": "bb7b5471_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48eb286b-b134-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620612368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612368, "uuid": "e6125b81-225a-42df-be3f-474a85713fb2", "comment": "Malware payload (Dridex)", "value": "0e3060fd8bcffb1b82dc9147a69e4d4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612368, "uuid": "3b497b8d-cc2b-4b23-84e5-6b1423f359c3", "comment": "Malware payload (Dridex)", "value": "73ccf6abcd3da6aaca8c3eea49ae49fe845a8fd0e82262ee1a7e6c0f1f51afd3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612368, "uuid": "78a3d182-5ffa-481a-91a5-6a9cf90f5a76", "comment": "Malware payload (Dridex)", "value": "026fbdda6988cd1e98ac6bd79077c245b92aa898", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612368, "uuid": "9d54a310-7f05-4ddd-8a94-40541ae14e4c", "comment": "Malware payload (Dridex)", "value": "de0edfad982a6b748c0fe87cf3a1e79e8b4b721e6482281db38858f995bf4f0661baaa0e3d9daf7581a269563d438bf5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612368, "uuid": "637f7d04-7b9a-4faf-aae4-012ccde5bd53", "value": "C5F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612368, "uuid": "bda277ae-63c3-4ce5-b6e7-1f899e8efee3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612368, "uuid": "e2621c59-c132-4b1f-90fb-6b8a67ed79c7", "value": "3072:+WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:+42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620612368, "uuid": "16d673b8-3da4-4aa3-bd41-4a1590c8284e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620612368, "uuid": "a3fd98c6-fdbf-4fd6-9bcb-f41bf3d24a27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612368, "uuid": "3430ea51-2d4d-491e-9435-5b593de576e6", "value": "0e3060fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbdb8bb-b15c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629636, "uuid": "fe61dc88-a065-4abb-ba22-15941bd2d345", "comment": "Malware payload (AgentTesla)", "value": "2e990f2354d53d427f48c361d21621f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629636, "uuid": "38ef8afd-6ee9-4575-b650-9062ca9a6987", "comment": "Malware payload (AgentTesla)", "value": "73e4f32ad74da67b03c63b115f0937dbd8f63ba010bead2afcb92e9a15b17df6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629636, "uuid": "a348b76f-0f13-4ef4-a6bf-266cd8377f67", "comment": "Malware payload (AgentTesla)", "value": "1526ebb5922e138bdb6f9e0f8818f75a55e1be24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629636, "uuid": "3b91ed1d-fcbd-478d-b708-1663d3fcb571", "comment": "Malware payload (AgentTesla)", "value": "1799c611a5d871a8b9975b005f308a45d9feaaac747d9fe3be5905ea0cd86c72f1f6c87994ae8ecdaf4a57e9ec042735", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629636, "uuid": "2cd9a460-0d2e-410f-b716-012e51fd1beb", "value": "39256DD1B2908C99E96F07F16D36952021F3BE5DD574C10C6A9DB71A2AB334260AFF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629636, "uuid": "86dc7aca-34a9-46a8-88b1-b18b740d4e4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629636, "uuid": "167e0a3d-5d0d-41e7-b82a-b608e764fe34", "value": "12288:X5wLVWmhFX7tBVw1hhhJh4NcIy8KxPXmOjuJyAlb8/zOX5CX:XmzFX7PGhhhJh4aITKxPXmOaK/6XsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629636, "uuid": "149fad2c-55c4-49be-9918-75f4fb50af3d", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629636, "uuid": "92760a96-49da-45a2-bda3-6f7f6d36e0d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629636, "uuid": "917e44e2-58be-42e6-b4a6-a3286f81f928", "value": "Informasi penting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cffb964-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676880, "uuid": "fb3d3fae-6648-4a71-95fd-c702cb310d8a", "comment": "Malware payload (Dridex)", "value": "48e51674a2ae667c3e5781031764a514", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676880, "uuid": "25a6d76d-9e7f-44d8-a330-ee513af686e6", "comment": "Malware payload (Dridex)", "value": "74266b0b6d9250468318aec5fc54a1ae0b34869379dac13f841a4f6cfab86305", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676880, "uuid": "89ce10d4-f68b-4260-ab83-b8034aa87874", "comment": "Malware payload (Dridex)", "value": "b228b1821a4565d5c48f113b06a70598513e66f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676880, "uuid": "69f47a3a-1112-436e-b693-1da278fbf57d", "comment": "Malware payload (Dridex)", "value": "d2ed76e3ade3c9d85e1c6b76b6c279a3695c50188efccbecbf67ea8914e49d051c5ada4d2dfa7d3a562f9fc1fbeba565", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676880, "uuid": "240d673d-ccbb-41d6-a27b-f9f66d6d6428", "value": "7AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676880, "uuid": "6dba3369-c8e9-4071-be6e-b3dd7b7e8989", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676880, "uuid": "dba6b3c8-a1c9-4e88-aeff-9b0b95f55269", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676880, "uuid": "4ae26ae0-f7f1-4568-9ce5-a4be7fb4121b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676880, "uuid": "833b8085-ea50-4c83-9957-150466f5304f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676880, "uuid": "70a4fdc4-e746-445f-a5aa-859810d85928", "value": "48e51674_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a794ecf5-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666214, "uuid": "5372f56e-5cfc-482e-83e5-a84f40d6e004", "comment": "Malware payload (Dridex)", "value": "79b88bdb34395bf6acf426f4d33bb094", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666214, "uuid": "4c0bfc66-4ecc-41af-bd17-21956e09d44e", "comment": "Malware payload (Dridex)", "value": "74565319a53efde2cff3d4cf7c97acf9df370fa1c3c14a08ea6865a65473c319", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666214, "uuid": "91b7e1d4-d8fc-4dad-975f-5d01033877cb", "comment": "Malware payload (Dridex)", "value": "90b20f8b13103bba4cb436c79107169820f4d7e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666214, "uuid": "b83a9d50-ac37-428d-bfad-72dacbabd9d9", "comment": "Malware payload (Dridex)", "value": "a6e381cfd13ef4e219f143cc97ec9fcd4a548596ef90ca9493621355233730b1aa4772c91dfb7c7aa430bcf60fb25266", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666214, "uuid": "36695305-f65a-4719-90cf-fe250ff55356", "value": "F2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666214, "uuid": "721724a2-4201-4820-bbd4-b9d5b996dd4f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666214, "uuid": "21dfcc0d-21bc-463e-852d-808a92e31401", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666214, "uuid": "512585ef-bf73-4046-8e66-be851fa16a36", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666214, "uuid": "187ca25c-0e29-4341-bdf7-40b98588415e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666214, "uuid": "f3ff7356-845b-49fc-a392-187d7edd9a48", "value": "79b88bdb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1fb363-b123-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1620605020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605020, "uuid": "b92afb0b-3db5-4dcd-b3c3-4d44f6f5b401", "comment": "Malware payload (Smoke Loader)", "value": "bb4a4b0930b9bc7c918d844ff59d42f5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605020, "uuid": "bd3c6884-c69d-4958-99d6-197e1bcd1f23", "comment": "Malware payload (Smoke Loader)", "value": "74688108a783cd87a22cf87d31c7be5c7a8a80937089a1bb2cc19c204236186d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605020, "uuid": "3b1f1702-d38c-4578-944b-b1a9cac25f00", "comment": "Malware payload (Smoke Loader)", "value": "92ab938f2773e93a71a8b1f00edbd6ee3a781fb0", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620605020, "uuid": "076926eb-ebce-4b3b-a074-1e9e97389146", "comment": "Malware payload (Smoke Loader)", "value": "c8e5f0c1cc26ab9ceb70be6b434baf1c97a51d188d31a389851a36ae9e34528d66c78999be21bba6c1b8ff3a04560a2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605020, "uuid": "0480a69a-6cc8-4227-afd7-b0219b97fefe", "value": "C5C312692745C2FFAD9D4E9EE3CBCD07A8204584C4BAF03B64D65607C6293E8F4616AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605020, "uuid": "fae709ff-195f-48ca-8035-9233d29e61da", "value": "3072:JVWy0yLCY+fUQ49ekWnNzuhXmiL9NAPx5vK8v:JiXYSUQrnNzuhXzLAPxBK8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620605020, "uuid": "52e8d17d-d1e4-441c-9b05-296904687895", "value": 122194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620605020, "uuid": "1237433b-9918-49ec-91e7-db1639ee1453", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620605020, "uuid": "5ef6e242-e910-4bb9-9b2b-c5e41e82f1be", "value": "bb4a4b09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f788cb3b-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669784, "uuid": "40795aaf-1695-4972-b7d0-28c9a089e99f", "comment": "Malware payload (Dridex)", "value": "47bc68a836974ac91d173006f5c4bcb8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669784, "uuid": "3cef659e-903e-4d5a-b040-85e0988d7b3d", "comment": "Malware payload (Dridex)", "value": "747d97f797092a4320b696a5a616f77143268a38940c866086f9649559dbf577", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669784, "uuid": "d9bfb1e8-0c2f-4122-b078-a3b0dddf4673", "comment": "Malware payload (Dridex)", "value": "eb2fbc19f5117213860c1183810a440e6b51cec0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669784, "uuid": "855e00d0-d433-4899-b1c8-1e0bdbdc4e31", "comment": "Malware payload (Dridex)", "value": "642794f5f74ef72efacb3f38c009e14a6c1a3d0818672d83533d1dae3bea54058a95b53afc075657d451e9f5ec2235d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669784, "uuid": "85d6fa1c-0f64-44bd-90c7-1ca8d536d864", "value": "A3F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669784, "uuid": "e2dfee81-35ef-42d8-98fb-e02dcc2e6803", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669784, "uuid": "f2a441e6-0d14-4d09-acc7-4574aaba88ff", "value": "3072:f/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL0D:1brE1kvcB74DXZ2MelVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669784, "uuid": "311f3ece-362c-42b3-98ec-d92d284b2f3f", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669784, "uuid": "fb832f55-f356-4487-95f2-0e075bdef01b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669784, "uuid": "6fcecb46-de95-4fd5-9901-1b81683358e9", "value": "47bc68a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc873f3-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680477, "uuid": "dcfc071b-6343-4e66-b8d8-94d620b6e680", "comment": "Malware payload (Dridex)", "value": "2d64c697ab68aec3102a5630183804d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680477, "uuid": "a53e73d9-1520-4103-a18e-adef73febbbe", "comment": "Malware payload (Dridex)", "value": "74d2b476737991696c7b7d3c6ef6df1fcb48582d13b417b19cdd706c3ba162c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680477, "uuid": "44e9da95-afaa-45b4-8ea3-dbaf80ea5358", "comment": "Malware payload (Dridex)", "value": "5e45aa8697b1c773034252d3f699ef3d8c00301d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680477, "uuid": "fc33f640-cea4-4b7d-9d99-888c5c3507a2", "comment": "Malware payload (Dridex)", "value": "5d2378803e5a30726ebd5cbd79b7763e22c6eab3b66d91b5c952fe779ec1c976d7eb8b9c7072c69ded976ff762449174", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680477, "uuid": "2d7bf9ef-ba9a-4477-9c71-e2071197bccd", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680477, "uuid": "81d6cba2-f4ba-408f-9277-d2ea23f08b77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680477, "uuid": "a95b06c2-97fb-4a99-8862-10eee5527777", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680477, "uuid": "b080fc04-0c7e-4378-b9d8-0b57702c6e89", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680477, "uuid": "899a7b50-b87c-4dbf-be76-d935e70237c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680477, "uuid": "429b00be-d989-47bc-a0df-5d9877a12225", "value": "2d64c697_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9c2443-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620670138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670138, "uuid": "00f4d52a-e233-45c9-9408-f9895edc9531", "comment": "Malware payload (Formbook)", "value": "77f1784fa00332d5623aba88277eb8c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670138, "uuid": "bff4fbf0-bb19-4458-8a31-e15b865a94b8", "comment": "Malware payload (Formbook)", "value": "7515beb02e1280d143b4716f8919e34fadfc7c806e5a354dc3dcd1dd3318882c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670138, "uuid": "342bccf4-77a3-4808-8e99-c115e0a1b0b6", "comment": "Malware payload (Formbook)", "value": "248f8ad49c0d3ef5ddbfaa5a8721aa4dc08acdf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670138, "uuid": "5e69708b-3a93-4282-b529-c8c63e7a7568", "comment": "Malware payload (Formbook)", "value": "9ec5f54fbeb0122e709b66af69681b77e77914645679c37008d5b69c31351db780d2741efe0570328cb636eea624bdca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670138, "uuid": "78af661a-0278-4d4a-8667-521d75449222", "value": "76B4230A7BC8D325C1F25C76A8E1CD723B727F84D456EE9E389F324947B67444AA4C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670138, "uuid": "099738b5-020b-4080-8e7b-dbb5362d61bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670138, "uuid": "9d8477fe-bf5f-4c75-b819-29507f17511b", "value": "12288:YHFMw7Y9MA59CyMAn0YGGtqQsny/QEsYiAA:YH+w09tVbwyNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620670138, "uuid": "147e77f7-202e-4952-9388-3f9dbaa948ea", "value": 515896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620670138, "uuid": "2cf9ee26-cba0-43b6-9f0b-22547e4eccc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670138, "uuid": "2181376f-c445-4c64-aaab-1c85e5a59c5d", "value": "PL_106104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921db75e-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687653, "uuid": "d4b4b77e-88e4-4c5f-8bf8-37f21020097b", "comment": "Malware payload (Dridex)", "value": "6ad51a574b45068f259a2fd4c8fc0f45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687653, "uuid": "01bd917c-bf20-44a4-a5b8-ef544cf0aa5f", "comment": "Malware payload (Dridex)", "value": "75747bee804105e5add873a5dd2d8784ec217c28ef7b978e04c4df83c453b008", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687653, "uuid": "80024b95-4fe6-4a89-b588-eee883033f69", "comment": "Malware payload (Dridex)", "value": "bca85ac16d5350e8d3d2bffa1e9631df8e2c285a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687653, "uuid": "db3828b1-703c-454b-9dd0-11ad9f3436b7", "comment": "Malware payload (Dridex)", "value": "2c83c3e52df802d8d7689d41fec01002f98744c51709479c77678bd4e1db531862c107a15254f36dc42c3a2665a97390", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687653, "uuid": "b98b8b45-8ffc-480d-9c59-6763fc9cbdae", "value": "81F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687653, "uuid": "fcb46b1a-5474-4bb3-8b74-1be8063e8a9d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687653, "uuid": "a6f368ae-765a-41ea-80bc-9eb19a471a23", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687653, "uuid": "de75f363-125e-43e1-91b2-abf137165bc5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687653, "uuid": "2f694717-a0b8-482a-b39e-556b3ddf888f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687653, "uuid": "a0d09d21-5be6-4144-982d-e7108de7bda2", "value": "6ad51a57_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08936208-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630728, "uuid": "b5bdda2e-6724-4156-bf11-241ce0ca4897", "comment": "Malware payload (AgentTesla)", "value": "cacf99de31a8fc9f3086ba2144add059", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630728, "uuid": "6d7f098f-d82e-4389-8c8d-acf9e9f223db", "comment": "Malware payload (AgentTesla)", "value": "76214b75099fe440b9639a0daa17ce9b49d1cf4193c5f3e429dac8aa1c555c60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630728, "uuid": "d99ef35b-c77d-4617-88bd-aa33ff158123", "comment": "Malware payload (AgentTesla)", "value": "bb8a252f8c3677f1e16f7f80287081bbc5680f83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630728, "uuid": "43dbd79f-28b4-4c75-9653-15e3f7f5f875", "comment": "Malware payload (AgentTesla)", "value": "8ab95a70de68f4478e42490614bded1d98646755b3fdb2a339508458534eac68ed9d3918f93477e20f5c4514e4f87b78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630728, "uuid": "51d78025-b6af-4820-b27a-bba42d0e613d", "value": "96F4DE3933C8AF05E93EA7351470541043F2B917D722E95E7DE268DA1EB2F428663F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630728, "uuid": "18e3edfb-097b-4ebd-acf8-fb7afb229aa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630728, "uuid": "c2707947-03dc-471a-9bb4-57e93b56bca1", "value": "12288:+0r6XMibSMyE+3CytQMYcn5lY7E/48JQP/vVE9M:+EibSMyEuBn5lMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630728, "uuid": "3e55ca42-6877-4c23-bc50-9224323b9d5f", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630728, "uuid": "6b66bb06-a931-4401-b2d2-029abc223f3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630728, "uuid": "9807ef67-7650-4d7d-8d77-a743127a1b14", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6c71d1-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655402, "uuid": "863e9340-78c3-4614-b611-55fd572e607a", "comment": "Malware payload (Dridex)", "value": "b375d7cfa782233848df3021027e4821", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655402, "uuid": "a5ca999f-9f6e-4040-8f92-2e291aa77c16", "comment": "Malware payload (Dridex)", "value": "76361c25e08f4a78aec8f80e3e61fc9cc96cacce075d9458eb1dd471c66a97dc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655402, "uuid": "30a4d973-8fb8-414c-b3ca-f1ed5c902f31", "comment": "Malware payload (Dridex)", "value": "83e12964fce1702fcd8ecfda47ec10be8df50ecb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655402, "uuid": "c8270cd3-d32e-41b5-bcbf-63c7ac3edee2", "comment": "Malware payload (Dridex)", "value": "d3b2807b26bb880b6f2c94a0f05900b01cb7cc2f079bcbcb83f20bf22165fe1fd6927383c25e209177308b80f6e38012", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655402, "uuid": "9e3430ea-ca96-4914-80e9-56f6309291d7", "value": "E8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655402, "uuid": "eac7724b-0475-421a-ae83-3796600f9f1d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655402, "uuid": "fa23fe52-35f4-4535-8441-4ecafc0e0752", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655402, "uuid": "5ae99705-17d8-4e26-805d-5970c8a8100f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655402, "uuid": "9f29dced-d5df-466a-82ea-bb0b0c6bc4ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655402, "uuid": "884f11b4-f775-42e1-9339-688f7a2de6a4", "value": "b375d7cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ff5f52-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628275, "uuid": "7aeeb3f0-d90e-45c5-afff-787970c1d335", "comment": "Malware payload (AgentTesla)", "value": "d1723e59f71f8612bb73cce9b4131092", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628275, "uuid": "8c5ba8b7-fd90-404e-be54-488724a0ec5b", "comment": "Malware payload (AgentTesla)", "value": "7658258f344a91180b23dfa875ba9cc29add936d94977edaffe26306fb5d76f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628275, "uuid": "cd0250c9-c16f-4495-bc15-cb55f959b9ab", "comment": "Malware payload (AgentTesla)", "value": "a76e38cd4210504aae2bfc52fe9468903a8c0256", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628275, "uuid": "00afa20d-0bc4-43a7-8ab8-5498fc023ace", "comment": "Malware payload (AgentTesla)", "value": "6396a94df170bf4160d176098fc1bdc18c5581756bd028a2b1cc3c293c2e3e3ead7327ea7f4f304aabc3aef489c31133", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628275, "uuid": "f4709436-42a9-47df-a315-4d8682c49af4", "value": "8DF4DF203BE8AA18E1BF4BB11D70D69057F2BA27C722C71E6DE9508E1972785C673713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628275, "uuid": "15ef4671-8091-47b6-80dc-c5d93b21f809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628275, "uuid": "e084efc4-41f9-4fd1-9120-50e5875784d6", "value": "12288:TgCqdcjXrrBVw5hhhv6JPS4r71UgkVANxQg+z4CjQ6PtvH87:TkSjXrV6hhhaF7qgkVANepEK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628275, "uuid": "374d45d2-86d6-4058-bc4b-5a06be9ae175", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628275, "uuid": "c9a8b25e-76d3-425d-977d-c894814e257a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628275, "uuid": "b0bfa6e1-2ac0-4e22-a55c-37342798b6be", "value": "lBKwquZfBhdeO7D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb2c755-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620630767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630767, "uuid": "2c9148b6-d099-4bd1-9b08-5aa789141fc7", "comment": "Malware payload", "value": "33b09e1bdda03eb29178a444ad0f9000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630767, "uuid": "6e131bf6-c651-487f-99ca-8f4a536f14da", "comment": "Malware payload", "value": "76fe551abdf8ee9d70991dc8de3a7dab5d1cb5605072f1d54f8b4ae4a6e03100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630767, "uuid": "e88e6ee3-21ae-4d4f-9586-e3ce82e4069f", "comment": "Malware payload", "value": "e33a61429057828346a7740a24a451b82e6e0ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630767, "uuid": "5573627b-c22f-4945-968d-32e5f84f949a", "comment": "Malware payload", "value": "10a130dfa5ff6cc02fa33a7f7f573354227ed801a494b3d5d8a8e7ae0b7ecd8db0c8f18fb2cb46ccf630cb2938f0d52c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630767, "uuid": "8193110f-69b7-420a-96d0-0b92508b0fbd", "value": "E1D51E726A1BE9B9E7C01F526EC6F3F7361B777B2972D1B1914000495B0CA308AA47F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630767, "uuid": "a1917b40-ce90-4513-91a0-b7db2f2bb27e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630767, "uuid": "02ce42dc-36f6-4769-8854-3fa8dd5aa643", "value": "1536:gLKjZT0Zf9eeEdmekGCeL6Vl5DtVUtDStsX3r+qCK61DxKWiogWrcmU4lBf13FzT:uEtfqVLWc6Eblm9BFsYAyR+m+rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630767, "uuid": "24971727-2b12-4bd5-9579-c6c8a1db50ce", "value": 2887168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630767, "uuid": "136a885e-d997-4628-89bb-cb53e8a3c849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630767, "uuid": "3e872dbc-152c-4f9b-9c24-7fc894ba1b24", "value": "Factura Serfinanza_0362253780_739465113_092731162602630055_4566297_875208292956210813_4655431199_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253bf7d4-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669861, "uuid": "742b41c3-3c45-47c2-ac86-ce7d8a37010b", "comment": "Malware payload (Dridex)", "value": "545b380ec3a862ee52ff76fcb3356aac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669861, "uuid": "b743538a-1839-4329-aa55-34901dd71036", "comment": "Malware payload (Dridex)", "value": "77373bb931a535adebdd77275cd16256d6fab7d0db88c81b80b3d2a492437b0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669861, "uuid": "97a6a5a0-6001-420a-b951-d5ab4b934f4a", "comment": "Malware payload (Dridex)", "value": "883616ccf00d11cd9113ce92d707a45e11fcdbb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669861, "uuid": "7519b654-8b92-4a81-83e2-d08590ac2cf3", "comment": "Malware payload (Dridex)", "value": "36d432557a1009efcb502a7c730ee713e9cbc19b2c15ea5e9db19e1f84aec45df64d7234a72222ee73d9e41d3ade1236", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669861, "uuid": "a847adf6-de97-4d26-a10d-e2d88295ef12", "value": "C5F3D10FD58ADEC3E7F21C3284EAB1AF7D9894294D34E2D77960E51EA2A3D6601344C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669861, "uuid": "ed219c94-71a2-4b1a-a589-84e0cf18a954", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669861, "uuid": "7748b4d3-e4b5-418c-8d6c-8aabbb5afefb", "value": "3072:7/FbrEzD9N+Ruc9/74DXE+JgaV7IPx+e6O/pPtaLss:JbrE1k4cB74DXZ2MelZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669861, "uuid": "0e444fed-4394-475c-a372-9416b80c7180", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669861, "uuid": "67d47525-b19a-4ab6-8fe9-006dfc923510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669861, "uuid": "9ae2ec51-82a8-42eb-a022-1def7da5ba3b", "value": "545b380e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616bbe84-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630877, "uuid": "1e46ca91-7c89-4d1d-8125-fc3c152b115e", "comment": "Malware payload (AgentTesla)", "value": "b34c428b0266ec0b4f3541bdb4a64e14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630877, "uuid": "4048598b-f2b0-4605-b177-3d82914954f4", "comment": "Malware payload (AgentTesla)", "value": "7745cfb5dad2fb66719dee21d97d1eabe67eeacf17b4684af8fe67aa5ed0bb96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630877, "uuid": "a0124be6-6fd2-4009-b1af-65359412c380", "comment": "Malware payload (AgentTesla)", "value": "2a9fb77bbedf8129925a7b42668ed9186acc4066", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630877, "uuid": "621a9214-eb7f-4a59-991d-d13f750da8a9", "comment": "Malware payload (AgentTesla)", "value": "68a1a1ba383fcc0535752361688370fe1124df164c78f85bcf38b2a9eb3b5f4853afa8ac35033059ae2b4d15835683ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630877, "uuid": "fb0437a4-ff8a-40b0-93e4-ad8b6dc449e5", "value": "F3F4CF2433886F61E83EA7391575000057F2BE07D731E99E7DE6A4DE4A72B818627F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630877, "uuid": "a1e0a55e-56f0-4219-839f-7aae0d5fc519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630877, "uuid": "fabbe44f-5ab9-4aa2-a3d5-c894e163e7e4", "value": "12288:cO7kOapBoTEjmjZIgZ3LUAKtMhZacWCPHWvM:c67QEEj5A3tKt8ZzHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630877, "uuid": "5ff50cc7-1683-4f34-815f-433930e5aff8", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630877, "uuid": "d0ebc8cb-e1d5-4704-82d4-6ef0059e719f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630877, "uuid": "1a324e09-bba7-431b-87ac-8afc8acfd23a", "value": "2021_May_Quotation_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384e5078-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669893, "uuid": "4dce494a-c555-41f0-95e8-639d7db2b4c5", "comment": "Malware payload (Dridex)", "value": "e6de695125d02ac9475da4baecf6b4fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669893, "uuid": "d131d0c6-5db0-4a2f-a63c-733e7b09ee27", "comment": "Malware payload (Dridex)", "value": "775df3056bb617cf80097947ceca2fa9bd2b76b5844bb75832fe9aac936eda94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669893, "uuid": "a79571e9-9886-4ef8-9865-6c4a9f9ef6c7", "comment": "Malware payload (Dridex)", "value": "ad488ceb220786761f15a46ff9065b0f4519412b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669893, "uuid": "5a411fe8-a0e2-4403-9b71-b67cb885260e", "comment": "Malware payload (Dridex)", "value": "982567a6f86eca8ac195c61aadcbcc36fc92ac56f7414d3a6260045758795a7f0ce7d91b0d5c13a10dc5b1db5dfd1514", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669893, "uuid": "da9e7c83-01d6-42ad-8833-53819d7ceba1", "value": "6BF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669893, "uuid": "05af54a3-1f1d-4e8b-be73-c93f944d368b", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669893, "uuid": "f6c2aea3-a390-4fff-8db8-1bd51222e6c9", "value": "3072:z/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL0D:BbrE1kvcB74DXZ2MelVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669893, "uuid": "b622ea97-fa38-4ef1-a546-2fc562a9f031", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669893, "uuid": "c10ad47e-5ae8-4d6f-af44-80e9ad115722", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669893, "uuid": "049b9285-66f5-4588-a627-7736fd56677c", "value": "e6de6951_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09facc85-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620630731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630731, "uuid": "d36e92cd-0256-459a-b0b0-f556d0d8669e", "comment": "Malware payload (Formbook)", "value": "33d849675e66bf8332b4bb2e4a1d923f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630731, "uuid": "094e68c4-4c86-469b-8634-a4a83f9297ea", "comment": "Malware payload (Formbook)", "value": "77a065555ec0a5c4dfbae72cdb035af45edf7997b1859fa75a158c40f119a020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630731, "uuid": "5f678523-edf1-4fe5-a452-35c8b1c5e2d7", "comment": "Malware payload (Formbook)", "value": "5a6a124d73391b021ffb15b5fe0bef53882e9d9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630731, "uuid": "b35dbd7c-ed0a-4adb-bace-837babd2abf1", "comment": "Malware payload (Formbook)", "value": "8c61a0c10f65bf10d50d9e689da0fcd7f60c9e58e8df6e271887335e78a219eb82996dcd2060add6d1c839bb446e9c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630731, "uuid": "06fa3e4d-75b9-4fca-8e70-a46f30557f2c", "value": "4E050750B1439ADDC83D76F4D39CDC7852E1ECE24E20E668EEA932694739F4E01ED621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630731, "uuid": "0a7c42f8-af4f-4fdd-b844-f1cec87e993d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630731, "uuid": "5498ee15-eefc-4229-9ff0-68e4bd5afb57", "value": "12288:Z70hHwq6oGbWgW4nVV2aiGnCqlAkS6cGfRxyFkpHbsM:h0hQDoG66nVOjab7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630731, "uuid": "82f14931-693a-4216-9fa9-3478038b31ba", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630731, "uuid": "06541fb4-18ee-478a-9a37-c551ade63629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630731, "uuid": "e4980270-3a2c-4d96-aecb-be1ff81ff3ad", "value": "T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6709ac-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669176, "uuid": "7cf5f599-c77f-447f-89d8-b626c7f5e003", "comment": "Malware payload (Dridex)", "value": "3b54f72d74244505b0b0687f3074fd31", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669176, "uuid": "1cf2b814-6805-48a8-8e6d-f3bff9f0da3e", "comment": "Malware payload (Dridex)", "value": "77f6654ecab29bb4c0e3c5d1711aaec8f73fe02929d6c1c6417b0de3f457addb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669176, "uuid": "788167be-8def-46c0-99f2-ae5779f8a414", "comment": "Malware payload (Dridex)", "value": "81dfc409a3f7f18528c9750ad9c6cc40ed8848a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669176, "uuid": "d9fc849a-4872-4c88-956d-781e1b839442", "comment": "Malware payload (Dridex)", "value": "d4540afc0d2c4ac415d2cb01e7736802eca21e48168a1692f3609572ececf30d51470b86688abe95ac0a3d62ef288f06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669176, "uuid": "465957af-7616-49d9-bf66-ca2093c897ec", "value": "D04423FEA530E0D5F3A04939001D85C7B90FA768C0A5F55A5D31B4AB0D4B2EE85E1FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669176, "uuid": "a0dc877a-d939-472a-9adc-48dcf70a0f9d", "value": "6144:WKYkcvIYnbJtMvnMVjw1eQ3B0CfVaJxpmDkBDa1/:WKTcvpFtsMqRrRYha1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669176, "uuid": "3be340be-4740-4456-a99b-9c11cc8dc11f", "value": 269378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669176, "uuid": "f063ab70-de0d-4118-8e02-43b3e084b572", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669176, "uuid": "988fbf99-9484-4391-8427-bfd54e7129a7", "value": "scan of invoice 91510.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28ede66-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620677023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677023, "uuid": "7410e569-de6c-45b9-9f07-6e5a6fb001b9", "comment": "Malware payload (Dridex)", "value": "bef8500af0408199030a13470f2fbd9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677023, "uuid": "8016b7f0-2c38-4cbf-97a3-fe9523e03392", "comment": "Malware payload (Dridex)", "value": "7816aae0e5cad49f5bd125ea288f846f4e3f41d3f868cbeb32431b4672b93f92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677023, "uuid": "fd30a2fe-0ac6-4bfd-927e-8944ee8b666a", "comment": "Malware payload (Dridex)", "value": "d8648bb12a1f9425ab41b108a0edd665b5a8f0d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677023, "uuid": "6f03e389-3579-4eaa-b60d-26d9e8e98e46", "comment": "Malware payload (Dridex)", "value": "c79b958dc1ea57e57038405b60158b756ef88304456ec042ed90a0e2872762aee82182d4864d1011c5f050c973f96ff0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677023, "uuid": "69a62225-3498-4438-befa-3aff5297d457", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677023, "uuid": "29e9d2fb-5fdd-4e44-ad4d-5a64d0b08758", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677023, "uuid": "949d92f2-dc3d-4410-ab0f-ec8af20f1ddf", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620677023, "uuid": "50c1d74b-357b-45b8-8fb3-f2b4d0841ff1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620677023, "uuid": "df5be967-be29-4364-b7c1-9cc008ef188f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677023, "uuid": "02c103ed-298f-4a8f-b867-73478bd88b4e", "value": "bef8500a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0a0c3b-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633850, "uuid": "9feb4a45-ccbb-42f3-9b96-26c12f70b71d", "comment": "Malware payload (Dridex)", "value": "8b5490bbdade25dbc098daafd578db53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633850, "uuid": "37f74d78-bd39-45b8-96c3-f458399a7dde", "comment": "Malware payload (Dridex)", "value": "782df8636a3ea835375094a1ab522efb001e99a08f5a32c17aa579a10ccb595f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633850, "uuid": "fdefe738-ceb1-4959-ba66-61878a12dc11", "comment": "Malware payload (Dridex)", "value": "d3d039050dd752542ab2bc36d5dc4f65da3102ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633850, "uuid": "2063c4ae-2c3a-4e5f-9436-463ea575b34f", "comment": "Malware payload (Dridex)", "value": "6dc035a85bcd87395005671a715e982ce810ef57e1c44f9ae84baad53235a6d35b62ef73bcf80eaf0d32b11130d8b481", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633850, "uuid": "b96c5b3f-d50e-4487-b3fc-7ca155e2ff73", "value": "D2F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633850, "uuid": "381a9e34-fc5e-4807-ab29-6b9ff80a12c6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633850, "uuid": "3706a12c-bf06-483b-855c-b9922791e165", "value": "3072:sIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633850, "uuid": "cda04f0a-c453-4ee8-b037-bd9095b6d324", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633850, "uuid": "7273f699-adc4-4eef-913a-c63e411c2053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633850, "uuid": "15dea7f8-13a6-48c8-a502-394f4d162714", "value": "8b5490bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72f6475-b15d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620630270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630270, "uuid": "eeee39be-d079-469c-866b-d9088af5e31d", "comment": "Malware payload (RemcosRAT)", "value": "a05bd7a4ae1f8568a05fd6ac66f58a2c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630270, "uuid": "dd1792d3-9058-49a8-af55-59b8facd4d50", "comment": "Malware payload (RemcosRAT)", "value": "783db8cd55c6d6189727115d09cda8b0e884fcfba6fd508e55c195c9c9f6e778", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630270, "uuid": "f0e8b30f-5e11-4280-84f8-66e8f40cc3d0", "comment": "Malware payload (RemcosRAT)", "value": "d81aaa3d16654fa8e91a64f348ded845f82c8db8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630270, "uuid": "2b8dc002-3109-4dfe-9eda-e962f277faf4", "comment": "Malware payload (RemcosRAT)", "value": "13c26a8e7ec7eaace014271f7c35e4602039394daa18b113ac06f3d1135e3234bdeadf3653e08b0d1a3051a33f066193", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630270, "uuid": "a14f0eb4-b738-487a-ad70-5e9111d1fb3a", "value": "35E42306EDE20F72BE6C0599E460FBB48244C6F980BEE5678A40EC9D327D7B6741F641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630270, "uuid": "d8e0e29d-5a42-4c6e-ad3a-14738b840336", "value": "12288:272evWI2imKQYPQK4pddFYcgUXzg3co11xtgFPfQLaFkA9D1n9v:CeGQlbdTgwIcCxgQ+Ff999v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630270, "uuid": "7fb16d50-f339-4fff-b50a-bf2032fcfb94", "value": 707469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630270, "uuid": "f482cd38-0ab5-4de7-ae27-423d78e4daeb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630270, "uuid": "46a0bae3-b59c-4270-95ab-5836102ee775", "value": "a05bd7a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f288c27b-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649160, "uuid": "226f125c-2236-422a-85e2-db8f2fa44115", "comment": "Malware payload (AgentTesla)", "value": "19d600d492727ffc4f4757d15ace8f47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649160, "uuid": "a0cc2fb3-732f-42c9-8e3e-0934f8f76f3d", "comment": "Malware payload (AgentTesla)", "value": "7896351788339988b9b403860c4161eda752a7e9f2f14a22667fb2a3026bedf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649160, "uuid": "1d84a0c5-3842-4048-98fa-78eed30516ad", "comment": "Malware payload (AgentTesla)", "value": "ac696b08ef524bb04aaac461e78b793f3818b04e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649160, "uuid": "46d35022-e32b-4d75-a00b-5d83a377acf4", "comment": "Malware payload (AgentTesla)", "value": "7f61df3f02683e208e9a3cf58a3d6981b8f6e9e655d6746b59a30cd57392f2fe006256b730761750b23c86ba3b352cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649160, "uuid": "f699012c-f904-46f1-b167-6d1dcf4647b9", "value": "8C057CE2A521DC14CB87B334B1C8C94ADF613D4C8629AB9D6C677C8637AA9141DF3378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649160, "uuid": "d89a8fe7-23c6-4186-b0c2-3a84f71ba176", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649160, "uuid": "046e4fc9-d1a0-45d2-8915-4911f7505b76", "value": "12288:51HFMw7Y9MA59CyMAn0pC90yUDq7x9eir5/NYb1:51H+w09tVz0yr7xt/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649160, "uuid": "9e78d01a-22c5-471b-949a-24a28c7ce8ae", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649160, "uuid": "9baf2fb2-abb1-405e-b242-e8d3f667e302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649160, "uuid": "0fb47d74-a04e-4099-8a8a-835faac70441", "value": "548947459838854.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a54856c-b12c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620608934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608934, "uuid": "b78a99bd-a19b-4959-af5c-cde6e34daaa1", "comment": "Malware payload (Formbook)", "value": "1eee31b469afc0350b13b3f5749e7df9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608934, "uuid": "92f45b34-0386-4c5b-8361-54947d77c619", "comment": "Malware payload (Formbook)", "value": "78b11874a66b80ec78962b27c352a643d1a11c7f5cf9273f0db06df3f4f7e76c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608934, "uuid": "ab1a268a-780b-42ca-aa88-148d54fe6a0e", "comment": "Malware payload (Formbook)", "value": "2469eefb13b89912c0f557390f9c5d56999bd9aa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608934, "uuid": "7f4799c1-1537-47b2-b699-e1eaf163cf5f", "comment": "Malware payload (Formbook)", "value": "9ed614777856f127cb8da22c232a7d0f15a38efee3f726598001d0c1b675d02006d4ed6e365b6397a146f9b96a9c3fac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608934, "uuid": "e4698b19-f9db-468d-847d-04385e5a9917", "value": "8454E04B731CD7AEEB9D8BB2397A02318748DFA722546C16BBC4FD2D153224D2A1B1D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608934, "uuid": "2efb7e9f-9e5c-447f-975b-a21f607a4654", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608934, "uuid": "5ae3bd4b-3e8f-46c6-bb78-b43a0acffd91", "value": "6144:29X0G67xyUYXRlBMmiHSIeUT6ghkYcl0394:40FxoTKH1O6lcO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608934, "uuid": "5bb1eaf0-32d1-4a11-9005-6888401eca82", "value": 284630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608934, "uuid": "3b19e3cc-5f5d-40a9-915b-0ef2190d0d14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608934, "uuid": "d4caf1d3-fc49-469f-9572-4c8420da441b", "value": "SecuriteInfo.com.Gen.Variant.Androm.29.10561.9603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ac3342-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637351, "uuid": "fe961dcf-e3f1-4633-a61f-22aa650f0590", "comment": "Malware payload (Dridex)", "value": "3a3f873afd0f69b804d3e9a19524cf4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637351, "uuid": "fedaa7d0-d2ea-436f-9fa8-ac757a6de230", "comment": "Malware payload (Dridex)", "value": "78e9ee4c8ee4a20058993ec85a4d8b1178d3cbcc7fe4cc3a7c2097f8f67cf623", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637351, "uuid": "d7718095-e72e-4203-83fe-1f784cfee789", "comment": "Malware payload (Dridex)", "value": "f2875356b428ff197165b9c7f8d811e83861bbcb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637351, "uuid": "a6af7e78-d94c-44dc-8db0-bd8e59f11db6", "comment": "Malware payload (Dridex)", "value": "19742dd6c2ec3ae63e1090dd77e37bf2d3e4f5f5dfd5004fcd6095aa3f2e3595fb37fac242451d6d8aecdeac83e8f290", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637351, "uuid": "34a8ad1d-24f7-46cc-9685-b32400f6e347", "value": "B8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637351, "uuid": "aadf855b-2d69-47a3-bb74-9d18fc7f94ee", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637351, "uuid": "a306ddf7-d3b0-48bb-b0e0-365d7dd6c962", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637351, "uuid": "497136a8-7059-44b5-9e6a-342df60882b3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637351, "uuid": "4fac9d04-391f-4f52-b4b3-d4ba40e10f6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637351, "uuid": "2514f5e6-06ae-4669-a2a5-697b9a1f8f16", "value": "3a3f873a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65deb832-b162-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620632173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632173, "uuid": "46b6af44-cfb1-452c-844f-56cd12e76df4", "comment": "Malware payload", "value": "bf286f85a3b7893bead31dbe09feec4d", "object_relation": "md5", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632173, "uuid": "69c8bcf3-62bb-4a73-aebc-8822f733412a", "comment": "Malware payload", "value": "791a45eee838e037f6101691af2417eee3b5cccb96e9e9ab25ffce679471a6d9", "object_relation": "sha256", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632173, "uuid": "8a534a6f-5f7c-4882-9110-78c247065e62", "comment": "Malware payload", "value": "2c174a0a7dd939c186d99e6930176937e5c004e0", "object_relation": "sha1", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632173, "uuid": "8db3665a-5468-42e8-b132-9082d386183f", "comment": "Malware payload", "value": "2c3ff729cf81827951901bc33b4c2fdafbdc30f4f64fec33b0ffb3aef59ba8504f897ae43d146bcd70d5bc1da683e7ab", "object_relation": "sha3-384", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632173, "uuid": "f40e5f46-8ff3-415b-a329-a06af40ecb89", "value": "E0833621AB6A5BD4DCCA7D770215CAB193324FC0474377E7FE6C7A0D2B68981882616F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632173, "uuid": "4c1c012f-0776-49b6-8ecc-03deb1c69884", "value": "1536:dk8M+fF1bTDkNnhipFnY5IE2vYjsRtX4D:dH3DMInY54vYjsRtX4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632173, "uuid": "64fbe313-2c0c-41ee-b3cc-dc525fe0ad41", "value": 81107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632173, "uuid": "9f62c1f4-e021-457b-812c-4b1ad2cfffbd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632173, "uuid": "53b677d0-25ee-4d89-b237-f374f47b7240", "value": "instruct 05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828aafd5-b1b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620667440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667440, "uuid": "da432df9-1005-4ddc-96ea-b1e6700d2bbd", "comment": "Malware payload (Gozi)", "value": "ca15492d0c96792b22e031811fc60237", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667440, "uuid": "e471f88c-b7a6-4ae7-8c84-e9d45478f8aa", "comment": "Malware payload (Gozi)", "value": "79278524b0b5613050c83e87aeddc0c987d8ad67fec06af310b8722b97a52171", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667440, "uuid": "892b4316-23a3-4836-9e35-52621fc46d3e", "comment": "Malware payload (Gozi)", "value": "c25a707cb43e81bd1b72fd67abb0c5465c28cfc0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667440, "uuid": "daaef1be-3e03-46a2-8bce-9498ac8fea7a", "comment": "Malware payload (Gozi)", "value": "e75bbe3673e1faee5b9fba535150bcc4b6f0bb9d12a11465f3878f71f283dec8b13b888ad3e8ddb741ae3be3b67dd8b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667440, "uuid": "19fca6b4-5bb4-43bd-ac38-0523201b4641", "value": "0515C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667440, "uuid": "442466d9-215b-470a-84ca-b4c19e89c487", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667440, "uuid": "27f57d6a-0cee-4c9c-aaab-15ad2d7b2cf4", "value": "24576:HQfpzjXPgfe8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgqJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667440, "uuid": "f7e9acb1-91c9-4c6c-abfd-3bff8faafa61", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667440, "uuid": "7fb1089d-69bc-40aa-98e6-0f6bbf839e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667440, "uuid": "43aa4c42-03d5-4080-9d35-c8d7edc39479", "value": "ca15492d0c96792b22e031811fc60237.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e17c73c-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673499, "uuid": "f4bd4195-e29c-4664-89dd-0e60af99bed9", "comment": "Malware payload (Dridex)", "value": "d16ebfab753194893105a9a4686d8b0a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673499, "uuid": "71fc95fc-1778-487f-ab19-b4657cd4ba87", "comment": "Malware payload (Dridex)", "value": "79290e74f7ea9e2f1cd5c59059d2321abbdd44cb5cfe1b991da462b85ca10c56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673499, "uuid": "b7cc58bc-0c49-42b1-b448-4536b5666c76", "comment": "Malware payload (Dridex)", "value": "b862ba2ae902219c6f348a728e650870d7c6810c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673499, "uuid": "73889ad7-540d-4f5a-b307-9ea792f05ace", "comment": "Malware payload (Dridex)", "value": "7ca22a3591cd9b93f87f6f126dcc8ca061ba0254f923a611acafd6666ddd7d36ce5117e3a74579a14a541783006ae13a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673499, "uuid": "e723b992-69f9-4a65-adef-d10f746ce84a", "value": "3CF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673499, "uuid": "0e720db1-1886-4f6f-bd52-dcecd2f1bf03", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673499, "uuid": "957dc5da-e2c2-402b-9510-267dd8273a1e", "value": "3072:Zesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:F4+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673499, "uuid": "6addb897-6e18-4c16-9de4-2ad0d5f4e009", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673499, "uuid": "be0db092-ed36-4e6e-b944-5c730cd6e8fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673499, "uuid": "1f769eb8-6001-4955-8128-4651ae507acb", "value": "d16ebfab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92868cd6-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648140, "uuid": "895aa3a7-34d7-4011-b2a0-e9817d9edb50", "comment": "Malware payload (Dridex)", "value": "0a3fbcc45fb581d3e7d9fe11153d65b1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648140, "uuid": "153e977b-7fe7-4ca2-aa4c-d3de9fc2b6a1", "comment": "Malware payload (Dridex)", "value": "793b23f4a53c7874be87cc1fd82174c7f3826025bd0d78d75fcea6f05a36e742", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648140, "uuid": "5693cc4e-1369-4105-aa18-e31cc33fdcb0", "comment": "Malware payload (Dridex)", "value": "8494a6a93e1e80be15b059313e34edb9917c48d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648140, "uuid": "b93cac57-9515-4b7c-8508-348cd2f60c0b", "comment": "Malware payload (Dridex)", "value": "fbb5a7007474992d4e1a0bc785c2e3e7b96c2af75ab24a0b32a440ed96b11dee69e8c6fb35fb6c50ae7234a61d3ad791", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648140, "uuid": "a674df02-794f-414c-922f-2e5d068b9603", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648140, "uuid": "6569371b-f14e-43b5-bef2-a4ae43b88a24", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648140, "uuid": "f1820446-b222-4c77-bef9-35ea20f70dbc", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648140, "uuid": "7b757c72-1850-4f16-9c0a-ff038b5e9bae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648140, "uuid": "bcc030f1-ef65-4a8d-ad2b-c2b659de8e14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648140, "uuid": "4e58e8cf-2996-4fcf-8ea2-77815d43423d", "value": "0a3fbcc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3a6942-b131-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620611275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620611275, "uuid": "d51f65fb-65f6-4081-884f-24b380eb013c", "comment": "Malware payload (SnakeKeylogger)", "value": "2b2be062bfd494717434723ea3664d75", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620611275, "uuid": "79f4f5ad-1e9c-467a-b040-8495d8a1634d", "comment": "Malware payload (SnakeKeylogger)", "value": "7a11431e141079aabfbc23a56ab312d3094828c2eb0b1033bb17692054f70208", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620611275, "uuid": "6c8db669-f0be-4584-8039-46b620709d93", "comment": "Malware payload (SnakeKeylogger)", "value": "084d841a6a8c2e29e983c59cbda2317fffd34ce0", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620611275, "uuid": "8de0d935-6263-4467-ba6a-4702f08bad06", "comment": "Malware payload (SnakeKeylogger)", "value": "5fc0fe9711ac0405ce0f79526d03b6fd5fdb9bf0aeeb7a300c1baef9d246b28949bd3d8eae238834f97c8824b2c06bc4", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620611275, "uuid": "4db7bcf6-66d9-48c2-b027-2a68130594b6", "value": "21E56C1859FCDE68CA8BFEE21F78FC17893A776AD436D02DA9A44C464345E05329433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620611275, "uuid": "a6b804c8-3f67-4b41-b09e-34368d3402b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620611275, "uuid": "b1a63ecc-5514-42ba-8de5-6fa66fabc685", "value": "3072:vGluM+VS6L9wtITa7djs8WisWbsqokNarsbR/t/MeUB/MXSP3ktkclMPhxDMYn7+:vGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620611275, "uuid": "217a1e6d-cb0e-4ac2-bac3-9d1a6aace966", "value": 3210240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620611275, "uuid": "427c0934-e48d-41f0-ae49-a57dd75070cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620611275, "uuid": "26cba73f-ee71-410d-bbd4-4f4cf05bb5d4", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.32673.17259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c7f61f-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633843, "uuid": "fbfd43f8-3638-42d3-bd56-3137d5edc1b0", "comment": "Malware payload (Dridex)", "value": "4b67fbf32e99b58c9c27b091e53ce76d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633843, "uuid": "0c1aadd1-eeb1-4f5b-aee2-3175c5ddb298", "comment": "Malware payload (Dridex)", "value": "7aa6386a58423b2e31d28929a9dc0b4082b8a9e8aaf6406c6c74d4bdc8c9b3b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633843, "uuid": "b68fde59-01c7-4dac-b463-de9acc9d0663", "comment": "Malware payload (Dridex)", "value": "58a95f65f2cd8369211f32dc70b69a24089c0b79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633843, "uuid": "8b2e886d-54f3-40a5-a176-7d929aa8dd47", "comment": "Malware payload (Dridex)", "value": "30cf87b726ca8f600c8a4e1bba143a9bb35b985c8905317a5a9a40f0a6b976039e49f1bfe31f9d3656f52f7a1b287d87", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633843, "uuid": "b115c6cd-60cd-48e5-813d-6e39251e757a", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633843, "uuid": "f91d100c-3fb2-4617-a99e-6d8ce65fbc9e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633843, "uuid": "e0780f6c-9b51-46c2-b1e8-61dbb0fc1567", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633843, "uuid": "1959e08d-6ce1-419e-8a0f-97e74ea8d06d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633843, "uuid": "5d7e4586-5180-41db-a678-f4f2c48a25c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633843, "uuid": "ac294616-ab86-4d2c-b5d0-07e6f5384e0d", "value": "4b67fbf3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfead13-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666275, "uuid": "06b880a2-081d-47d9-ad20-824db23e9a63", "comment": "Malware payload (Dridex)", "value": "e22cf3c8bfcb0249cfaad906dae248af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666275, "uuid": "36915606-255f-4556-9293-ef738fb8b799", "comment": "Malware payload (Dridex)", "value": "7ac24ef9edaa598947191df4d763933e1f2f286b1bfc4875cd54d4661b7791d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666275, "uuid": "3c0b3cdb-baf0-4701-a0ac-6450db115f4b", "comment": "Malware payload (Dridex)", "value": "a1bb7122acdd22bb5780991fc105faf042347e22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666275, "uuid": "5d6e90ce-8f86-4075-82a3-ec99711b6418", "comment": "Malware payload (Dridex)", "value": "97fe306753795d4b5c1e4c4fa4964cb448c24724536bc84186f126f7d7d4b03f5659525dbafe8c7881985e816c255885", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666275, "uuid": "1c0c6f6c-5f1a-4f06-8691-1ad895e3f699", "value": "E5F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666275, "uuid": "4d528c16-777c-4114-915e-1666bc4dde53", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666275, "uuid": "c85466a7-b3c1-43bf-9932-40971101ebd5", "value": "3072:IWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:I42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666275, "uuid": "2b653819-70d3-4767-9e35-39b7517c38b5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666275, "uuid": "73ee96c9-9525-4eae-aab9-f290b15acc51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666275, "uuid": "c13c318b-1451-4dcd-aee4-1a73cf805c84", "value": "e22cf3c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edb4b77-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673393, "uuid": "22b33774-d669-45a0-b607-ef11d8af82d8", "comment": "Malware payload (Dridex)", "value": "e332ac410dbdb53030cc1e56737fc07b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673393, "uuid": "44047b75-1b87-406c-bb6c-bcc68986bdd8", "comment": "Malware payload (Dridex)", "value": "7ae5a0eb60b692b1aa0a3f5fb9a54ce98b436566244a33f5fa6e4323938540d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673393, "uuid": "d1cf159d-abc0-4e7d-8290-d72ddefb916b", "comment": "Malware payload (Dridex)", "value": "8e9f21c4fef464ca2e07441db4c6412ac67e5622", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673393, "uuid": "0dc36833-87b6-4921-9325-43599a9c00ba", "comment": "Malware payload (Dridex)", "value": "049218980eef3dd52eaf30b0c6d76307485b331d745a18e8516e0f6a301115cf85f39b294feee9585c6e980d7e9978a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673393, "uuid": "314569a2-40e4-4953-9ace-00061dee7ccd", "value": "43F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673393, "uuid": "c56510d7-17ce-476f-8fdb-1c1134240af8", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673393, "uuid": "e6ded1ed-515c-488c-a431-7c8b20fc73c4", "value": "3072:Wesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:44+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673393, "uuid": "ba37ee46-4eec-413b-9fc1-1b1b233b5bf9", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673393, "uuid": "421e9a0c-69fa-410f-8e72-52645a9d3167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673393, "uuid": "190c92da-a928-4a05-b8cb-6f3eb3728f18", "value": "e332ac41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44877ab7-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673349, "uuid": "efb2c61a-e9e1-4cec-8032-8ae2632c31a9", "comment": "Malware payload (Dridex)", "value": "7db0d4475db7b0b3ee88bfca62087bef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673349, "uuid": "b96f33f5-e8fd-476f-8753-2fe8d578a23e", "comment": "Malware payload (Dridex)", "value": "7b120739fd92da90546e399fcd6a6b40513a8b0c3608518b775fb90e9fa5af36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673349, "uuid": "84951902-d2ba-4075-ad21-15c1c4ba92ef", "comment": "Malware payload (Dridex)", "value": "f727886b01ec3fa8016aa397c969ce283c92d498", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673349, "uuid": "d44586b5-ebd3-454f-8dc4-c4ff9531fb01", "comment": "Malware payload (Dridex)", "value": "e221af6f21f748045fecb95715e2bad635750c91a7e9c99f5e8529f631b0ea27aa8cb9004222e5b498bb6054db94899e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673349, "uuid": "c5a7fd36-9b19-4107-b576-a0f1a20d77b9", "value": "D0F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673349, "uuid": "de94fc32-ec2b-4624-91f8-8f60ee74acb0", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673349, "uuid": "3a7496dc-839a-44f7-8679-7bbaf25a7a98", "value": "3072:Yesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:y4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673349, "uuid": "13687c23-21be-4168-a825-45f3458dd22c", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673349, "uuid": "e9f9af69-07e9-4eb9-9f85-f20d4a104c86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673349, "uuid": "10af1d4b-f94a-4b99-a9c0-550dad64cf76", "value": "7db0d447_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a282638c-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640865, "uuid": "313b6b9c-b904-4b8b-95b0-6de3062a6eb4", "comment": "Malware payload (Dridex)", "value": "de0e1a189f767d95d7704cfa971edbb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640865, "uuid": "ef8b6bf1-fb7b-4f3e-92a7-6bda71e526f6", "comment": "Malware payload (Dridex)", "value": "7b4799ae857d162eda5b013e2e77ebde8c15838387ba8f8fe68fd73318f363d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640865, "uuid": "8731acc4-077b-4f13-965b-204ba0c5010c", "comment": "Malware payload (Dridex)", "value": "135f6f2c014974bda64e8639a5909631572820d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640865, "uuid": "178d552b-9310-4981-bbbf-400fcc298211", "comment": "Malware payload (Dridex)", "value": "4b3b8e9f52f40e7b6edbc3d2260970bfb82b08e5fe8c162408902c1133ab92744480e89799280df28cfdb13f284e3bd5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640865, "uuid": "15b37cd2-5be5-449e-b07f-a98f6b2c0e0b", "value": "40F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640865, "uuid": "0117bbe4-6836-47b0-892b-90b18236101a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640865, "uuid": "631e1bf7-bc02-4bef-a371-87072de21af5", "value": "3072:RiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ieAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640865, "uuid": "3e7d28c1-7feb-4e92-b91e-52b45299707b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640865, "uuid": "937b4e9f-6c5a-4302-8718-8411c178fb84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640865, "uuid": "cb0f79bf-0970-48d9-af15-f4f0a17bca7d", "value": "de0e1a18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fd9298-b19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620657724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657724, "uuid": "59600017-7992-447a-a6f7-7c8a137c730b", "comment": "Malware payload (Loki)", "value": "2c211b96f7cafa709998c26d1d671cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657724, "uuid": "0dfd9202-8a47-40a9-aa22-38f3c56a4737", "comment": "Malware payload (Loki)", "value": "7b75ef695dbbd0531edd85679419f9f64e153d8a4f19ac9db0c0a637a2b7bcdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657724, "uuid": "3ca633fb-7598-4e2b-b033-10786949b1bc", "comment": "Malware payload (Loki)", "value": "1330702bb9d7c6128bb36403faa52c5d34c1ea19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657724, "uuid": "1276f04d-c193-4984-9270-a9216f9895c1", "comment": "Malware payload (Loki)", "value": "d6446864589213f8b1f3f733e221879008fa66520f7491f35a9b101d462375963fd9f1c54f283fa5979fc5b8b615ce78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657724, "uuid": "006dbf86-d470-414c-a776-a0d136b59ef8", "value": "CAE412033B042AB5D9314C37A182CA521B76FE59C15B9E96BD9CF33A973B381BD16324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657724, "uuid": "86dc298d-0e61-44a3-84bd-98188ae9d923", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657724, "uuid": "e7ad86c7-a56f-4e5d-9b93-78105fd7b4a1", "value": "12288:CHFMw7Y9MA59CyMAn0jb2wxEgoh09odPh1JPQnf2OVWm9qDL:CH+w09tVKiwxEA9wDRkf2OUEqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657724, "uuid": "7a26260d-4931-4f9a-ab5f-5eb19e805191", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657724, "uuid": "a6986b0c-3aa7-42e2-ab8d-f364f3d0a0f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657724, "uuid": "20b508f1-49a4-43a6-a3df-a7488a1961b7", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d04200f-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669847, "uuid": "7c64a5c0-c8a9-4bf5-ac58-3a2bada2a67f", "comment": "Malware payload (Dridex)", "value": "bb6d5aaef1518131532e1c998ff5a2a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669847, "uuid": "623da890-0db4-461b-8e37-cbc7b2158ed9", "comment": "Malware payload (Dridex)", "value": "7ba6916cc90daab32a0f6ec0b1df9e4973f063305e6e188dbff6daca806204d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669847, "uuid": "7c62ccdc-b272-46e8-9352-7b54d9648244", "comment": "Malware payload (Dridex)", "value": "47465cbe7ba85a04e4010a80014c5b974e92b938", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669847, "uuid": "842e9359-5f94-41ec-966a-3f6f3b245891", "comment": "Malware payload (Dridex)", "value": "66b0d6a50ff586ec5ce72ea6bff51811f421ce38fbba55967633b8633b0a6e0ed5780eb4eee8362c488943fd42cd5a97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669847, "uuid": "0678f4d8-5400-4635-8bfc-a9f706552922", "value": "F5F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669847, "uuid": "95acda59-7922-4572-83f6-00791c30f64f", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669847, "uuid": "14398aeb-90ef-47c2-bfc0-023b19844e9e", "value": "3072:e/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLIe:UbrE1kvcB74DXZ2Melxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669847, "uuid": "0ab72e6b-fb86-4faa-81f7-8940ad095ff1", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669847, "uuid": "27b525ae-5ef2-4450-8d26-21d61254e190", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669847, "uuid": "fda29582-f471-4f9c-b03e-7f1c98fb211e", "value": "bb6d5aae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2bcf11-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620649632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649632, "uuid": "8e664af5-e2ca-4158-bb3c-3dbea8c00409", "comment": "Malware payload", "value": "164f192a0a595702b84bfbafe11a91de", "object_relation": "md5", "Tag": [ { "name": "ex1", "colour": "#79C47E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649632, "uuid": "79b21a95-6bef-4c4b-b1f7-973259d34b28", "comment": "Malware payload", "value": "7bafdb99d11bc620cc3094b699e31d03b9e1ffbce20c197fce674813ef146895", "object_relation": "sha256", "Tag": [ { "name": "ex1", "colour": "#79C47E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649632, "uuid": "1eab4fd4-14a9-4051-885b-51ddf525ed21", "comment": "Malware payload", "value": "72939d1b1ccd3b55be9a9fbd37b596d753eb536b", "object_relation": "sha1", "Tag": [ { "name": "ex1", "colour": "#79C47E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649632, "uuid": "e8ceb366-694e-4628-ba71-122b32b9a4c0", "comment": "Malware payload", "value": "63a3937d4e76c12009bc28ad64b6d0889f8461de53c1227aea41967581134a561a909f59020c4f5bfdd659c3b8360d6c", "object_relation": "sha3-384", "Tag": [ { "name": "ex1", "colour": "#79C47E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649632, "uuid": "96712994-4290-4a5e-8bf4-f44e922e4ce8", "value": "723523213AF0C6B3D2826471CDD8ABE071E6E5184F2584B35BC94B3E2E359C6D534F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649632, "uuid": "24ea007e-ea4a-4485-a376-bea6aa45b0dc", "value": "1f4dc9aa893a3c5fdfc9623903183e73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649632, "uuid": "1687956a-18a4-4bc3-8097-f1f17e1783d2", "value": "24576:6WvknOMEBwrmn/OkjO7sk9Yh7N5rFxedlGgdqUjooIzgs:6UeOMAymn25skKBFxw8gAUXIzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649632, "uuid": "19e6e2ea-6bc1-4ac0-a2c6-35d8c1a59303", "value": 1117477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649632, "uuid": "bc2bb332-c31b-43bb-abb5-775afb5b8c68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649632, "uuid": "04118c1c-f6e3-448a-88bc-87fca0335fb3", "value": "2021051038892089.ex1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909d6121-b18a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620649425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649425, "uuid": "9ab27ee7-e76a-49d3-89ca-27e771d14935", "comment": "Malware payload (SnakeKeylogger)", "value": "32565aa7d01bc8973f292fd839054042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649425, "uuid": "82438bfe-c5cd-462f-850a-0f9a889f1c4a", "comment": "Malware payload (SnakeKeylogger)", "value": "7bb1631ee8b27cc78218bb16414ffedf68e970d15914dd31f66d0c997be33bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649425, "uuid": "aab9d842-769d-4baa-8003-081beb801378", "comment": "Malware payload (SnakeKeylogger)", "value": "3c7786dd603b69e3eb4eb8dd9ac4c4619d18746d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649425, "uuid": "c1bec165-2724-40b5-9780-c5b0cf9d5aad", "comment": "Malware payload (SnakeKeylogger)", "value": "eca6e9ee8183a21ac99c6839780fdaab9d4a7f89da4e4cda47d7056457f4afbe57412e3ed4a5b4a88520a817f38bc4bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649425, "uuid": "1fdb62d4-828b-441e-aca9-36cbf53f2bee", "value": "7BF4CE2037D8AA18E87F877119E195C463F6BAD7D222C64EEE9DD04D1E31742C762B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649425, "uuid": "590ef6b9-d987-4254-a8c7-038489f96cfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649425, "uuid": "2558233b-fc82-4f3e-8739-e77072400740", "value": "12288:pgEti3FXutBVw1hhhr14zqyidT8lJ9/df/CRIywiJwctelSkPt+dbcCDAb:pcFXuPGhhhh49fneIywiBelSkPkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649425, "uuid": "74bb9e29-45e5-45e5-9904-fdf1111041e7", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649425, "uuid": "c691840c-a92c-49ee-9e7a-1d3a21992b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649425, "uuid": "50beece6-6243-4483-9deb-762514df718b", "value": "Reconfirm invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d010b038-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640941, "uuid": "56fc8848-0e27-4d4f-97d6-102f274dc2e9", "comment": "Malware payload (Dridex)", "value": "a44d9d89195e462355539466c4e5cafb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640941, "uuid": "2f2e0807-9983-486e-8cb5-251c13ddc190", "comment": "Malware payload (Dridex)", "value": "7c7db0e691c61b4a1b34221704f1d1efcf2b5d9aeb05c72d76d7df52a1f1a9fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640941, "uuid": "fe784fdb-4b2f-4fad-bfa8-85179aa0bd71", "comment": "Malware payload (Dridex)", "value": "361d4b60fe734386864594ad941531e9816564e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640941, "uuid": "ba212420-076d-460d-9211-5b32271fa538", "comment": "Malware payload (Dridex)", "value": "f92cb214597183319f52621a371e802d4cab6db5f58b4f3eb8299024a1465e48496603eeb06ef34147ab42c263575ba4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640941, "uuid": "22c26859-213f-4124-a150-b4ba2710e423", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640941, "uuid": "65af6253-4139-45c6-af50-1eb151addde3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640941, "uuid": "09edb875-109d-424e-b056-7515813e2ce0", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640941, "uuid": "37b20692-dff6-4044-917c-6105dad59165", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640941, "uuid": "04a7a215-57ac-41af-91e2-454c1034e141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640941, "uuid": "66b5cf78-99c2-425d-9f0c-59360b950ae8", "value": "a44d9d89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa60c38c-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620666219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666219, "uuid": "9fdb174f-aaa1-4f8d-9442-fe70010fce33", "comment": "Malware payload (BitRAT)", "value": "238f938f5ced393d4e577a4564ab4dad", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666219, "uuid": "567eb75a-ae3d-4d2a-8c23-1d64e37ba6f8", "comment": "Malware payload (BitRAT)", "value": "7c86292bf74e67542dd8bd096c34e0ba11d0134b68ea385d7c118125e04a8d5e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666219, "uuid": "e1c41f0e-cee3-4d8a-83f4-ff50900482bb", "comment": "Malware payload (BitRAT)", "value": "4dc25dbcac8c407fb85dfcc04bea26e7b18aec23", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666219, "uuid": "e4b26f7c-dfa9-42ce-aa45-0178255e7d5d", "comment": "Malware payload (BitRAT)", "value": "bf60f7982090ae5ba5d252f7ca8e3f56f79c4aa0ccd4b21c7370c1d0f49c19596bbb96992381ccc2f6f876ab9ca09b5e", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666219, "uuid": "ed85668b-c053-442f-a293-246da949036f", "value": "C4B52374E341C79AC42D5B386036CD722BB2AA369353DB1EBECC32775F32302496516A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666219, "uuid": "2604d1a7-eeb0-48c8-80f9-07a043f7e17e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666219, "uuid": "3f7d1436-22a1-401d-be8b-5d7555891512", "value": "49152:jTj3zrMqmp9vA8vLcR5ZGju4DDOhWEBA8BtoN9PoxGU9:j338qmp9o5HZGjfxR8BQ9PoxGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666219, "uuid": "b06a5cfb-f824-4fdd-a577-24956bd1f244", "value": 2303488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666219, "uuid": "bd8f293a-d9ba-4c75-b6c0-96351dd29436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666219, "uuid": "62ce9551-4df1-4676-8ab1-b24947a3e567", "value": "238f938f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3b16f2-b180-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620645311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645311, "uuid": "58eecb99-cecb-4ae6-824a-3e2ca0ae663b", "comment": "Malware payload (AgentTesla)", "value": "f9b599b641b5dec725cccdf94cc8bbbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645311, "uuid": "7eec017c-789b-481f-a0c8-22eb9c05f84c", "comment": "Malware payload (AgentTesla)", "value": "7dc9da6f7f7dc78da34cb0fd7eb04dde6c09a27581d069bc00cd27c31176b418", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645311, "uuid": "ab130713-adc3-4757-b771-a15210c8966a", "comment": "Malware payload (AgentTesla)", "value": "5bf569bfb347a194cc156321b6b6950916daeba8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645311, "uuid": "04b1bdf3-9ba6-4d80-8e0b-70d5e4fae8aa", "comment": "Malware payload (AgentTesla)", "value": "46090ac7a6b09a7ee49d6f165059ffd4294c9d1976c9bff480168080f2c66c7205c1abec5f249386612224f946bac9c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620645311, "uuid": "38500e94-4ad6-4aa7-a345-4fb4dc21757c", "value": "77D4237DE3A8F4C269E607674ADD9415A216682AD02D378C2F61B2C0DFCD47E06C62DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620645311, "uuid": "0a298e18-b738-4c55-a4d6-e48c97247781", "value": "12288:i87AwxhTCtJhVrbICbNabBybTEewFsCvjf9Sh4TxXWrK/i:i87N/c7bNFQ7fU+TxXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620645311, "uuid": "02f346aa-5a65-4569-92d0-fd1b2502fbbb", "value": 615593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620645311, "uuid": "d7f31a14-f1a0-40cf-ba59-f8478e682c47", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620645311, "uuid": "8c3ff317-20ac-4c42-80c5-c6094b60a89f", "value": "Purchase Order APO-074787648.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7acf8cf-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673542, "uuid": "1fa96874-58a3-45e1-9e34-c957599e3e18", "comment": "Malware payload (Dridex)", "value": "0f92b1b3c853e2b4d180a27644864cb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673542, "uuid": "013cfb35-8a8f-49ba-88f7-8e3bb2e4ca04", "comment": "Malware payload (Dridex)", "value": "7e94324c48f76d13357989ab6ac95be6aa0439b00a85028696446ce8f48741e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673542, "uuid": "f712d8f6-2339-48e0-aed1-8111bb2897ae", "comment": "Malware payload (Dridex)", "value": "c803bd71efb512d13ddc66bddbbc5b707d10d8b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673542, "uuid": "190de8e1-b044-47bc-b042-41796df0af59", "comment": "Malware payload (Dridex)", "value": "03ee41d73ba053a0dd4925eff1266e882ed58ef80ce49c9392043707fa51ff862046f1e1f1e2463b06f6d0077be4d392", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673542, "uuid": "8a4c43b0-1c46-48fd-8de8-d69bbcfeb9cd", "value": "9DF3D0906A9BDF0ED9C13CF96A96A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673542, "uuid": "db8df9b0-a006-48f6-aaf0-89fd911a310e", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673542, "uuid": "bc83d230-9c9f-4880-9ac2-f0aae1595eff", "value": "3072:Fesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:h4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673542, "uuid": "d32d05c3-fb02-47d1-97f3-6092223a8cd4", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673542, "uuid": "cc7f1409-9abd-4fc7-9d28-dbd00919c26b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673542, "uuid": "905f1d2e-201f-4f44-9d50-c771105de080", "value": "0f92b1b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4bbdbe-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669012, "uuid": "09f85f70-4373-44e0-8070-9a1ba51c00d0", "comment": "Malware payload (Dridex)", "value": "f7aec7c3547af2e62b3b893872eba013", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669012, "uuid": "2a475aca-52b6-4d7e-88e7-79956f395b4a", "comment": "Malware payload (Dridex)", "value": "7ec429c808dc9ce14085094e5556ed3e0e482ee4d47d89e4cc61370260de9d4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669012, "uuid": "d52fb069-8775-448b-ac39-f20831af9593", "comment": "Malware payload (Dridex)", "value": "516f9addbf7c82fb1e488d203f9a77969b9decc8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669012, "uuid": "eb3f8132-0d27-421f-b1c2-ff0f45d53861", "comment": "Malware payload (Dridex)", "value": "1ae95a1c9bf02cb9d55b7c613f163d278bc2ca86195bd89948f0582a9ff61fdeac713309250be2aff5e3b8989ed8179f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669012, "uuid": "5f0f62b8-e20d-445f-a47f-e45d10894e95", "value": "3A0633C57C06698EF8758230BE9A36C4E9B1232B9A5A0D98E118EDF09C10D69377F5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669012, "uuid": "de068ca8-0f14-4bed-9e07-124fd00ff38b", "value": "98304:44Z57BiuYNNEIBx63yJJ+NKj9oEKuKAmfBf46zM:44j81NdBx63iVj9o/ft42M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669012, "uuid": "582eb4e1-7eff-4382-83c4-1291a6eca9fa", "value": 3710315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669012, "uuid": "93a761b4-c74d-4717-b6b6-bf76bbfbef95", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669012, "uuid": "5a695333-748b-4d12-8e40-47c8d60017aa", "value": "generated purchase order 045950.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd65cf45-b144-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620619462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620619462, "uuid": "f2d21c73-14ec-4ca8-8932-4daa3c829739", "comment": "Malware payload (Dridex)", "value": "10320a40856c9029bdb49759b684b355", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620619462, "uuid": "9fcec13f-bd6c-4ae9-964e-5d36d600f19a", "comment": "Malware payload (Dridex)", "value": "7ef73e7ff22b2badb95378da9e63c2bc39f090184969dc58eddb0a9ac131f2b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620619462, "uuid": "d9253e4a-f721-4c44-92cd-1c6ae9482449", "comment": "Malware payload (Dridex)", "value": "bb4fd950faffd7f52c26efe2dbc19fcf9536efcb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620619462, "uuid": "c8d21648-58f5-4cf0-a88d-28c9b7a26ed7", "comment": "Malware payload (Dridex)", "value": "03f516f6f4ae324b5c9165caa28f626ab20a9868f4dad55266940f9699e4020f380d24e12eb2650309f19a830af8ca88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620619462, "uuid": "76462d37-6d47-4d5b-b829-dd09eb423778", "value": "2BF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620619462, "uuid": "198a3903-5fe1-47b5-87a6-da193b4fd273", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620619462, "uuid": "dcdf1688-adce-41e7-85fe-4a03ac3bd83a", "value": "3072:aWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:a42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620619462, "uuid": "abb1af66-d732-471c-91e1-69063918828e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620619462, "uuid": "bcecd8ac-796f-469a-b06e-8dff239aabd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620619462, "uuid": "00dd72f3-620b-44f6-9119-eb1b6d5c8dda", "value": "10320a40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637c0dfe-b14d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620623150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623150, "uuid": "53c8e44f-c48d-43ca-b160-dd2bc0e1b1e9", "comment": "Malware payload (Dridex)", "value": "e5ad6cfa9cc695e01a208a06ad6604b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623150, "uuid": "33092c9e-190d-4e87-b592-52788975a414", "comment": "Malware payload (Dridex)", "value": "7efc1f4de69054c479c73a3c612733cd540afa916543404833fbd73825a45841", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623150, "uuid": "3a816af4-139d-4a13-89ac-fb5eb7ac16b5", "comment": "Malware payload (Dridex)", "value": "2aa91c5c89e45b3d44ca3c7d61f9ba473c773dc4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620623150, "uuid": "230d4dbd-c000-4c2d-925a-6279e25dc24d", "comment": "Malware payload (Dridex)", "value": "55de73e821433faee427efcc69b4a2801506a3fc245f8b5a2af0531d5fa86c5d6cd7f84280075e92021c1df3fd269390", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623150, "uuid": "690eb661-5f41-4839-a083-7858530cde16", "value": "8DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623150, "uuid": "54e084d3-bbea-4cca-9745-14630bc52ec9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623150, "uuid": "74045d34-46ad-4784-acf7-6057b4c78c81", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620623150, "uuid": "3c5b96fa-bc0c-408e-be4a-408bc3bd778b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620623150, "uuid": "d4c3c8a2-ab53-4930-bd9f-f64d762338da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620623150, "uuid": "3191db58-4f71-42e5-b8ab-38e10cbd0b3e", "value": "e5ad6cfa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4823426f-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620669919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669919, "uuid": "1711a551-8109-4df9-8c08-9cbf3a4e65be", "comment": "Malware payload", "value": "93394d6e0ea894922267955095fabbc9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669919, "uuid": "6e3ca0b8-7264-4007-8f49-74b12f942e4d", "comment": "Malware payload", "value": "7f0f199833687549249b22ec50bbcb234d2ad2b8da993a6cbc86db8a53236530", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669919, "uuid": "7c81f43d-bb64-4079-beef-cac3ce124dfc", "comment": "Malware payload", "value": "38ac582b64fb09f212aceddf5e3cc13946c69985", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669919, "uuid": "c8d29b17-fc52-45eb-8379-3146a0dc0907", "comment": "Malware payload", "value": "2edbde86416376f8f68ef08f378b08db65c5a9a3fb6eaabff18988efb4e2b66cf7ddaad1a95d2c24290a595097648716", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669919, "uuid": "042a62d9-6f2a-4745-8872-25cf67f3de35", "value": "C7D4F1838AD08E06F5C92DF0451789772D51B8B68134A3098E71C2BFDF1C668E235BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669919, "uuid": "1e3792cb-478d-472d-bfba-e87e73800abc", "value": "9492b94f5d5a5ef7d6070716325e88dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669919, "uuid": "ee28baa9-7684-4536-bff3-785988e30c32", "value": "12288:3prLPez1SBV5ulap9F2dXhkdVFflxKrqEsr0LsPju0T:Fc1SBV5ai9SeKOEBsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669919, "uuid": "41433c7e-f65f-42f7-bb1f-6dad793c8778", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669919, "uuid": "50c7a460-7574-437b-866c-99d1543f668d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669919, "uuid": "992e7d94-0b8f-46d3-bf25-4d1faedb0f73", "value": "93394d6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4ce5d3-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620652047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652047, "uuid": "cca6a9b6-4217-4eb2-8045-506675b77077", "comment": "Malware payload (Dridex)", "value": "3a34a82cd281062cd1249627aee53e63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652047, "uuid": "7cc458b5-572f-46f7-aef7-4d107b978426", "comment": "Malware payload (Dridex)", "value": "7f3dc715a5f1b3876d12e00a52edf1f44a72e92697a5b8eb318232b462b0813a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652047, "uuid": "ec4c9fee-e115-4271-80d7-4d21d1aab5d5", "comment": "Malware payload (Dridex)", "value": "095b2a63213ea59aa2899d316e26f831dd5f17cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652047, "uuid": "7da9da3a-07a8-4990-a97a-6537397ec655", "comment": "Malware payload (Dridex)", "value": "4e389d3fd3a21a39933109bdd4c1bbbd146b50a280bcf1519e90e57b948adb72227ee28928c3da0ea549ed775a25ff8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652047, "uuid": "3b637074-1fd9-427e-a41e-bea9b2bcb041", "value": "47F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652047, "uuid": "6a34a92a-4201-4490-9e5e-dc1cb060d8c3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652047, "uuid": "8a30e1a4-51c5-4709-a1f1-3009f726ca3d", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652047, "uuid": "66a14be7-f522-4992-919f-5afbfd5b3e12", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652047, "uuid": "fe60c07c-1204-4843-9d26-b1a7691a98b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652047, "uuid": "2db03219-605f-448e-beec-a0cdcf082fbf", "value": "3a34a82c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5e11a7-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655297, "uuid": "6b06c0c3-8937-4914-9ef3-0adaa22869f4", "comment": "Malware payload (Dridex)", "value": "2232e014e739558aedac45e67f2b9f07", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655297, "uuid": "894b159c-8cb8-4bbc-84ab-64b3fcc8d8e8", "comment": "Malware payload (Dridex)", "value": "7fd36d39d427817f4d97701bc7c3c5af26dbcec0e324be06499eed09675287ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655297, "uuid": "fc151ca4-56cf-4d4e-bfe1-764e492227a8", "comment": "Malware payload (Dridex)", "value": "1f767bcb2287b4b1d4a5ca0fa6a39eb50ebe002e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655297, "uuid": "ef1d564d-d75d-4f31-9d12-fa41794440fb", "comment": "Malware payload (Dridex)", "value": "d5f88782c1f8b1373e7db67b0a69666b7fc0155c2faaafd0d18567a1d2940c1b12c6db5bb9184a6d9f3ed5e2d5473745", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655297, "uuid": "e37fce4a-6687-4440-929c-8630106748b2", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655297, "uuid": "7e18633f-1c9e-4029-9497-6d2581d48231", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655297, "uuid": "8220e931-c628-4c28-a93d-9c166e90b120", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655297, "uuid": "f5044c5e-885d-481e-b89c-0b9b320977ef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655297, "uuid": "96a5ece7-f0b9-4832-baea-b26563674a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655297, "uuid": "fab60ad2-c8d0-4eee-a28d-dfd59f7e9f7d", "value": "2232e014_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54cfaa1-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680518, "uuid": "1dce83d8-5e74-4442-ac1e-bed7d457cc0f", "comment": "Malware payload (Dridex)", "value": "021b6f2da4ce6f40a4e9fbfc7ad5f20b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680518, "uuid": "3d43e151-9552-4ef6-b1dd-7be249743ca6", "comment": "Malware payload (Dridex)", "value": "7fe5c1191d869633b44db7cb6cf5654bab31ede6aacfb8f6a7e714b832400f9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680518, "uuid": "075848f2-c694-4bf0-9518-8d6bfcbbdf31", "comment": "Malware payload (Dridex)", "value": "eb28612119b38650ac046a32a1351c42d2dd3445", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680518, "uuid": "f815d63a-28fb-49a0-82ea-6b2617aa3481", "comment": "Malware payload (Dridex)", "value": "d5204dbf2f6d109f437fdcb29a1a92e828fe4f524b21768c48a28130dafb80467abf4d396c4fe6160b46edd902f2071a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680518, "uuid": "7dbc2a62-e0aa-4603-a84b-ca7f00dfb1de", "value": "67F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680518, "uuid": "bd900211-3876-48ac-90f7-909e97b575c0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680518, "uuid": "12e87382-413d-476a-85f3-1f9696e3cd96", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680518, "uuid": "ccbcb10f-7d9f-4882-8c83-6c29b3290865", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680518, "uuid": "d2b29bd9-c15e-4356-b52c-f21a7a3b15ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680518, "uuid": "55f24566-21b8-4882-a586-6ac60e1050f9", "value": "021b6f2d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1186372d-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669828, "uuid": "8c968164-94e1-4d23-a049-ab4a97946dd2", "comment": "Malware payload (Dridex)", "value": "2ea4de16c5aaef255da1fc9f30f85d89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669828, "uuid": "52112536-0e37-45ba-ae38-84b251a039c1", "comment": "Malware payload (Dridex)", "value": "7ffdda89394f183bcd0a405ab823b6f6acfe5f5d823d5b800a448a70432d1fdd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669828, "uuid": "feec24e3-e2e4-41a3-a2fb-b1a281d729ad", "comment": "Malware payload (Dridex)", "value": "670a7d4d0c8942ed1e417d0ff1997ed60c4313f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669828, "uuid": "69998b01-9324-4624-ba6b-17605e286f3f", "comment": "Malware payload (Dridex)", "value": "6df6066bc9130851c55876bfa8e7aa959783c5191b3d599e2080cfaff7c17a88ff2be50df757752cf38cb276157ad81c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669828, "uuid": "71f86ef9-df02-41ca-9677-4390367a0243", "value": "B8F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669828, "uuid": "81591230-e4e4-4ea1-a34b-1f49184efe20", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669828, "uuid": "f7eaa51f-c202-4a82-8ded-3f9e15032edb", "value": "3072:h/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL63:bbrE1kvcB74DXZ2Melv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669828, "uuid": "60044ffc-b7be-4aee-be6d-06fbbbeae340", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669828, "uuid": "08ff9ca9-f2d3-4b26-8064-35b3f084900d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669828, "uuid": "d96d113a-8f05-48df-97eb-9480f4f1aa58", "value": "2ea4de16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39ecca8-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649027, "uuid": "6120a71c-935d-49c7-9268-943282185c51", "comment": "Malware payload (AgentTesla)", "value": "f0160a06c1009f2908425ffb3e69e0cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649027, "uuid": "bd8a456e-4880-4203-8d47-651bf6212993", "comment": "Malware payload (AgentTesla)", "value": "8011e22f056cc3a11f8e32fd6b122631e76f254c9c32eec5f2381bc5881dcbe6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649027, "uuid": "98b470d2-fd43-465b-ad6e-2c83efc72bbd", "comment": "Malware payload (AgentTesla)", "value": "9bfb2196b3fae2b4eded05e3c4489e904229d8ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649027, "uuid": "f1bf367c-4df6-4b9b-b046-356c1d241e6e", "comment": "Malware payload (AgentTesla)", "value": "63203693e4ed2bf5f90ecfbb3ab34c64919577774388206166e318147f1ed6edc81fb24b5605160faa9c8156d4d21215", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649027, "uuid": "db40d496-de4d-4045-a3ff-4b8910510e58", "value": "EF157CAC754459F1D36F1E7663CF1C0243652534683BE90E8BA017FA2A67F172E3898E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649027, "uuid": "373cf55e-23bb-4010-a657-b1f972cda1ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649027, "uuid": "ef618476-ee8d-4607-ad05-38fb3d701e0c", "value": "12288:a7Q5bfM9kooLLoS60/K7yh0PID4/uidLSybFy1sxeXfLxQs1wsKKyejB:F5bfM9kooLAPIR8SRzxLwsKKPjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649027, "uuid": "aeef0064-17ed-4437-9b4c-9c8eedcf488b", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649027, "uuid": "4874f79f-fb77-482d-9243-4785dec42bd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649027, "uuid": "b085eb1c-0e43-4758-ba67-fff3c7945e9d", "value": "#10052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe282358-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669795, "uuid": "cbf3c2ec-4ce5-4f5a-ba4a-fd60ae8d7a31", "comment": "Malware payload (Dridex)", "value": "e3c977a098ac8ee3a51b478a44131db9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669795, "uuid": "d97ea882-7bce-47ff-9775-718f1c1571cd", "comment": "Malware payload (Dridex)", "value": "80b6a4b39e930921a8a8e53665c7f2fbd62f43dfadcbf89b462e00c393f0cbd4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669795, "uuid": "65ef6b5d-f7fd-4ade-a0a3-9915e3fa355f", "comment": "Malware payload (Dridex)", "value": "0c58ba2aabfc173559eec3c1cf029246912abf1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669795, "uuid": "358bb516-c916-41bb-b5c5-5f743b2a3692", "comment": "Malware payload (Dridex)", "value": "5aeef8f4e71844f0475750aba52982ff46ede73340580613f0f328cb08dcd38b142ac00e6a4bcc69720a6332da93cbb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669795, "uuid": "305f171c-1d6a-4215-8435-d481937f92e4", "value": "03F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669795, "uuid": "6a242059-3c7d-4a70-a13d-af5b8d46c21f", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669795, "uuid": "ca2dbf28-87a5-4f45-a3c4-672519e2a1c5", "value": "3072:Iesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:C4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669795, "uuid": "6de6cbaf-6ffb-4594-bc61-a38521f1a7e1", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669795, "uuid": "3fd43b24-ef5d-417a-b596-49ada1c59c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669795, "uuid": "200661d4-b371-4351-a766-cbddd5e0e7e8", "value": "e3c977a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2e9215-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658952, "uuid": "87e7f2ca-6b7e-41a2-a719-de44021f34b3", "comment": "Malware payload (Dridex)", "value": "57cdf02142925e9fbff0b5b29c8b103d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658952, "uuid": "a02d945f-0902-471e-89d4-15e100d18955", "comment": "Malware payload (Dridex)", "value": "80babfe0d4c20667c77b9736b6d3fda172f4ae05d46c150cccf03959ea6de24d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658952, "uuid": "12d2276f-5e40-4c6e-b36d-87fb50f2e4b6", "comment": "Malware payload (Dridex)", "value": "c6a9c0107a1f014db25292ff151dcf4f39395978", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658952, "uuid": "6b586648-c9f1-4a16-9fad-a16f1a4a9246", "comment": "Malware payload (Dridex)", "value": "939d401c25eb4637b151b5d7d02d9d817a28d7b81c19598d811ca2a87d9137eac40a4f313356e056d4d073d5249fee3f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658952, "uuid": "e4911606-fcff-4639-9770-a6fed66752f9", "value": "0AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658952, "uuid": "580d0453-eb0b-44b4-a7c1-fc787ab83242", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658952, "uuid": "fa4c9321-0e04-4192-a2ab-3bd034bb84ac", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658952, "uuid": "82b47358-4345-4b80-99a9-fe93a59fe661", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658952, "uuid": "4480aa04-3d78-4c75-b733-063e94aadfd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658952, "uuid": "c1c27c32-fb3f-4ea8-b0db-d302328380ca", "value": "57cdf021_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3323d81f-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629082, "uuid": "c0526e07-104a-4de6-8b82-745df88f4e9c", "comment": "Malware payload (AgentTesla)", "value": "ce2773d607f2395d8b873338bf0f6dae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629082, "uuid": "e0d532db-4015-42f6-9c9d-4e279853fe5e", "comment": "Malware payload (AgentTesla)", "value": "80bd30aa05237c35c46fc461f06d04b3a5b4ae90380287125ad011a605ef6298", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629082, "uuid": "5bc87335-bb31-4a39-a233-508e68c538d1", "comment": "Malware payload (AgentTesla)", "value": "3b807301aff763ebc8a99b8abdd0e5b2436694d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629082, "uuid": "a370d5a3-5ad0-4d28-a74c-3aa9c3809593", "comment": "Malware payload (AgentTesla)", "value": "9369fe5606dbb9fe175faac67ff60743815aad2407739cb90955bd65599ebd31facb6b60bfb17d477d7920082d7d4ca2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629082, "uuid": "821ca387-3527-4681-8f26-efc67b78942f", "value": "DFA4DF51BF40C0D6D9572E711D51D63CE7E228AD8AE38706A6B6EB3E7073AF2000F596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629082, "uuid": "2a7ae6b6-ab6b-4b96-b061-9ad97e482246", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629082, "uuid": "ab7c32a7-dcc0-4f89-9ebb-205ac3cbad58", "value": "6144:v9X0G/l3raV0mPTIx1TOS0Q/4eAy7EPeXcr52gVMi/cklDEu/aVk7YYhub+q:Z0+l3raVxLIxxHFAQY4fGHlkvb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629082, "uuid": "8f1020c4-07ab-4579-b0dd-3bac8d932cbf", "value": 471584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629082, "uuid": "50b8387a-7aa2-4d44-a6bf-a1d79e140884", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629082, "uuid": "ba025eaa-f081-4eda-8b75-4bf86516ff1a", "value": "Proforma Invoice 10.05.2021.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22570a91-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669856, "uuid": "8351d24e-4dc2-4096-920f-b21712da3153", "comment": "Malware payload (Dridex)", "value": "ef77801f75a5d3502d8561906887749c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669856, "uuid": "9a93e765-9b34-4c70-a4e3-7084f6e02bd7", "comment": "Malware payload (Dridex)", "value": "80d4710bee9341044a1c68f81fe99b556e1a5ce6eed305ba858a1fb568caf09e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669856, "uuid": "d4cdf976-f13c-4be1-91ea-2437bea7bd43", "comment": "Malware payload (Dridex)", "value": "de913f0050c391f8c47ef198303b4a78e87d6784", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669856, "uuid": "654a1c91-42f7-4b73-8834-b69b114efeee", "comment": "Malware payload (Dridex)", "value": "3ed2e8e45e6171e16cd3d59187a66c0ba8479328ebee792ba991eb59d886ac919132cb1d122d76fc291fdcd2c048fa24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669856, "uuid": "847623c6-7811-4cc5-81e2-3ff0117466ba", "value": "28F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669856, "uuid": "c7b82576-d69a-4ce5-a69f-1df331e416c8", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669856, "uuid": "8d500e46-0139-4be7-87f3-80e20efe6fd4", "value": "3072:m/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLIe:cbrE1kvcB74DXZ2Melxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669856, "uuid": "eaea0da3-3e90-4271-81c4-18b6f4d3d14d", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669856, "uuid": "a6648330-79f8-434b-85ba-55a3aed7548a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669856, "uuid": "adf883ba-fe25-4d5b-98f5-6e64f7c43532", "value": "ef77801f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3a4aca-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673600, "uuid": "6146668f-3c73-43e6-bce2-5bde7072b052", "comment": "Malware payload (Dridex)", "value": "704bab49c32a3b5379dbfb6cfab308ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673600, "uuid": "c375bd8e-a92d-4b28-b572-205d167f2d1a", "comment": "Malware payload (Dridex)", "value": "81ed5f026f526a43b34a5c567551a96f1dcfcd59a9f1e8d6a3cd098dd59948f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673600, "uuid": "627b43f1-534b-466e-82bc-e594b9991d5d", "comment": "Malware payload (Dridex)", "value": "2956fbe0fdfd4c4bf15a9e2aecada189c5dbae13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673600, "uuid": "e0f2c469-7d66-4487-9ccc-6fcf3d56e436", "comment": "Malware payload (Dridex)", "value": "51eee41d02f3fdf9c24381fdc56624926a020827de545c63ae297b41ada0c01282a238ed8667edbffba48e87d380fa68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673600, "uuid": "bd531f8e-2aef-443d-9fff-883f17d63f0a", "value": "C7F3D0906A9BDF0ED9C13CF96A96A879B073458C811FDAB4D0DE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673600, "uuid": "0bdc1286-a1be-4e8e-92da-9e8a1aa0fadf", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673600, "uuid": "e1ac1a53-1a19-4c7e-91c2-dccddc3be2fb", "value": "3072:Mesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLKK:W4+VZQpt5hyPsa1ekiEtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673600, "uuid": "52aaa2e0-71d1-4f53-9fb1-0a002cf6e9f8", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673600, "uuid": "db41232b-7696-41d2-9689-9b4505aa49a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673600, "uuid": "aec5d8fa-d331-47b4-a866-fe695c80db69", "value": "704bab49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79810c62-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648098, "uuid": "bb1012ca-48fa-4896-9190-cf831af6818b", "comment": "Malware payload (Dridex)", "value": "3147d7254624a60e2471c767cb02150f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648098, "uuid": "49ea7d99-af97-4bd6-964e-f0e7f471a062", "comment": "Malware payload (Dridex)", "value": "825273a3122f08025451ee1f67874b1a688b4541e5871031bb8d55464ecace50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648098, "uuid": "5ac7c34e-9f19-4875-bfa2-28ba1d5528f3", "comment": "Malware payload (Dridex)", "value": "2908f95d6bc834709bfb4b9dd4bdc047e0e26585", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648098, "uuid": "5693680a-39e9-41dd-8acb-e415e6f0efc2", "comment": "Malware payload (Dridex)", "value": "5e59f4af6fffcd8a598d1ecad5515559ff24cc4cd1c00129114fa37637ce3f951652885ee47482bec03d46e42dba83e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648098, "uuid": "da0ee0a1-af92-45dd-bf51-4655ffc2bc4e", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648098, "uuid": "ba4f60df-eba9-4cc2-9bf0-1897f5fd8442", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648098, "uuid": "d75ee316-1483-4c30-adfa-1f1baafabbd3", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648098, "uuid": "648cf264-9a18-485f-a9c9-30af528489d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648098, "uuid": "8a082b41-1147-422f-8260-e44c529a09d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648098, "uuid": "e8f7221a-8f0b-41bf-9628-69e652771ffa", "value": "3147d725_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7266870d-b167-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620634342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634342, "uuid": "f72b3cfb-b61c-493d-b288-0fd697d46abf", "comment": "Malware payload (Dridex)", "value": "1bd2e26c1ed5ffedf6109858ce1f6056", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634342, "uuid": "ed472c0f-4a23-4212-9ed9-193c84ff82e6", "comment": "Malware payload (Dridex)", "value": "82d1ea53362854e3423982ba0f8d11bbf9da101f1f6fc916ba7598bcf4e5ac47", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634342, "uuid": "f00c163f-5f88-42d7-ac74-415d6945e327", "comment": "Malware payload (Dridex)", "value": "d3ba47e1aeaf13382998aeb8cae8a5f87f093029", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634342, "uuid": "6cd149c2-d09c-4c9f-86c7-eca9b0866dda", "comment": "Malware payload (Dridex)", "value": "3ddbfb780e21f46560e9478e361f38c6884fa3f029ea0084809224052951856c97b1622bddc9a6a765010692ecb67b2b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634342, "uuid": "62a89ef6-65cf-4396-8551-7049a7920c49", "value": "6EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634342, "uuid": "fc1b61c2-9cd4-4fd0-87c5-1dbd98cff94d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634342, "uuid": "e032c97e-010f-4946-a749-d0e0a42bbfeb", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620634342, "uuid": "40ae7d09-921f-4c8c-8e52-2486a4acc9a0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620634342, "uuid": "12b5119c-d4f4-4b6a-af48-ba4c35616640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634342, "uuid": "fe06bf84-1193-4e20-a453-e9bc9f473ace", "value": "1bd2e26c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fde5684-b1ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620663624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620663624, "uuid": "4b994d00-88d2-4b05-b133-c13b9f1514fc", "comment": "Malware payload (RedLineStealer)", "value": "328c32fe3b4a886c28b386254e7ce0f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620663624, "uuid": "e72310f3-19aa-4ae9-8887-7d40301b08b4", "comment": "Malware payload (RedLineStealer)", "value": "8333bdd5e1560584a0302e2fe63cf9d81ebe5b48e7e2b74dc27d5ce14b46e0bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620663624, "uuid": "6133f94f-65c7-478c-a7fa-0b36d9eaf324", "comment": "Malware payload (RedLineStealer)", "value": "97c1a63be0a7027b47b63aa819aaa8edf2bf31d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620663624, "uuid": "3b5fe00b-fbb3-4763-a882-77f1f1819feb", "comment": "Malware payload (RedLineStealer)", "value": "63e127aa522748859ea2a24610b4292eb1a9a82cee11824eebc22b6e47b60893eec54d509755dcbfbe586d54fc6914bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620663624, "uuid": "ad03f187-523c-4346-93ef-2627c0d40605", "value": "FDB34A3C7BC9AE30D6DC667683D1800593E69C905583F36AADD132F998A3BE1590F707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620663624, "uuid": "360d3f78-8476-4131-a211-228a7da950a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620663624, "uuid": "c9893f13-49f4-4029-a315-193b9175a28b", "value": "3072:KWV3jWflUxS/72u5DWEWiWX1B4jNT46WwrnAnu:nVH6iu5DWcWlQNDWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620663624, "uuid": "5eb90cc8-890a-4c07-b0fe-628023f50f4d", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620663624, "uuid": "3e24ab56-dcdb-43e1-9c61-91ba3315b444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620663624, "uuid": "74b3b065-826f-4cbd-96bd-1b13b77d7e3e", "value": "8333bdd5e1560584a0302e2fe63cf9d81ebe5b48e7e2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970d7bc4-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673488, "uuid": "9a3140d4-2ea9-4f04-9c37-a20c9b8e2181", "comment": "Malware payload (Dridex)", "value": "4af875f6ccf28013098a6c84154e96af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673488, "uuid": "a5148296-e3ae-40e4-8953-2ec19f0bfac2", "comment": "Malware payload (Dridex)", "value": "83ba98c384becfccb9c279f8c759a96fb275e096eee8d5c7d31000a00121f6af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673488, "uuid": "41d097fb-3795-4c6e-93cc-a2cec5bc4015", "comment": "Malware payload (Dridex)", "value": "418ba33db3e22b1b43f114a14cc5c6b4fff638e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673488, "uuid": "52f68c7d-1276-4fec-9e79-b89d9f507dc2", "comment": "Malware payload (Dridex)", "value": "c25ec728d4fa6b67145ff7a3dacced46c3be97a9888932d1b3d590ff2cd6d0ca89d44c5befba41fb973a69a631c916fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673488, "uuid": "af8bb771-63d2-4057-92fe-85584e9d9b34", "value": "2CF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673488, "uuid": "7d841d00-b659-4161-abb3-d7e5d248dde8", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673488, "uuid": "ecbcb336-6fd8-40e1-9259-ec5ea21e84b4", "value": "3072:Wesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:44+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673488, "uuid": "0bb4d7a1-2d0c-4b92-af90-5463c6ac90d5", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673488, "uuid": "71b3a21a-9dfe-4631-aab7-9589a683ec79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673488, "uuid": "a001b2c3-044e-405c-84ba-cd210e36f8dd", "value": "4af875f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f414e1d8-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666342, "uuid": "dc0c6e8f-ca95-4615-9198-1306269d9578", "comment": "Malware payload (Dridex)", "value": "a5ad5720d048c785d7797a7c95b9c179", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666342, "uuid": "afbfe91a-42dd-4cff-8826-9416ad98e27e", "comment": "Malware payload (Dridex)", "value": "83bef39be7d4a2c373baa1ff3a2b88b2924a8ce99c99d6d06220a59f633f6212", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666342, "uuid": "b957078d-0691-4ce8-9460-4ae852c6246b", "comment": "Malware payload (Dridex)", "value": "a0f6ab2c38ba72988367f32e1a4af80bae8ebea7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666342, "uuid": "9812eda8-ab31-4fad-b6df-c311b34ae9ae", "comment": "Malware payload (Dridex)", "value": "8d33425ce371380f6bcd5a8942e81f65ae3495ad80c9e059eabe753ce90954c939a5044c6c5d9622d53df74b39d37437", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666342, "uuid": "731e97d6-f0fd-4500-9e33-835ec2471de4", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666342, "uuid": "10fce6ee-557d-4f91-b496-8fbdab7bb735", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666342, "uuid": "0953a31c-57e4-418d-82c6-388c7074c07b", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666342, "uuid": "33adf72b-e3e3-4747-8f87-b135dc94f586", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666342, "uuid": "3eaaf098-10fb-4515-9d83-dcb0a067c55b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666342, "uuid": "efff7be7-4265-4d14-b4a2-60198e4a70b4", "value": "a5ad5720_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c670cb87-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620651233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651233, "uuid": "7f7db43d-7c86-4903-8236-2c39a6f2937c", "comment": "Malware payload (Formbook)", "value": "d72f1abe7c521c844071a8265b92545b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651233, "uuid": "a6f2cc12-09ec-4a3c-bc98-6cd501c89ece", "comment": "Malware payload (Formbook)", "value": "83fed765d229173fedc6811b521cebdfcec3342713679a57d49188ba554c00fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651233, "uuid": "b4b85751-6d83-4360-a84e-9bab9c1ea742", "comment": "Malware payload (Formbook)", "value": "0c59a02103a9a7fb663a37809563a48a8adb097e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651233, "uuid": "e92bffdb-9221-49e6-a95a-4c33859e9926", "comment": "Malware payload (Formbook)", "value": "888467937eb0667c260bb128dfb6cd5dffa1a72a669bd057d7c72879815e5592525157091997a7d9d7a5c9743ee48c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651233, "uuid": "6c0ebd9b-a5f2-4c74-a6f4-65e5f80ea114", "value": "25057BD8AE9AB90DD06E6378702050FCC3E76D2644CEE3EA0BD3FCDA5B6721095416D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651233, "uuid": "1130ac3e-d7cd-4820-89f4-f77893efc39a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651233, "uuid": "9c75dd31-dfca-4a83-b805-ded25fc49c5e", "value": "12288:zViXtK+Fcivt2bUmfRQVmJYQwBMjGDUuK3LLmcNnuQ1np7ICfLc:l2FV5mfRQV5N6ruKPmcl1SCfLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651233, "uuid": "9938c76f-6671-4f34-b5bf-579b25a70429", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651233, "uuid": "be14a140-55d1-4bd9-91dd-a3e8fa9d646a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651233, "uuid": "c2afee83-77d7-4149-ab42-8cc022a978c6", "value": "Order 202139769574,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e580da2-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684049, "uuid": "85f536e9-b960-4fe0-a1d2-bbcb7152a5e3", "comment": "Malware payload (Dridex)", "value": "166295a6457dcb64400b9e716293b376", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684049, "uuid": "95e99ed6-f795-423a-bbce-726a0201a121", "comment": "Malware payload (Dridex)", "value": "84796454b90aacdbc4402a744474324a8ed94d1626226ab292353a84a7e24eb6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684049, "uuid": "665f3e8f-006d-4f86-b01d-9712a890d6b3", "comment": "Malware payload (Dridex)", "value": "b4129da66dc5e33be03dd3463b8f31907e7fc936", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684049, "uuid": "982f3105-d909-45af-968c-2c27f607e70e", "comment": "Malware payload (Dridex)", "value": "d8a349cb5539c996286ef8ffa8c7b838c17f5363f7f49a2038abb8c4b1db932626d70f8b9da678d298912e1c531f1438", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684049, "uuid": "808496e8-8ecc-4f22-8807-1b3446f2b1fb", "value": "3FF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684049, "uuid": "5efb6196-0f60-4298-a34d-d08bbdf937b5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684049, "uuid": "d7cf3fb1-8e5c-452b-9a42-ff888b7e9a3c", "value": "3072:LWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:L42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684049, "uuid": "3f7fe85f-5a03-4612-8073-ccd6987bd526", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684049, "uuid": "2a0a1fd5-ae41-4a5b-b9b2-23191d6c6ed0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684049, "uuid": "553a398d-1b83-4fd9-971e-90cde9eb312d", "value": "166295a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666bb208-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666105, "uuid": "bb6a7aaa-3320-427f-bca0-2ae2b988c05c", "comment": "Malware payload (Dridex)", "value": "704d927a80ef8a6d0b9533f2b20e7d2f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666105, "uuid": "3f751da7-98b0-42da-9b2a-0fad8effc2cd", "comment": "Malware payload (Dridex)", "value": "8526f1d7c9b08b7cadc6d129a667e8b7cdab52ad3cb68b3125e1e4572a632cae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666105, "uuid": "e2ee7f97-5303-4b2d-b58f-c07a29aa6a29", "comment": "Malware payload (Dridex)", "value": "1573d6de967db0d25390fcba0c2e119b8392d33b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666105, "uuid": "f0e78825-fcc9-4f87-8a2d-ef914fbb88ee", "comment": "Malware payload (Dridex)", "value": "1452ffd7dacaa1a60f50e4fa00c3006c0c280b12e0ac110115538b9863af74d4388b0cf045d99819841a013cb455916e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666105, "uuid": "ee96137c-5d25-4040-8e8d-f64c1cbebd1c", "value": "EAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666105, "uuid": "54b12a8b-757b-4060-9fde-ca2bb60df71f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666105, "uuid": "7221430c-258c-401c-82d3-6c5045626623", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666105, "uuid": "2e581985-49ba-4614-afa0-016598b61354", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666105, "uuid": "07dea872-341d-4a2b-9b9f-6667efda3360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666105, "uuid": "e1844524-2eec-41dc-b3c2-077a635f6a18", "value": "704d927a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae5aca8-b12c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620608935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608935, "uuid": "57a90978-c7a3-431a-b8fc-7fde184cd01a", "comment": "Malware payload (Formbook)", "value": "060e58ae58d80bd62141837f56b68e0b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608935, "uuid": "27cd53c3-85e7-411c-bd5c-db5c2efbcfbe", "comment": "Malware payload (Formbook)", "value": "85b9a95d62f3d7d669197231e1bed3495103e1a23a358fbcfdd140ddb8b81dbf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608935, "uuid": "760f021f-79df-462b-8d35-154c81ceb4a1", "comment": "Malware payload (Formbook)", "value": "6965a19b6a6bb9f6e1bb2d76ecadcf5798717b67", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608935, "uuid": "67e95112-e8d6-4dfb-bcea-2709fa15c3ec", "comment": "Malware payload (Formbook)", "value": "f892e3517632252257f182abdb26c8cd602ccfd6217bcee0fc3aa339403d55e4d3977f95f326107edfeaf7435b90d77b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608935, "uuid": "7322af9b-d6d6-466a-bcc7-c24505fb0e85", "value": "B244DE213ED38C2AD8F7C97E2DE4AE719E4E70CB1130663FB68CD26C65525824C6E12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608935, "uuid": "1abc2c8e-a031-4619-808a-8aa7f4a92e3e", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608935, "uuid": "b61926f8-fae0-4523-91e8-91eb20b06713", "value": "6144:29X0G6ZMnAH44vTVZNMYe6MpW04m6HQ2ZAEJ6ACu4w6:40TbY4LVUWmAQiLC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608935, "uuid": "cf6544f2-6082-4c8e-927e-a872f02851eb", "value": 263550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608935, "uuid": "340dc67f-8259-4ef0-aa59-11c2edfee03b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608935, "uuid": "6704db68-87bf-4ea9-830f-cafe9ca9815f", "value": "SecuriteInfo.com.Gen.Variant.Androm.29.29991.2939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a51b14-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658862, "uuid": "7aa6d616-3cd8-46b5-93ba-3858a23b9772", "comment": "Malware payload (Dridex)", "value": "f920bcc2c50adbb2145ca1ee9f3d0deb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658862, "uuid": "3049b0f8-dee9-4108-b537-613b2956462d", "comment": "Malware payload (Dridex)", "value": "8621e4dbd1aebcbe83230e8ac4b17e09cda39cf35b2e90710250a308375e610d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658862, "uuid": "1aa4c08d-b592-41ac-82f2-966785d0c883", "comment": "Malware payload (Dridex)", "value": "20916b835d50948a614e105e1aebea5e58039e97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658862, "uuid": "196b823f-7684-40ba-979d-7f8ff3ff2d83", "comment": "Malware payload (Dridex)", "value": "cf545231c20fa5d928a947bd58f3c2ea3e1ca7473b648a2216fb575001564c169924e9d3befe4fdf682c53c827a05d29", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658862, "uuid": "44c45da4-bcf0-43b5-8975-361e867eec96", "value": "72F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658862, "uuid": "13812699-a01b-4ea4-865e-7bc8fb58d6b6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658862, "uuid": "b3119542-3cac-4c3c-bb33-99307ce7603f", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658862, "uuid": "b79717e0-9a37-489e-a60d-655980dc0fc1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658862, "uuid": "522a4c40-e808-4f38-8e1d-509ed31df552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658862, "uuid": "17899fac-3e17-43ad-8188-ed08feae63a0", "value": "f920bcc2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6199f4af-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673398, "uuid": "8347385a-a076-4010-b17e-4967f90ac3e5", "comment": "Malware payload (Dridex)", "value": "43d5ff5cf9681868f5ca7c4c96cdb421", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673398, "uuid": "f283b689-e80b-4f88-a5ec-3dd4063a9185", "comment": "Malware payload (Dridex)", "value": "8650129b3a2e194a5eebb9da170c02632bd0bbd1c96fd26c8a6f71188c85ad8e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673398, "uuid": "cb5e7955-67cf-48fb-a379-5943b7bd5303", "comment": "Malware payload (Dridex)", "value": "d21bd1e95de829ede44d3690cdbf1afc13c630c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673398, "uuid": "1f0a3646-de8e-4346-95f5-b6ff62e9e69f", "comment": "Malware payload (Dridex)", "value": "e7debc62f965ce21ac2aab53e8efd02962f0f78f545508224ba4f7f86bc03731803e287279e1f1303d86ee2dd79b23a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673398, "uuid": "7c618840-e0be-4507-a72e-9759f9f4e502", "value": "69F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673398, "uuid": "3b5a8291-2aac-4e2d-8f9f-9c65b7cd46d3", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673398, "uuid": "42cb34b4-f79c-4551-8a3c-75c5939b1dc0", "value": "3072:pesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLnmU:14+VZQpt5hyPsa1ekiEwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673398, "uuid": "843f586d-b4f7-4616-ac74-6284b69cef2f", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673398, "uuid": "995dd86f-cbd5-4bb8-9b0e-586882977e1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673398, "uuid": "3a5c81bd-6c5f-4bc4-8447-c7f40a2e54d5", "value": "43d5ff5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ca6489-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633779, "uuid": "370c9a4b-8381-4748-9e86-4d26c8d80d80", "comment": "Malware payload (Dridex)", "value": "78ea12248e95facc87d672bd44a51cfd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633779, "uuid": "f699ba48-31ce-4bd5-bddf-38e1f4873285", "comment": "Malware payload (Dridex)", "value": "86a41126525b30c419c6a718791158f69bc862277032f6389ef6189ebf24cd83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633779, "uuid": "3d80e79b-64b7-4a88-8b1d-a74594f4859e", "comment": "Malware payload (Dridex)", "value": "8abaff0ae1897a1c89f29b0cf62617643f50dc31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633779, "uuid": "55dc02e6-37dc-47dc-b81d-f662a7c9dace", "comment": "Malware payload (Dridex)", "value": "476bc31fcb37cd23d36895360b6538986a6c0e9388c584d11f1a9d1c938bc3b39b2e670316236057ea708032926e9e5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633779, "uuid": "8d70ccde-cf36-4185-b4d3-2c84e87a198e", "value": "B1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633779, "uuid": "74d63c1d-a18e-45ae-8161-0342cc371f8a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633779, "uuid": "8a7b7900-2246-4264-a57c-b92a8608baff", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633779, "uuid": "36f6bb30-c7b3-4cdd-8339-bc1764bbe821", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633779, "uuid": "e552cf4c-32ff-496b-b0d0-f57836c45a44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633779, "uuid": "cd996e44-f888-4079-87d7-328af915b354", "value": "78ea1224_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc32b568-b17d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620643941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643941, "uuid": "19cb1dd6-567e-4212-ab4a-c35323c17e7c", "comment": "Malware payload (AgentTesla)", "value": "3d2627d3d77e13a2db1d4efee51c2491", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643941, "uuid": "3e6d7f68-e52c-4616-a75e-60afd5c32a96", "comment": "Malware payload (AgentTesla)", "value": "86e7e9abc8ae431280935625545da1a813509462ec27d6d7ded6ef0a6b8eb43a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643941, "uuid": "b2e8d0f9-0220-449e-a8e1-9e7abdac2ddd", "comment": "Malware payload (AgentTesla)", "value": "aaef62f9b8862f6dec3baf2322b1ad50dfb0cbba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643941, "uuid": "6604e27c-4062-4824-a526-43b247822776", "comment": "Malware payload (AgentTesla)", "value": "56fea351a7f212daf48c39c418e6b4fc998f801f9eac0170d78044cf552895b72c133e57c286fcafa8990d998989a1ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643941, "uuid": "ab5c1de4-d28c-42eb-9186-ca7e10f37320", "value": "6EF45BAC715469F1D36B1E7663CF1C0243652134643BEA0E8F6013FA5A67F172E39A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643941, "uuid": "4f1aa607-7b99-45bb-90c7-837a9c477095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643941, "uuid": "8c1ff556-bc14-4bd7-8bba-249b4a5c8ac4", "value": "12288:LF5l0wgkooLLoS60/K7yh0vw+nnRxrtHY6Dfd7ksPEri/c+C5S2uyhm:vl0wgkooLAvnxrZYMdzMuc/gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620643941, "uuid": "9fb46c04-028f-40e1-b703-d882f0cadb56", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620643941, "uuid": "e9f49139-5315-4160-8179-676706d0f077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643941, "uuid": "1e2f2883-a3a6-4b30-8548-4151a2e195a5", "value": "Sofidel 4402560174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6524ca82-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655365, "uuid": "c0055f77-e342-42e2-b2cb-cdfcc024b6be", "comment": "Malware payload (Dridex)", "value": "bdea89d3958514c372fa0851e436d330", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655365, "uuid": "b35a1a43-265e-4115-bd72-0b456ad59fe6", "comment": "Malware payload (Dridex)", "value": "8763c965e31361f1c01d0f463220231c20927aa2b98aad6626145f1163966424", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655365, "uuid": "bc20b790-8990-4a68-9e63-22377296a781", "comment": "Malware payload (Dridex)", "value": "e2aa52a22a9099d4fa8436aab5464a047562066e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655365, "uuid": "872b1e16-e287-41c5-954a-2af57c946b9c", "comment": "Malware payload (Dridex)", "value": "9dde91e7a53322b48c6cb59ceb02836efc1a5ab50a99d15ac51c273c0c56bf495828e91754db2200064d31e91fde17d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655365, "uuid": "95270bc1-c61e-4055-b5f8-eec948307554", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655365, "uuid": "a8dec69f-3b6d-4653-9e26-9efadc067ce6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655365, "uuid": "2169ab7d-d1e4-4be3-b170-f637070ed285", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655365, "uuid": "9172e8f9-525e-4969-9d6e-0adbd6d7abfa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655365, "uuid": "26737639-43ec-4338-b360-83b2692884d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655365, "uuid": "f640d50d-d2c9-448e-8f40-85adb45fe780", "value": "bdea89d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a917959-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620630893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630893, "uuid": "87269b44-4143-4ad5-bae9-89c7d417e556", "comment": "Malware payload (Formbook)", "value": "877bb5661fe79bb7f48cfb3ea54537a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630893, "uuid": "49257f1a-684e-4016-9831-7af71c309b79", "comment": "Malware payload (Formbook)", "value": "87935ff36515ecb6a4177c25ad1d11e8d2882aa1c3f369e719406f063a062517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630893, "uuid": "8547a0d7-7e3f-45e7-9224-dbba02450cda", "comment": "Malware payload (Formbook)", "value": "dd6b5263da3b4f1a42e89c2c1ade852098561c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630893, "uuid": "a80a0ae1-6270-4231-97c3-19b11fc66104", "comment": "Malware payload (Formbook)", "value": "5ab81ebf0ca1b0726b0f164651125b9eb9c80f1826952bdd3e03c0d25b2118802d7ef96568f821d91d0c4263425b25b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630893, "uuid": "338cee46-4caf-4e20-9ab7-e14333734075", "value": "CCC4166022A086E5D0C304710B94A526C597ACFFA9703552A3E2F636CDB958FE3F7DD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630893, "uuid": "4acf60ad-418e-4a09-825a-00d2b95bfbfa", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630893, "uuid": "0fe49527-5a4b-408e-b1fa-0f199da6d544", "value": "6144:q9X0G6+bQSvddNYJ+WxzNvDozGbRE1RbQnBYYwKc7:c0f+bQWdNYZZDoGbREfbsuXKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630893, "uuid": "587c020b-3117-43f8-92a5-49781158de72", "value": 579490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630893, "uuid": "fe6df1e5-13c9-409b-a05a-4660fe652f61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630893, "uuid": "c0339c7a-9501-40ac-a152-966a4dbe2fa0", "value": "INV74321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64da8c53-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648063, "uuid": "ca46e7bd-2506-4150-81b6-1828d0b3ff3b", "comment": "Malware payload (Dridex)", "value": "1a2e6c7cb7119978a90693737443b200", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648063, "uuid": "51004969-2585-457a-ad38-79ee5387534c", "comment": "Malware payload (Dridex)", "value": "8802653bc05dc888a08c1638d50faf85a0bb25b3ed6c413ff68a5e7799cf0c4c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648063, "uuid": "fd15a251-8c3e-48e8-88c3-5b2bc625c67b", "comment": "Malware payload (Dridex)", "value": "7952077ffc7fc38fa91548e04e6bbe79e8ebf4b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648063, "uuid": "83f5726f-fa4d-4323-bf59-22f7833e31b9", "comment": "Malware payload (Dridex)", "value": "4bfb1f161bc486d7b8f0d110a63ffe7b8f4082cc2612cde378155c9942f8871817b8e42ecbd16da6c601ae665204c5c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648063, "uuid": "adf3c38e-f9ed-4a43-ab25-98ddf3100fae", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648063, "uuid": "0ada13cf-815c-4b54-ae18-44e5f3f6e3e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648063, "uuid": "21ecd0b4-813a-4de4-94fe-f32ef46b4739", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648063, "uuid": "5b892346-a87a-4324-bca4-7b8181065e18", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648063, "uuid": "d079a98d-b1fd-4ebb-a3fb-a4ea0344c1d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648063, "uuid": "b390d2b5-f1e7-4589-bc36-9e27ccc35f15", "value": "1a2e6c7c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd5c026-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633821, "uuid": "a9c6b8a6-aa62-418e-ae1b-9a468cb49731", "comment": "Malware payload (Dridex)", "value": "4208582aa94932ac946df8cfc0eede73", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633821, "uuid": "972d8f70-c4f6-47f6-af9d-f2b31764bddc", "comment": "Malware payload (Dridex)", "value": "883e287be2c7f2aeae82ef6b5bd775058bc6af8e3104e23f427d67b80829e17b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633821, "uuid": "4edd6e28-f3c9-4c5f-b721-ff156fab7828", "comment": "Malware payload (Dridex)", "value": "6b8b8a66bb4f3e1024e61e46b5ccb27b68ad6509", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633821, "uuid": "bb648305-9cb2-411e-b394-b5da85aeda71", "comment": "Malware payload (Dridex)", "value": "611d7da01bde33765a9d6bd695f68b3f29baf8a10485dec8057fcbe670987ea662c99eaee302318f3faa00889050f6b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633821, "uuid": "b8d2307e-8b4b-4144-8a84-c53caf6f84eb", "value": "AEF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633821, "uuid": "df64e9cb-dd8a-427a-a517-007c7a10c0ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633821, "uuid": "83433a49-0b1f-4cca-a5a0-0fcc1ad3c10f", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633821, "uuid": "5db547e2-073f-4ff6-82d9-bb42967ecf59", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633821, "uuid": "5cf27c3a-bfc8-4008-b3bd-885856798a60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633821, "uuid": "7b69ff06-e908-46df-b363-9c22aaead29d", "value": "4208582a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ba1c61-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684057, "uuid": "eb875fce-9575-4c0c-8593-7b40c2bfcff6", "comment": "Malware payload (Dridex)", "value": "6ab5bf7a18ead304cf40a978178a4935", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684057, "uuid": "4f3d64bd-410b-42de-b4ff-1d09bdbcce06", "comment": "Malware payload (Dridex)", "value": "88b1e6816a454ebc1a6c762019367a66be4ef6c5f72d529a10a3071aaf260569", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684057, "uuid": "4aed412e-488a-41df-a192-fd6bbd8a997f", "comment": "Malware payload (Dridex)", "value": "a420fd671a04c063551ebdd8fd73448e6e8afa11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684057, "uuid": "c132dbdd-e939-4929-8d66-c2439a9b9125", "comment": "Malware payload (Dridex)", "value": "940b24601de2dc578a894b82b0f07d41a35d19db24c9d451334a941bce548c794cc846656d7b9ae8b9670e2707dd5835", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684057, "uuid": "6bd6ae8b-5011-4521-8cda-7a7746033407", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684057, "uuid": "fe74f100-6aaf-44cc-b306-2294eb334d93", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684057, "uuid": "e6775c51-693a-4bd4-98db-09fb8d505ea4", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684057, "uuid": "dee474c7-367d-4aa1-b5f3-e5a67688a63c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684057, "uuid": "2ae76d9b-e621-4be4-803a-dae119e81de9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684057, "uuid": "ef6d898b-d555-4cd4-bcf9-e44f29e7da7f", "value": "6ab5bf7a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca2f250-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658867, "uuid": "aa22ffb3-7d7c-47b8-a712-d4cbf257f3c5", "comment": "Malware payload (Dridex)", "value": "ec27371685b2b3a21491f75ec1a2283a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658867, "uuid": "014314ee-57a5-479c-84ca-1e536a71c560", "comment": "Malware payload (Dridex)", "value": "88b7aad908ca743c29deebf05644697c82abee45661c79c499f92c2a4fda1d00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658867, "uuid": "521e607f-e9b3-4d0c-a771-51b806e012ba", "comment": "Malware payload (Dridex)", "value": "109d68711ce6a14d38971c5298f5fc6222167776", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658867, "uuid": "f81e926d-20c9-488f-a8b5-e4dcd8dfb03a", "comment": "Malware payload (Dridex)", "value": "8c33112f58153c27014efd959b9e979e4e4f0106aab8026fe29ec1e545cc01419fbad7c4ee78ba152e04f5cf0abf6b9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658867, "uuid": "8cdcb679-8e7b-4376-9c0f-79de797ea6ae", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658867, "uuid": "ceb7ae75-bcdc-4289-a94e-ca2b88e5b422", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658867, "uuid": "e6bfaf4c-d8d8-40af-8a2b-5107a666793c", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658867, "uuid": "15e88054-aea2-4349-af40-a0e05b1613b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658867, "uuid": "d2c17063-a76c-4bc9-8043-8d74b0205951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658867, "uuid": "0e3476c3-4b87-4a11-867f-202fb440132e", "value": "ec273716_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715576a7-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662687, "uuid": "6018042e-6c0d-4d2d-89c2-07fbac84b907", "comment": "Malware payload (Dridex)", "value": "a80edaa7ab32e0c42f2b6f562ee09530", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662687, "uuid": "836ede86-218f-4146-aab9-10d2d316a595", "comment": "Malware payload (Dridex)", "value": "8901f42c87a14d4ae3c91e59c51a0a7fd856896881262b38d11c8c0924fd43a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662687, "uuid": "f63a1fe8-21cb-494e-9da1-db973b760233", "comment": "Malware payload (Dridex)", "value": "578a572245164bf6a8a8c8d38dc83ae699baecdf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662687, "uuid": "e1ac7139-3551-4f04-9dcc-be7411ab2f23", "comment": "Malware payload (Dridex)", "value": "8c1388c85bed9df226434c026ce22f9aab1e889e1ce6ff295875acc7da5f805999ae7972dd92df82aaab6da0baeb7fb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662687, "uuid": "188e5fdd-2aa5-43fd-a776-966d03f37876", "value": "39F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662687, "uuid": "8bf4169a-d357-4a63-8b12-1a802a522e58", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662687, "uuid": "46f9d476-6994-42c0-bfcc-cbf5748eb2bc", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662687, "uuid": "7be825f6-d2a9-4be2-b11d-9858d17e7ea1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662687, "uuid": "ddced162-445f-4dcf-887c-806bdeeece33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662687, "uuid": "0f46f19d-eb79-4db3-bc63-a4501e44321b", "value": "a80edaa7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53f5ef5-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620651231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "67725405-5778-4506-acad-2d642ab38786", "comment": "Malware payload (AveMariaRAT)", "value": "8aa01d41ca564e213d86b51609ee920f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "3d1cd451-6d7d-45f5-a457-5830a8672407", "comment": "Malware payload (AveMariaRAT)", "value": "8972f2edb2e2e1b345132939a5e6ed96dcc2096295cb34d5d71e9deef767f772", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "b3739833-1082-49e7-bc4d-31177a590bcf", "comment": "Malware payload (AveMariaRAT)", "value": "6273f696e89e258347671d2deffcfea89b36a3c6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651231, "uuid": "398e5566-74e8-463a-9f09-75c90dca84cd", "comment": "Malware payload (AveMariaRAT)", "value": "a41506e17add7fa65630ddeca277bd3e77a6525f0ccc39d253d859735cdd1bb4c0a654736f6b13ab24ceb2e6c8afc937", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "1cf1689d-01f8-4527-b0b0-e1ba32567fa2", "value": "44E56C707B81616FD9DBD2348749FB34B3AC8A755A690AB703D0AFC36E4D243902C75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "65ef33e0-6de7-473b-b3f2-682d2888c8ea", "value": "75e11dd3f761aa20181d07553cd7c75f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "82a52ddb-1d40-4cc2-9e3b-e4bb958efe12", "value": "49152:gqo77+RnOKyfqhZpP2EyTnbpSlQ3TweNXHBvoQezm:gqE7+RRyShZpP2EyzbpSlSTweNXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651231, "uuid": "43ccae49-0fb9-4760-b7d2-d9fbcc056550", "value": 3134976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651231, "uuid": "41c0c539-f477-4093-a88e-04df9d6582ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651231, "uuid": "d5aaff66-994e-4639-bff7-418a8cf13c78", "value": "Document - Banca Transilvania .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0000d9-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637309, "uuid": "8377ec66-5117-4eb1-8b93-660ea0831592", "comment": "Malware payload (Dridex)", "value": "81d579970d998fc61b22fdb556eee4cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637309, "uuid": "8ff20cf0-0205-40f9-97ba-4bbb70f46e0b", "comment": "Malware payload (Dridex)", "value": "89c1618d567b41016f4955080983e90a69bf817a55dd1f546bfa6f23bc92e16b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637309, "uuid": "319eaabe-c6d5-4b5d-ba43-02a5a6246a81", "comment": "Malware payload (Dridex)", "value": "6e15853800c67c18d880501adf17a4562bf74566", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637309, "uuid": "9d8f235d-b91f-4c53-8a2f-54bd80b34269", "comment": "Malware payload (Dridex)", "value": "3cb7f1a57f1e98f3230ad083ff386c9f9c2c49a4657ccb4ec15fb8ca69a85b5b79072a7642dc0558ba6e7d7a0dd4a01f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637309, "uuid": "d3c7962f-0eee-41e4-a088-5bb49aa51cd7", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637309, "uuid": "61c07d96-82d8-4636-8e20-c906c508daca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637309, "uuid": "80c6500b-496e-463a-afdc-3c064cb63529", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637309, "uuid": "12f5bd2b-2198-46f1-8af1-f63542ad257a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637309, "uuid": "62a38ce0-0e2f-4a42-abe3-bdeff0830ded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637309, "uuid": "93659009-9437-4ae7-84c3-41f53f5d281c", "value": "81d57997_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677a93a9-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1620657946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657946, "uuid": "fa5cb21d-9603-4116-99db-3515f62eb8f0", "comment": "Malware payload (CryptBot)", "value": "6a37fa585bfd1ac9e6ca94ce01626a58", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657946, "uuid": "4ec3fc2d-9823-4bbe-96d0-9300facaacff", "comment": "Malware payload (CryptBot)", "value": "8a9ed010aa3db217f81dfa4d928863eef5cac1165dab6c03258948b8ef019435", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657946, "uuid": "6351f031-d2dd-4a2e-82c1-a01ccf9d77fc", "comment": "Malware payload (CryptBot)", "value": "668ffc4c0524999211f75a63f6f875c4c20d4a98", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657946, "uuid": "01076f8d-56d4-4617-a1a5-c0a10fd061e2", "comment": "Malware payload (CryptBot)", "value": "96877dfc36f52de9fae8cbaf83a0d24bc8db9dc66ecae7746fe81a042c108b52d1d234c67c5a7727d905f5d95e1fa861", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657946, "uuid": "3990d31f-13a6-4cae-bb88-8c2201f3b557", "value": "9A849E30A680C036F5B721F889BA977CA53D7E915B24B1CB52D427EE16346E4BC30E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657946, "uuid": "9a3fc504-ffa5-4f27-adea-30e43b29c87f", "value": "178661358a4d867acf7b5af89a395103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657946, "uuid": "27a7e5a4-2120-469e-a24b-c54a4529db84", "value": "6144:7SWHQFmgeqO1/4kjckQHafCQWQAusuMAvYeGkRabcUyI2sazgnZaN8:THQFmgeqOlwkea6rubgeGkucUyIRwgZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657946, "uuid": "8f725be0-4ed0-434b-b639-1a4ee83a4a95", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657946, "uuid": "c52e7633-6372-4576-81a9-af8ddb36f57b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657946, "uuid": "16d5f7aa-9942-4bec-bfe0-9d8cfa08b24e", "value": "6A37FA585BFD1AC9E6CA94CE01626A58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446a612f-b1dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620684945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684945, "uuid": "f82566b3-e5b4-452a-af8c-3552b735cb17", "comment": "Malware payload (ArkeiStealer)", "value": "98a4eb2d84f8cf5ef10a8a8af478aff8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684945, "uuid": "694f73d5-a73a-438f-9582-5fda6466615d", "comment": "Malware payload (ArkeiStealer)", "value": "8aa1689d6acacf9f2eb2603db52dc5908e1ec5d80000deec13e2e038c2883413", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684945, "uuid": "d7c93010-7477-4c6f-a047-5ee8c62921ff", "comment": "Malware payload (ArkeiStealer)", "value": "b88ba20c317e1ca600d918d63ae218b2a96ea6ad", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684945, "uuid": "a46242a2-970e-4a55-bf32-80cca296df0e", "comment": "Malware payload (ArkeiStealer)", "value": "33fce759ce03dfab4dc518d9176acc79fb0be592486feb25250d6d0233b096705195e0e2cdc342f97a35c5bf0892bbe9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684945, "uuid": "646c2a14-1661-44fd-b214-e5a990335dd5", "value": "3A76333ED1958075E2360134CA87D3B3F578B940BF9E548F0BDBAE2A4EA9344276417B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684945, "uuid": "ca78827c-461c-45f1-b401-581053ae59f0", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684945, "uuid": "ab26f74f-ccb6-45bc-bf5f-baa58b06994f", "value": "196608:it4c/en7NN/0TbxqyEgmhr+JBxtLwCULB04Y:JsTbxOgmhr+J7TQZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684945, "uuid": "d898ce56-0765-46c5-b9f4-8b9a419dd259", "value": 7228719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684945, "uuid": "877cbf9a-2a79-49bd-ac0e-117629e85d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684945, "uuid": "c9238cd4-0986-4fc8-89d9-4590f892a90e", "value": "98A4EB2D84F8CF5EF10A8A8AF478AFF8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ded9ddf-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644562, "uuid": "54c3d5ac-c39e-4ad7-a4d1-b0749d8bdc1a", "comment": "Malware payload (Dridex)", "value": "10d6f4980e424ab69be8e87a50a77098", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644562, "uuid": "8354ba4a-eabc-4adc-a8a5-e5e965e1c625", "comment": "Malware payload (Dridex)", "value": "8b345b760c285f3606428cf47a02a8fd0e51ca95c318876f75c9e3598617d6ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644562, "uuid": "24ecfe78-eae0-4157-aba1-7cd5d0d9f0f0", "comment": "Malware payload (Dridex)", "value": "74bcf22b49cd48ced03dba3457364deddca14f50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644562, "uuid": "fa16d33a-8f20-42fd-a476-fdc3bc23322d", "comment": "Malware payload (Dridex)", "value": "79e6d0457326ada98d8b6330a419c03bf3617f68e9b53865f87555175540a53c082b6fa16096b2bdb914d1a9c130fd10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644562, "uuid": "87a43204-b4b2-4944-82b8-a922f064f243", "value": "10F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644562, "uuid": "85f2d9c5-d08f-40ac-a624-188bb2e21597", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644562, "uuid": "3338873c-78e8-40fe-bc2d-8ba569fbcd95", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644562, "uuid": "3a58bd34-1630-40a9-942d-3f31fb51e6d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644562, "uuid": "85992ccf-b07d-41bd-9e27-f2674842b99f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644562, "uuid": "ccf9e897-3838-49a5-83cd-40406b6f3650", "value": "10d6f498_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b3c5f7-b150-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624555, "uuid": "eae28ba3-d9de-4620-924a-d8afd5de9e3c", "comment": "Malware payload (AgentTesla)", "value": "96f3811f152e02afb608785714c0a280", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624555, "uuid": "63162687-5f11-4971-bc13-ed1f0c78c3f3", "comment": "Malware payload (AgentTesla)", "value": "8b4259a23bb21522d344a17dd5cd24aeecadd275f4d587b44e2b55595381c504", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624555, "uuid": "01679383-b027-4e4c-92e8-0859ca9d107d", "comment": "Malware payload (AgentTesla)", "value": "080a471ee86b031e4a737d33e684feac12034fef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624555, "uuid": "f60a6bb8-7b4d-43ea-b18b-d6e334889e54", "comment": "Malware payload (AgentTesla)", "value": "7829948cd0ff2d15c3399cdaa0ccb782f3bc65dd445fbdbc1e1c163ccb28aa2e994fa0021f5df92dcd967c218f510b93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624555, "uuid": "260a35a0-d9ab-4890-9997-79c3ff3e1ee1", "value": "504518AC3140B4EEC6578C339BDE5C20922025BA932BC60B5313177D9A5FE53AF395DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624555, "uuid": "2485a59b-7311-4488-8d38-4b1cbd6ce190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624555, "uuid": "f8551371-76b2-454f-afee-5dc297998ed4", "value": "24576:oYH4oLAEgPZfdbTvcedWEtEV3gBJ3Bo5dH:o2gPXbTbw7yJu5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624555, "uuid": "b53e873c-2d5a-463c-9cd3-b1f2470be2f2", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624555, "uuid": "68448994-b8de-4072-b5db-3edd3695f421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624555, "uuid": "6e9b98b5-3378-42c2-8125-7757217c1d4d", "value": "LPO-6809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a139fe-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649024, "uuid": "6a1ed560-190b-45c5-8982-b0324ad19856", "comment": "Malware payload (AgentTesla)", "value": "0b16b6ee9d61d56d2d718eb58c0bb027", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649024, "uuid": "d771917d-7614-4879-80c1-f28aaa26a1b9", "comment": "Malware payload (AgentTesla)", "value": "8b48cf42d80759394799141684dc71d694e24344ade85837ba018c93df81494d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649024, "uuid": "3003b1cb-2afb-413e-9664-9f76046391ae", "comment": "Malware payload (AgentTesla)", "value": "340fcf6783616c4b0498461c06c8084bfbd37379", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649024, "uuid": "251e383f-4087-4e5e-831f-5baa4b3b1360", "comment": "Malware payload (AgentTesla)", "value": "31b620e2a1cf86d5cae367e8fbffe694a8f22d816eeffe5bb4b7be5a3f5099b095251c527196aa7b7f0628e4cf98f069", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649024, "uuid": "564d1609-5714-4f0b-8554-edb43f6b5d83", "value": "AC157BA5B7417B9AD367CF7AA95303D483F0C4236232F68F6DE42AD50704B4ADA6F481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649024, "uuid": "e0a4a783-e162-4281-97fb-b3e3efddbe3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649024, "uuid": "c038f2ce-4ddd-4ccc-bd7f-0d8bd9080c9c", "value": "24576:kuvuhjsU0VCyWOGV2nlt13AmYkf3Sq+KV:yjsHnlglgSDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649024, "uuid": "b94a6fed-da48-4c99-85da-09867ecef9e2", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649024, "uuid": "8010a4e4-bfa2-4dea-860b-815924dc4309", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649024, "uuid": "6d4aea5a-9736-47f4-9e3c-46a5da6bb6f7", "value": "contract_documents_993454938_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51cbb7e-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620659043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659043, "uuid": "6f1ddf31-7efc-48d5-b5bd-853ce364e1b9", "comment": "Malware payload (Dridex)", "value": "614b30d9f155648b35aa3c8247277374", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659043, "uuid": "2bd16fd1-5e77-4741-af0f-c39d218902a2", "comment": "Malware payload (Dridex)", "value": "8b9696faf6891adb7850e25d1efc5c345870aa1bce0c2c15c1155a567bc5c1d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659043, "uuid": "21076796-11a7-47c5-b16d-ea0f4aa63c1d", "comment": "Malware payload (Dridex)", "value": "77da66bec116f8322307b76d6fc895d2084bfe02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659043, "uuid": "4831daa3-8d86-4b03-a910-c2e8f38721fd", "comment": "Malware payload (Dridex)", "value": "7df8ee7601ea21a3eef6444c4305a3f0869ad030dd1650b6cd86b85bf553a12b6fe140db126d84adb9c9083102916554", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659043, "uuid": "f5cb7751-7d14-4a28-9b92-5a8242e265ce", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659043, "uuid": "c0dda40c-5f2c-4a1b-9066-18e52f84ceef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659043, "uuid": "6cfd078a-6898-4a17-8652-6c892d274768", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620659043, "uuid": "7a33a461-a88b-4df7-a5ec-16998137dd19", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620659043, "uuid": "60345b2e-22d7-488a-b2e8-8bb92670b2f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659043, "uuid": "1997a7ed-8ecb-49f7-83bb-d8d6aa426fac", "value": "614b30d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa027eb5-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687693, "uuid": "767e9088-0b9a-40a2-9bed-35dc5b495fd5", "comment": "Malware payload (Dridex)", "value": "24e04651ddca9234195d307bde94a5ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687693, "uuid": "431438e3-6f66-405f-87f8-4880cc013e20", "comment": "Malware payload (Dridex)", "value": "8b970932b766eab4a36bffcf92e85982452252c8c2fb3fc8b57ad81a3336451f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687693, "uuid": "d25f5939-fde6-48fc-a5b0-93cf7403f1aa", "comment": "Malware payload (Dridex)", "value": "8fe8e01d03266c484fbb7cc8d5434ddee815e94c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687693, "uuid": "c46ce124-1c96-4fa3-a0d5-c4d5b8b5052e", "comment": "Malware payload (Dridex)", "value": "251fa4dcb28316f6c0a27dff6b6c06e2e874df91fc3c0d3ead63d971167a700c0bfe0c794339cbae0d7c6f8528442d2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687693, "uuid": "fd75ce9b-21fc-4fa7-9389-3e46a7c1b4fe", "value": "77F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687693, "uuid": "0e40f09b-70da-41b6-b576-2c219137eb34", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687693, "uuid": "3c458c6c-de9a-4362-ac9c-ee90eb76fffb", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687693, "uuid": "c549f52f-f9a6-4394-b497-eea8792ee2e1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687693, "uuid": "9cc8cf11-cd78-4ded-bd31-2bc553b47649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687693, "uuid": "d6ac8b5d-c231-4495-9d0f-6bb5889cd273", "value": "24e04651_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae95f6a-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620659025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659025, "uuid": "bb18fa5b-d9c2-4cb4-90ab-7429b6c3e0e0", "comment": "Malware payload (Loki)", "value": "bae050e64f4fa193c944863c568873fb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659025, "uuid": "25f09432-e806-4bd9-baa2-1044a26fa89f", "comment": "Malware payload (Loki)", "value": "8bcb7a8a5ec451753b7e49d1b58b68ec07df0de5a4a24e5bfa29adc53d21d558", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659025, "uuid": "fd3eeccc-2073-4976-ac35-666ab397df8f", "comment": "Malware payload (Loki)", "value": "8d15497f95c21c6cc62054e6dfda4cf93372fa14", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620659025, "uuid": "70ab62a5-321b-41c4-982d-5390d868d338", "comment": "Malware payload (Loki)", "value": "229e1d20baad2230808c903f49596eddd19885dea863d9e00919fb8bec83749d7b6b3ec42a7581f5c31fa6d9e91ce1d3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659025, "uuid": "2e4e33ee-97be-431e-95c7-fc9925e04b1f", "value": "7A9716176EC0E948F4E81A3F85FC50627FABDC42580ADFDA05E237AD18F5665F420A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659025, "uuid": "561fc993-08d2-46d2-99e2-23f213478ca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659025, "uuid": "648f11f0-321b-4aeb-8115-cc1a344c34e0", "value": "12288:Bzu/4GSKBL7hVLdrFijq555t/uFRoXnRkuhrWDFcruLrhwMpMUSh:BzriBT0855tBXRkuRCcruZvpuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620659025, "uuid": "2eb6764c-52ec-4d50-8714-da35d982b1df", "value": 39845888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620659025, "uuid": "58a5607d-869d-4e3c-919d-c642519885db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620659025, "uuid": "7fffde14-fef2-4809-9b68-ee3111b88e60", "value": "bae050e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71eb8a0a-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648085, "uuid": "7619cc09-e909-4b68-b52f-f21e8eeaac3b", "comment": "Malware payload (Dridex)", "value": "e25a18c7f9cee759eeaeec394dd51671", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648085, "uuid": "5bb56e37-e72c-47b6-8ea3-14b6ed970a6e", "comment": "Malware payload (Dridex)", "value": "8bd3c4fb575ccadac3256a1010508ea8f262e1c48375130dc6133a7f92898f43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648085, "uuid": "5d243ac7-75c4-4089-b239-e0eb7ec25fab", "comment": "Malware payload (Dridex)", "value": "e847861204858e3f1f9e5f1ba9c5c317a10a8bf7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648085, "uuid": "8c5a21a4-194c-4da4-a589-bc1b017a281e", "comment": "Malware payload (Dridex)", "value": "cb03c756a9dc70e9cbce6d6ae8403e973823f3853ca9b948c905e72f3f45952c9e0accbdc45e443f99253d495dc2b937", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648085, "uuid": "3de5a37b-c4eb-4dd1-8718-4596d50871de", "value": "2AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648085, "uuid": "20f53d85-978b-487b-9b85-b27d9284acd6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648085, "uuid": "320a319b-ea67-4c72-b4a2-c8f22b6bcafe", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648085, "uuid": "b6b8c41a-d4c7-4c39-a5d2-782275a88b55", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648085, "uuid": "3c2c0d81-7360-4cad-b2f3-8f41646befec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648085, "uuid": "c27faf6f-3f92-4f45-a43b-2a2c7b4c57b0", "value": "e25a18c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df17bf74-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649127, "uuid": "be79daf4-3410-4d0e-8c67-2137c1e80e8e", "comment": "Malware payload (AgentTesla)", "value": "b112fd5b230db0da9f1d2f948825a2f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649127, "uuid": "d689e959-f24c-45f3-b2b5-d124c93b9136", "comment": "Malware payload (AgentTesla)", "value": "8c73fc72cde74af2d7d3c1720c11fd1e78177cc776644b11b8cc39e71d079572", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649127, "uuid": "e8014f02-f5c3-4886-90ab-54503f66800e", "comment": "Malware payload (AgentTesla)", "value": "139e33b2a257ca40f494bb689086fcd8b0853cce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649127, "uuid": "373bcb1a-5f58-4cfb-a00f-061b2b461cf5", "comment": "Malware payload (AgentTesla)", "value": "53f355543a81ca3fabfb76938d6cc4596b43dc8d971e9e91d129ea0ea8bcd8b4752ba9e5761bb3b8cd1a21e1f3b52046", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649127, "uuid": "2fb0d971-7e48-4d07-8a7c-b1d7d801bd38", "value": "BD05C06037D4BE28E1BF473788B0858093FEBE07D363C56E68E9714E6972B499261713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649127, "uuid": "b5883fbb-4e74-485d-9144-ddd19b1989aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649127, "uuid": "254fc441-e7f4-47cf-bf48-fa92876ab809", "value": "24576:2ahl2hhhWiTuT4SPw6Y9thcMlD+4JX6f:3VT4SPw6YrhcMI4JX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649127, "uuid": "73d8a640-ef41-44fb-8ea4-328436fd2f7a", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649127, "uuid": "b1be737b-1099-452a-aad0-a73d38afc765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649127, "uuid": "dfbfaf8c-43b0-43e1-adca-7e930f57a0a4", "value": "NEW_ORDER_LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e336b36-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620669554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669554, "uuid": "b9de8604-617a-41b8-99c1-b83c458c21c6", "comment": "Malware payload (AgentTesla)", "value": "8cedabf7bcbbf4466c0698bbcc774315", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669554, "uuid": "703b0dcb-caac-4dbe-95b1-f86eed926930", "comment": "Malware payload (AgentTesla)", "value": "8d33ac3a6ed3e4e8608757bf57424e201c94f5418eb24d7a921fc9116d595c88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669554, "uuid": "6fab3d12-4f7d-4761-b577-455d6e330ab0", "comment": "Malware payload (AgentTesla)", "value": "6d140236f87bb24ad472eeac1cde6bcdb7863062", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669554, "uuid": "c2ee7dbc-d3e4-43ce-98dd-7659a4ec806e", "comment": "Malware payload (AgentTesla)", "value": "b8ba380b1030c0bf2c3d686d187fc2497975e60c6eab435b5ecc92b54e4b0a188a93bc7caf2e53b77fd0f68be579d635", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669554, "uuid": "b828a784-d755-44db-b01d-537dfc9d45eb", "value": "76A412046FC4A305DAF36D78EDD0CD753B217F44A812D9CB785B724A9BB430496B8D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669554, "uuid": "5216a02d-1849-43b5-a901-077cd7772548", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669554, "uuid": "8a524d7c-4c24-4829-b502-a89442f23ad7", "value": "6144:GIVqv8/tMw7Vns3no7/MXMA59C/2h4T3wn6Fr4Bxnt1zE9IYBG7o6E4vUMu/ssTm:BHFMw7Y9MA59CyMAn08BxnDQbcvUP5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669554, "uuid": "f3e58a1b-550c-4f14-adc6-40dc16f60b01", "value": 478008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669554, "uuid": "94e979a3-1168-4784-b65d-afce328cc1e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669554, "uuid": "c41e1648-a9f1-468a-bb1b-ad0fff938ffb", "value": "SecuriteInfo.com.Trojan.GenericKD.36873958.16703.16238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42851bc-b122-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620604924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620604924, "uuid": "c9bf3d64-eea8-43fc-8ed3-8d2d3ef3279c", "comment": "Malware payload (Dridex)", "value": "14710cadd8b6de905920e9f52f46b998", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620604924, "uuid": "532aa2ec-6708-4534-a89d-2a456ff3fb6c", "comment": "Malware payload (Dridex)", "value": "8d637e406142724564c6a89b878df24315c6c865dce7235d357da26649105ab1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620604924, "uuid": "db156a82-1814-4fe4-bb5e-aae4f2f0c2bc", "comment": "Malware payload (Dridex)", "value": "f43d8410b68717318bbec81be696377af9252bd3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620604924, "uuid": "12db37e2-5eb5-4dbe-b1cc-66901b4275ae", "comment": "Malware payload (Dridex)", "value": "a286da68f6a46b0b561cebf9b043c7dce43fe9a074e9ef52d79a40697d5936b6bc5bc2ff9e72646f821a30e6f24ce306", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620604924, "uuid": "9dac358f-ddb7-468d-b13b-1cffd719bf05", "value": "FBF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620604924, "uuid": "f0119616-14b0-41a3-8b21-07210ed7cc3c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620604924, "uuid": "7caeaeba-c526-458a-949b-c0f21396e74d", "value": "3072:JA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:J3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620604924, "uuid": "43fe7e58-39b2-4072-8e23-4027b575466d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620604924, "uuid": "4a21af87-ceb0-4845-bf90-2bdc457f377b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620604924, "uuid": "9418ebea-2d04-429d-ba2e-180bb64c2697", "value": "14710cad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508d298e-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628272, "uuid": "3ebd20a9-a66e-41ce-b1fe-1a9c0879d413", "comment": "Malware payload (AgentTesla)", "value": "c7bad1cde5a30aa2b665c62a1ebe3548", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628272, "uuid": "ad740985-ccb0-484f-a2f6-bdc4416cec01", "comment": "Malware payload (AgentTesla)", "value": "8d6eb0ea0a37d5573bd7a306d12837a74dd2e68a597b42516784b3f2d23743e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628272, "uuid": "289f2149-a667-496e-b106-613732f16fe3", "comment": "Malware payload (AgentTesla)", "value": "e4cb443f698d32c572274f379e52e2c8e6296846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628272, "uuid": "9e0b57b1-bd5b-4899-938d-acffa454692f", "comment": "Malware payload (AgentTesla)", "value": "2fe0a4b7fbcceff0232d4ed673e876cf9935f7367363575fff683ca41297dfccda119d349689b8bc5d4843d8e1e6261d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628272, "uuid": "875bdee1-71bb-4cbd-9fd4-23c312575f58", "value": "EF53D05FE050BC65C4F7BCBD8340D0DA814D6C49A05A3E077288ED4D699A2E673EE3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628272, "uuid": "1aa196eb-6117-4329-9f06-3fc5e8cba38c", "value": "1536:w0uXOQOTO19mChPUH6I/YrShnDkY3QNaX1cl+GkCI:wRJWHgNMM+GA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628272, "uuid": "60834612-5a58-4c96-bab3-38af0948c367", "value": 61998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628272, "uuid": "ff9e61fd-c512-4294-8a94-6daf5a1265c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628272, "uuid": "9ec607bb-eac6-4b7e-9b6b-c8242b3bf34f", "value": "Purchase Order-1245102021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce02ff8-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669793, "uuid": "09457b5e-f179-4c48-9f41-0628115ff81a", "comment": "Malware payload (Dridex)", "value": "0cb67d58aac996ce2f0e36783e2c2417", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669793, "uuid": "b7f800a6-1134-4005-bd5b-2b105bf2f6e4", "comment": "Malware payload (Dridex)", "value": "8d7fe000d738901e5cbf869e95bc3d922b28d076dba83b495ffce7e53b3b82ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669793, "uuid": "e72f6180-5ad6-45e7-b9cc-783d09eb9e22", "comment": "Malware payload (Dridex)", "value": "07144911da3f59445ce2a9efa4e928ae1c8cb351", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669793, "uuid": "45124bc0-06df-4788-8350-9e3edb97c3f7", "comment": "Malware payload (Dridex)", "value": "e602e1f33811bf6485863c141726b8ebd8855544b67ba8bc3515afa2391be3bc28ee57ed12dd9eb2f8c48ab4cdad66c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669793, "uuid": "f6214eca-6f30-4576-91ec-3a106e3ebc59", "value": "5EF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669793, "uuid": "48f07d30-a1c6-4f6a-a9c8-ea0a75650746", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669793, "uuid": "65a4d3cc-27ea-459d-bf8e-9e05bef372c6", "value": "3072:g/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:SbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669793, "uuid": "b8729d6c-6cc8-4395-b55c-1b79af43e3da", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669793, "uuid": "a36f0e75-2cfa-45ee-b10a-7ba959242693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669793, "uuid": "3639b746-8139-4a42-bdf4-98a163091816", "value": "0cb67d58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1164989e-b153-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620625589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625589, "uuid": "1946aa9b-9ec1-442b-8e62-f73e1eb7510a", "comment": "Malware payload (Formbook)", "value": "8a64a399bf5789187d97088115174413", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625589, "uuid": "443a6e1e-7cbd-4456-a083-7c95af5f8b7c", "comment": "Malware payload (Formbook)", "value": "8dbf5672166ca668a505b52c355f0281257f657d7adb71ff3a12d6389cec2f3c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625589, "uuid": "376c1cfd-9a8e-4adc-99a6-51111e3b45ab", "comment": "Malware payload (Formbook)", "value": "a1f28ba3892dbc4508912804305a9264d05b1646", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625589, "uuid": "3c1331eb-af0f-492d-ad35-7c721edda3f1", "comment": "Malware payload (Formbook)", "value": "27914dddad409b58b26cded066d2486ca48e8c82d2d3d75bfb8ba67f88571ba4d7b1a1fcba95b7e060fd215955fb44f9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625589, "uuid": "6866f30e-2f91-4805-ba2d-521ecb710491", "value": "996523B0EC871F33D5D74A394A279EB5312EFF415A089EC62A5D335E647B2310847B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625589, "uuid": "b22aab21-62cb-4a4c-b1a0-b923a8669104", "value": "24576:A6rlauTlJpC2vFdMy9RYeor2Jlqx83S2F+Bqoyh5vjSm4X27v7ZGa9ciCPN:Bv51Fb9RYeTaCS2FCqRSm4G7v1GatC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625589, "uuid": "edfee214-776a-451a-9620-48fcf534470b", "value": 1478144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625589, "uuid": "f3d892fe-9973-4207-8680-b17033525072", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625589, "uuid": "fd77a328-58a3-485f-ae19-f398e5f378ad", "value": "new order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9d7b4d-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620649987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649987, "uuid": "093afa53-5db4-4853-92e5-b50bec96c456", "comment": "Malware payload (Formbook)", "value": "a02437aa430c0ca2847115f6ca17d0a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649987, "uuid": "a734023a-312a-4500-a0e2-815dba9b43bb", "comment": "Malware payload (Formbook)", "value": "8df52ba27a44fa2964a2fe9de4894aefa47b3c09abaeeb9602bde6d96926136e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649987, "uuid": "26b2bc48-b5d5-423f-ae1c-1fc8930c9466", "comment": "Malware payload (Formbook)", "value": "1fa9f7f2bae891e8e06e73bd01abf18e839829a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649987, "uuid": "68aa4e09-cfe5-4e47-b509-9c13b2a5cb0b", "comment": "Malware payload (Formbook)", "value": "ca5af6e4b51380be52d2bcce019df1ae2ab2178b5cd1c5f65ad35062329d0dd228b2bbc203f90225f34a3aae1b2cc222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649987, "uuid": "73313cbc-7b40-457f-89d6-a0096f8e0245", "value": "C0E4DF2C7BE48A45D6BE57BC9470113093F9B1069A1BFB5D4EA060FC2CBB720EA1195F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649987, "uuid": "a1554273-aa50-427a-8d81-6fc606f7b58a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649987, "uuid": "7d6f0a6d-6f55-4dd6-b57e-111e7e61b630", "value": "12288:6Lfsw+uvR2/V4BFNbegeEbr/0Ow2Sd+bP+Ta40RCWtUjZi8FjQ:obZEV8NbyC/jxPJKtiYjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649987, "uuid": "bc2fd502-a78d-4207-97d1-916b247ac382", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649987, "uuid": "5ed8b05f-5a14-4ecf-9693-88a635fa29f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649987, "uuid": "7d3c3444-f230-4307-9a13-c63405505cd3", "value": "New Orders 122020 2 x 40 HQ.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3702f759-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655288, "uuid": "fe3b67fc-1506-4319-bb8f-fec4a04c80a2", "comment": "Malware payload (Dridex)", "value": "f9957a6b0c5d1ca0d208eab1e3873ec6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655288, "uuid": "0898bd43-758a-437b-b998-5f8b79f28322", "comment": "Malware payload (Dridex)", "value": "8e03e7f93cdb4227854cadc83019b4bfcf0d6b99736ba2a5d7d66733ca90a6fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655288, "uuid": "2613bd18-f9a8-405c-a2b1-99a212407204", "comment": "Malware payload (Dridex)", "value": "511956b88cca428e0bd600fec5feb176f97aa163", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655288, "uuid": "dae71bf1-5a96-41d7-a0a0-fbe3594eb3e5", "comment": "Malware payload (Dridex)", "value": "586cd27cac08ae2223b403be1fb365f8015bb5d2eeded295383fb12ad63a2ea67eddef508f3275c5247f863cb28f06df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655288, "uuid": "3a907d1e-9bdd-48d0-8d74-c82e4e0e68e7", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655288, "uuid": "7059965b-d984-46db-8317-5ef85ea62c49", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655288, "uuid": "bd31db0f-0deb-481a-9bd6-f4a362a69666", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655288, "uuid": "ce64b8d3-2faa-4ef7-ac9b-42bbd3ceb20b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655288, "uuid": "5e3a9229-1fa5-4122-97f0-1d4d280b67ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655288, "uuid": "c5505897-bef7-4920-adbd-e107648efeb4", "value": "f9957a6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ad6f56-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620670133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670133, "uuid": "28b8c806-125d-40bf-b7e0-56145f33695f", "comment": "Malware payload (Dridex)", "value": "ef6e4275ccfcd85e9e2ebd09b3c43797", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670133, "uuid": "1ce5f50b-eb31-4a86-a796-76e7981f5511", "comment": "Malware payload (Dridex)", "value": "8e192b087e6c2a0bfb538d860d3618cc7b22c2cae8bad8ab94376da017128578", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670133, "uuid": "5017ccef-b523-4355-867c-a57ff95b4301", "comment": "Malware payload (Dridex)", "value": "5bdfa1b8fd44e92a309af0d2438f5c15d80038f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620670133, "uuid": "8f3d3dd5-52c0-45f1-8649-0cedacb8365e", "comment": "Malware payload (Dridex)", "value": "3c65b53437dfd9b17586ea94e1c740de31b25a8607990532cdf6f3c9810539fd6c873374c65050e0e3ebc8ed05872195", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670133, "uuid": "311f943b-8566-40c7-95b6-d4aacf74916e", "value": "7474235E0EBAEF32C3A11334871A8F01247723B641F21A0353B9B26D8B71F559D7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670133, "uuid": "4f370a0a-945f-4a9f-b977-eb3f234e6f44", "value": "6144:ofHicx6Zz5sCQRhd6Amw0wSBLPLab3uPcGOVGnALb9rMnwYEz+uKOIcL:ovic6Bw0wS5W8psZLb9rM4z+uKOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620670133, "uuid": "036e48de-80ac-471a-8ad0-bd7ec1598737", "value": 340588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620670133, "uuid": "009473f1-22c2-484f-8ee1-63c89e90a4f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620670133, "uuid": "746d6151-a1ee-4c4e-9afa-00b04387f7b0", "value": "scan of document 8030.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71930c64-b17e-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620644219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644219, "uuid": "7fa90684-0b7a-4b5d-bae6-dae771499937", "comment": "Malware payload (SnakeKeylogger)", "value": "dcf2a1486856d9ea6687c0b128552b78", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644219, "uuid": "ea3a9cbf-42b8-4654-be41-ee1dff0f92af", "comment": "Malware payload (SnakeKeylogger)", "value": "8eff78d6fcb3902acc848308a2bec0e803c6c4cca746e99d8c72a11f145251a3", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644219, "uuid": "acc4e5a2-62ac-4cfd-a63a-fe6365e03175", "comment": "Malware payload (SnakeKeylogger)", "value": "7f81d4c55c46a50c4e492c94d01e0aa521c788b0", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644219, "uuid": "baf8aa57-d9ee-4005-895a-b78a321b09a5", "comment": "Malware payload (SnakeKeylogger)", "value": "5a43c76d6a73b2abc1bae2c2591f246f10a8a2047dd4cee9b5920f6b7a5e57959a8ebbec50799578c40aef7847c8b4d5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644219, "uuid": "193066f0-16e8-4c3b-aa39-4bb4eb54f5f2", "value": "FBC423DB4514F263C6EE3F1AD8CA30735CB6C69D8444DC3002B2E4529A6A73B9939F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644219, "uuid": "2cd134c7-917a-4934-97a0-91a2f47d54c9", "value": "12288:I5qPNCoVjGunr0kE7/QugDYdiholEhd3LJqDScthTVWFaTDkQBIzmS:DPNCoVjxr0/WDUxlk59raZuuDvIaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644219, "uuid": "a09eea31-917d-4340-8495-371360517e33", "value": 562740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644219, "uuid": "655986ea-77a8-40f9-8148-c20a7ab42abc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644219, "uuid": "9c6f114c-edbe-41b2-82d2-c7e78c19301a", "value": "LPO-6809.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b53e0f-b163-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620632596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632596, "uuid": "874be7d2-86f4-445f-94a2-26440057fe6b", "comment": "Malware payload (NanoCore)", "value": "a79192808f19e3f4b4ed7d48983684f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632596, "uuid": "455c4947-d119-4175-842c-98ddd05f791c", "comment": "Malware payload (NanoCore)", "value": "8f4ec0f164657fae38d4555a0f710ddc67b9e421ac0d7c82491c30a51895031d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632596, "uuid": "baa1a769-4d9e-43f2-bf5c-efb78d9ae969", "comment": "Malware payload (NanoCore)", "value": "668acc37f1aadcbea568acf4055d00ced32ecf3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632596, "uuid": "62c7792a-8ce5-4fc2-af7d-0ee289dc8a14", "comment": "Malware payload (NanoCore)", "value": "ea0bf49b3cc62536c22a920d071ba9dc085e2fcec44b4d28150063e0e10cf7cb48f77309baf9f0dc36af8cda2bc74829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632596, "uuid": "e414ec99-5857-455d-9380-b6837bde7793", "value": "FB251202BAC288B2D57318314A356B15AD3DBC201F25DBAFA7E04C7EDE751919634B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632596, "uuid": "e342fe7a-4a35-45cf-8d10-d679d50c94b8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632596, "uuid": "eab35e1c-477b-46ad-ad39-cb87e43d56b9", "value": "24576:BAOcZpJO36E6Pe7+UlKPEqU65ulTqo9/s0Y5a+nzQ:bRf627+daz9002/nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632596, "uuid": "712787b7-4393-47c5-bf3d-c073a45491d5", "value": 1037491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632596, "uuid": "d8b9ae5f-c848-4759-b404-25dbb517795e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632596, "uuid": "476a8c4a-b556-4f30-8c84-5d9b096e0b02", "value": "a79192808f19e3f4b4ed7d48983684f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9856fdaf-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650726, "uuid": "619341ec-208d-4580-9b04-86b8d9bf605f", "comment": "Malware payload (AgentTesla)", "value": "0daf72345fbdea615702168201afd8b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650726, "uuid": "e0593e17-482e-422b-b8ac-7ffaf6ad6713", "comment": "Malware payload (AgentTesla)", "value": "902bd3ddbbc9c8b39ae204d20e7e957ccd6dfa8e7a69537fe8191cf3d4785797", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650726, "uuid": "215f5bb0-a0a4-4795-9b2f-37d9a0765df3", "comment": "Malware payload (AgentTesla)", "value": "96f0fe8283985f996e0b0dbb4398f62acfb28959", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650726, "uuid": "46e21948-c6c3-4c8e-8630-f02b35ef17e9", "comment": "Malware payload (AgentTesla)", "value": "c0426f36726718fa3544b507df8a27fc5d1c91a59fddfa283d34f484d13ca5f9ed3fb7e9f1262c014703bc2de48332e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650726, "uuid": "f64549e0-6571-45c6-bc7a-654e4983399a", "value": "4A254C69B742C0C4F56E24B5CDA0FBF0056ABC2BCE0B6E1702563EC1347B6679A3A547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650726, "uuid": "6cfd2d72-4300-4be0-9508-8f771312f476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650726, "uuid": "b2317734-f36a-4289-a466-e2efb36f4b0a", "value": "12288:ixV/rFW3DTqA7bKF0YWukX9ne25au1AdfgaVxnspQFQjUzm21:yF+bd9ne2egaznBFQQzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650726, "uuid": "6cebdb25-bc5c-4756-9962-c6315926a5e6", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650726, "uuid": "9ddf1a8e-42a5-483f-ab12-b1f027e5cd6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650726, "uuid": "4e7d3ba7-e3e6-4dd5-a389-585a4ff286d3", "value": "invoice and packing list.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397eb3db-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655292, "uuid": "2ac91039-573a-4e9b-bd00-fb16b7e6a6cf", "comment": "Malware payload (Dridex)", "value": "90bfecd8e22fb68cf2ecab1211b09692", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655292, "uuid": "d546380a-32bb-4707-bff8-53004cc97422", "comment": "Malware payload (Dridex)", "value": "90440ccc4f4e523bb55ed696347ea5865f644e48cf809ccc0074e07a3a3acd38", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655292, "uuid": "3340e848-8513-4d9c-aee2-ad79ad7ae673", "comment": "Malware payload (Dridex)", "value": "6536c78186541a6ab72535ca36812a6485fbb6bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655292, "uuid": "1de297bb-0273-4455-9acc-d3fba6b9af2c", "comment": "Malware payload (Dridex)", "value": "8b783f5a91b61415a0c9178312ac1587ef7b0e830f8514e09a6118007d2843dc354e65c31ab436ff29a43905dac627d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655292, "uuid": "b937a5e0-d223-48e4-bb81-775ae1df00b4", "value": "4AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655292, "uuid": "2c9fffc3-15a1-41be-989b-4bb0c89ddd4f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655292, "uuid": "d08c8a76-ed47-4bf7-b49a-4d9088db60c2", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655292, "uuid": "942934a6-ebbf-4242-9ad2-eef5d358ef08", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655292, "uuid": "d6759996-a7be-43e4-8b85-e6752d0902a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655292, "uuid": "ce06790b-ba36-442a-b679-42f465ccb18a", "value": "90bfecd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a42576c-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673466, "uuid": "eaab0c31-5d20-49b1-8eaa-0cf112f33c40", "comment": "Malware payload (Dridex)", "value": "25ceb585ee717c1248082c6c07a357f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673466, "uuid": "14916f6f-27cd-4bab-ab50-26795b21837b", "comment": "Malware payload (Dridex)", "value": "90638a1cc7cbf5d1a0920395d141d6c9732c02161f4a8ad0a6c1c8edec7a3983", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673466, "uuid": "ada41f6b-029d-46ef-839c-bd7848ab134a", "comment": "Malware payload (Dridex)", "value": "f83826099577e88d5c596e1007c8b2eb7a516b14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673466, "uuid": "c0c28021-ffbd-40a9-88d2-cd33000eb771", "comment": "Malware payload (Dridex)", "value": "ebdc9cd524afdea0cb46cc455b8f96506bd215ca542e4fb91af2f5f9a5618dd8bae56ea83ccc72b566c8c9870068f8a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673466, "uuid": "673f637d-1d03-4d63-b016-d94f882482bd", "value": "60F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673466, "uuid": "259e36c0-0161-4c2b-a22e-b5bcc5b983a5", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673466, "uuid": "23de01f0-a034-425a-9bae-dc8364305f18", "value": "3072:Lesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:v4+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673466, "uuid": "f9de3d56-78b9-4b75-bcbb-4d9fff5f1e48", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673466, "uuid": "7ab922b3-6441-4bab-8bd5-a6401ed9e4be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673466, "uuid": "6a8e311f-0cb6-419c-ad7b-74d9dd7690a1", "value": "25ceb585_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e9d799-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673454, "uuid": "c64d2b63-e999-4922-b0e0-4b8196774c16", "comment": "Malware payload (Dridex)", "value": "df8657b629d2bcfc7f13f375324059a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673454, "uuid": "3d13c439-5e70-4d6f-acce-2802e0845d68", "comment": "Malware payload (Dridex)", "value": "90939d924f4a1044e0f43404a3ee0bd844ea5245b802115cab0a1bff7e7353b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673454, "uuid": "3f52112d-6b73-4b79-86f8-b55774ea8278", "comment": "Malware payload (Dridex)", "value": "64af8571c117b8da46a23c274fbdb254ede03740", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673454, "uuid": "9d1df2be-0dfc-4ce6-a340-2a1b2189f617", "comment": "Malware payload (Dridex)", "value": "4f5df5d7e356c9e18838b889f867a128fa3b58cde94390b49b0a486200d1c65f6c63c3d706f38c07a672eba018338278", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673454, "uuid": "cc229ea4-61bf-4335-a1fc-ae702bf62531", "value": "F3F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673454, "uuid": "fc2cde47-4c8c-4b0d-8989-92ee4f626375", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673454, "uuid": "c28dc00d-e2b8-4fcd-85ea-16a64f71e52e", "value": "3072:Xesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:b4+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673454, "uuid": "6587d353-ff19-4110-86f2-158b6670880b", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673454, "uuid": "38b75ba9-867d-4cac-bb9c-d7e14a884b13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673454, "uuid": "6eb653f6-15b4-46f0-a8e9-aeb075a834b8", "value": "df8657b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f075fbd-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620651811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651811, "uuid": "3dc92116-2593-482b-9f7c-9967737c2281", "comment": "Malware payload (Loki)", "value": "77b58a583c012987b81bbdc5ccc92af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651811, "uuid": "8ffab21f-1d3d-429b-ae15-e51941d59cff", "comment": "Malware payload (Loki)", "value": "90c34abc42842c9910a1149103248a108e114624ec9877a092fffadcdf9c54e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651811, "uuid": "55f86c25-c9f7-40cd-832b-3b47389e6f08", "comment": "Malware payload (Loki)", "value": "ae726884e85df1dcecd4b0589bf04f8bca9c579e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651811, "uuid": "05bba997-61e8-4f37-a341-b230a2d2d719", "comment": "Malware payload (Loki)", "value": "687bc896fd464e7e83d5d20123c775364377c7eabd0c4cca827e97aa4c6e4c885137edb781095f40b3dbcc638ab3c4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651811, "uuid": "43a59abf-819b-45c1-a219-7a026532e775", "value": "CD9422012BC4A716DDB36936E8A0CE7AB7323F44D413DE9B399BB348473A70496A1C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651811, "uuid": "f5df5ab0-f3f9-45d0-9844-bd4825c745ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651811, "uuid": "114330af-7cfa-459f-8d62-3e51bedbf63b", "value": "12288:OXHFMw7Y9MA59CyMAn0y2wxSwhZ5iiIGCXF:eH+w09tV2wxSA5iGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651811, "uuid": "52e9ddea-2046-4178-97db-fd131e14fcf0", "value": 428856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651811, "uuid": "f612537a-70a1-4879-b68b-5564a2eef9fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651811, "uuid": "f2bc730e-8811-4472-b170-1060fbd0d01c", "value": "Olqmvkwk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b65c108-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630733, "uuid": "cbd75830-5887-4f1b-b1d3-79170a57dbb2", "comment": "Malware payload (AgentTesla)", "value": "2bff1f27fc8666607e70f3cf7d189133", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630733, "uuid": "04a10cde-5858-4fb1-b5ea-2fbb5ebd3d62", "comment": "Malware payload (AgentTesla)", "value": "90e6f37e7610a98dbec41e0fb11b289f36757d296183d9baa9e182a04de0fdcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630733, "uuid": "0038d106-ed9d-48ee-9f55-fa9a633d31bf", "comment": "Malware payload (AgentTesla)", "value": "472560642c427facdabd51bb0a38d72b9eae6c30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630733, "uuid": "22fa8314-3d45-48aa-81a8-3e98561cd863", "comment": "Malware payload (AgentTesla)", "value": "56589b0bcd3a05a31c45a0100e4462076a9909e9b3434f213c5e7e7fefcc5a2dd708650c5413ba042d534fd6a8fb87c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630733, "uuid": "aac67e75-390d-49be-9b57-372e73eccdf6", "value": "B2F4DF2532C8AF55E47EA7391570441053F2BD07DB32DA4D7DE6B8DA4AB2F808623B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630733, "uuid": "3021d516-b0e5-4c11-bbb5-d62ec152f588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630733, "uuid": "dae03f0e-b9b8-49ef-84ae-ac6d9b65c8e2", "value": "12288:w17ugk3TY6nRNl6Y9L0VcsFaHANiaYCbSWT28UN1fJHxKZD0M:iuTU3Y9L4F6ANiaYCbSQW1flEV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630733, "uuid": "7584b5cc-e7fe-4d6c-ad3b-523461da51e1", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630733, "uuid": "2c4396b4-86bd-4ad6-9b2f-e5c2c893b07b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630733, "uuid": "b44c1a46-7468-46c4-b295-a261d25f92c0", "value": "PO2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f67aa8e-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655329, "uuid": "9e38de93-cac8-40bf-889b-d21a700faa26", "comment": "Malware payload (Dridex)", "value": "f176d33335c36f95107e2d1ad5b23f05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655329, "uuid": "5c79bbf8-fdf5-4837-89de-3c6282c8be1f", "comment": "Malware payload (Dridex)", "value": "911dbfa0d09cb94712212fe56dcec7bbf6f69988ae657bc02b2b270ade50f63e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655329, "uuid": "301310ba-1dae-45b6-9ceb-c3cd3f3f79a0", "comment": "Malware payload (Dridex)", "value": "e8950f86fdf8db5038f54cff9ca28c7670c14f3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655329, "uuid": "f3a55c10-0372-48a9-8e83-bac7087ff117", "comment": "Malware payload (Dridex)", "value": "8842fa8ed6ecc7e2b5261e12d0e871b8de859cd1ca9792e3fa8f67b84d56ca7aefe974571e9168c836f5e42fbd07d5aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655329, "uuid": "656a0fc1-71de-4be5-bad6-c0c122032138", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655329, "uuid": "f935b7f0-a690-4f22-b990-f02bf89d4245", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655329, "uuid": "adc0b222-2bef-4a83-9283-5ba44bfbdf4c", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655329, "uuid": "8c0714dd-f9e4-4a49-8280-573015ad2e58", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655329, "uuid": "2fb47368-02c4-4d29-b8f0-e7352c01898b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655329, "uuid": "4cb9418d-2065-4b25-977b-8edcf4754580", "value": "f176d333_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65192773-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620657942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657942, "uuid": "94b8a608-d2a2-4715-aae6-ef30cb2179e0", "comment": "Malware payload (ArkeiStealer)", "value": "69d199ce13bef908b40b77e0d2c9dc50", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657942, "uuid": "e59857d3-8cc3-4586-afc7-962a5c6197a7", "comment": "Malware payload (ArkeiStealer)", "value": "913f62676d29a2368f9f6f97a3adc623ede915b58812e05aba24a1b0177697d4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657942, "uuid": "0a6e6978-a366-463e-80e0-609cf8356e24", "comment": "Malware payload (ArkeiStealer)", "value": "08d77aa261d103e75d32f249c90cda6fe8146102", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657942, "uuid": "053eb346-4567-459a-8c19-bbcb8c09e536", "comment": "Malware payload (ArkeiStealer)", "value": "2f82affacae07f4c8112807f6521bd029975292308e8b5f5909a80759e6dddb0d0a16d6cfcb43fa008c054487c0c1507", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657942, "uuid": "34436f56-2e74-4583-8a6c-28ab0a7844d8", "value": "62D401017AC540B1D5722D7456E5AB34693CBC211F38CADFA3E83A6D5E301C1AB36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657942, "uuid": "03116b47-9c71-4ccb-88e7-8d4498fea5b5", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657942, "uuid": "ea8ec84a-d715-4151-a070-b6b83e4ddd8a", "value": "12288:VOOfN590uu6opX+t4sP60M8wHvUq6K3FVpaHHjgyLXF:YOfNkuu6oLsipF6KDpSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657942, "uuid": "962ae627-237f-4eb3-a4fe-cfbd8b93fda4", "value": 627084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657942, "uuid": "f40cdf8b-8ad8-4409-b53e-3e606243dd89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657942, "uuid": "50b2449d-b55c-49df-bfe2-d2d2d3af2241", "value": "69D199CE13BEF908B40B77E0D2C9DC50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b76dc46-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644531, "uuid": "d0bb4de6-481c-4125-977d-8d02e719c786", "comment": "Malware payload (Dridex)", "value": "a43432235e57f636e3fd571ab6572348", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644531, "uuid": "ac5fb66c-88f0-49ed-a876-f6e9a27a5f09", "comment": "Malware payload (Dridex)", "value": "915199f7a7eb4d3d5bc186f319da2a29c80950e934bf5f2bde0d6bf04edb7f42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644531, "uuid": "b37b02b4-36c2-4012-84c9-906b790acbab", "comment": "Malware payload (Dridex)", "value": "15beb1f3d8b30e9d4ab7ddcf0c2b7c8a0985cb7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644531, "uuid": "b9712ca5-b6ee-46d7-9554-2ad7cea21f71", "comment": "Malware payload (Dridex)", "value": "8b25f75b722b9f07f64151242b34a76cb17b51bf4209593f1a1fc641bd62a06005c0bed0ada7ba0c052e638dc0940971", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644531, "uuid": "9a8c0a4b-1f43-4092-ba2c-0b5513ae3ecc", "value": "84F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644531, "uuid": "604b914d-ebe4-4ff0-9797-1f939e22a0f7", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644531, "uuid": "c1d1f5b4-b208-4914-b4e1-7b7251f0233d", "value": "3072:bWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:b42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644531, "uuid": "66f1c06a-b7f8-4b72-a006-70e48309e82d", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644531, "uuid": "018a53e4-d73f-4206-b57c-bd8ea0d3ceb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644531, "uuid": "1594189a-9824-45b9-b82b-ca85a162b37e", "value": "a4343223_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5389b613-b180-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620645028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645028, "uuid": "4fb450a7-5773-45ec-99e7-56b55d255251", "comment": "Malware payload (RedLineStealer)", "value": "399f54be040d697ba9fbc6f5d5b1f432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645028, "uuid": "43a25e26-de5c-41ab-b777-1b34e57272bd", "comment": "Malware payload (RedLineStealer)", "value": "91a94cfcd6fab10920d82645ae166fdd029e651a26bd9cd9036e39ea5afab89b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645028, "uuid": "ba046e1e-b3fb-4030-8e44-123806e84a92", "comment": "Malware payload (RedLineStealer)", "value": "a92212e1267edc0697ad2425f5a3d47b5fa9923f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620645028, "uuid": "56a585a4-60d0-4eb7-a400-6b99ceed5ba6", "comment": "Malware payload (RedLineStealer)", "value": "de22aa8ca7aaeb5fbadd16accd9c990d182b92bea5af264fe0c02f54f18cb9cf29ef4497c8862da95daae59b7a212128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620645028, "uuid": "aa2e03f6-4f69-4212-88dd-085320227c9b", "value": "1B34AED03090D17EE077113280B6AE656E7C3C252FAAC7C7B78836655E331D1A6392EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620645028, "uuid": "7c703a4e-0804-4094-8e64-3f4875744a7c", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620645028, "uuid": "1bef0ec8-1190-478b-80bb-ab2de4e4c2ee", "value": "3072:3DKW1LgppLRHMY0TBfJvjcTp5X+NwPc+NSHv88ZPPH88CpjPunCIuq:3DKW1Lgbdl0TBBvjc/+NcNSHZH3CpjnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620645028, "uuid": "5ebe1330-1d50-4320-80ca-a79f46fdae95", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620645028, "uuid": "51f60811-ec9c-41bc-9edd-13145b1076dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620645028, "uuid": "a0084d11-4535-4ee7-9410-982a71716645", "value": "399F54BE040D697BA9FBC6F5D5B1F432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8f1e6a-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676992, "uuid": "67b29826-5647-44a8-af4d-a035847dce1e", "comment": "Malware payload (Dridex)", "value": "6d7cc3d743a96131cf8a097e650b8600", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676992, "uuid": "c5297948-9f29-441b-a236-15c41ed2084f", "comment": "Malware payload (Dridex)", "value": "925107bb724b045b76952bd9c085e57398363a52d3d0effd1a89337aa1b57702", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676992, "uuid": "cd98b5e2-2c22-4943-ac37-9789c8bb1186", "comment": "Malware payload (Dridex)", "value": "ede259f3f878c40dec0db64ebd0a359274127507", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676992, "uuid": "2df699f7-99bd-4e3a-9dbc-1b0091bfd1c9", "comment": "Malware payload (Dridex)", "value": "358a1f8b52816c6f96706c435a86f421a9e52dad2b7c26bde0a5581f4633019f84e10a25764d907834df8a6663033128", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676992, "uuid": "4f461e14-dc46-4c29-8d17-5b626757a253", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676992, "uuid": "fd07ca40-fd8c-4aac-a765-0991611be3ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676992, "uuid": "925649fd-fcf0-4cf9-9fef-4a3ccc81b773", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676992, "uuid": "61c3f101-3ca3-47c6-bbe0-a5c5876db207", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676992, "uuid": "1fef4514-a0b1-4d44-af81-b325aaeeb1d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676992, "uuid": "257d7283-b227-4625-ab2f-20d2ab0a36bc", "value": "6d7cc3d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deafd310-b152-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620625504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625504, "uuid": "ce713d86-ad3e-42a2-b3ab-ba86476de811", "comment": "Malware payload (AgentTesla)", "value": "4d17ca2791dd2912d94cc97ded5da97d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625504, "uuid": "28ef140c-19b8-4199-927b-9d7c619ab7c6", "comment": "Malware payload (AgentTesla)", "value": "93501266c14fefdf79f3e52ce6fb143a868da2607585bcf02d92b271dd61d54f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625504, "uuid": "7d1fb326-0ba0-492e-9ab7-b19695575e1e", "comment": "Malware payload (AgentTesla)", "value": "492fb0e1c1ab177ff8201fc3abd303eb48d7670e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625504, "uuid": "2aab3488-0315-40c4-baf3-0a78b98287ed", "comment": "Malware payload (AgentTesla)", "value": "17ead5f1ea11c2d5e550159a52d5b8b7410e9f447d69791f1736575126f48a3f78e013a33adf3c17ff3089d26b33dffd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625504, "uuid": "2e11bb72-0e78-4af5-990f-6a3efc60aa21", "value": "9E610A7CB9082467FB0723FBD419FCA913A4B05299C944553ADCE58517B732B551A842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625504, "uuid": "38be78de-d8a8-473c-977b-38850787438d", "value": "96:XmVROUR22AZuYd1NiCoFQ3DfPPIInnfthyu:XtclA4Ci4L5neu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625504, "uuid": "720f4a0c-f01c-4bc3-975c-9f330b556e9c", "value": 3366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625504, "uuid": "feeb1d84-4bb0-411c-94f6-26213cbd72b8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625504, "uuid": "c56dda74-bfb0-4d9a-975e-41d15ba00921", "value": "Company Profile.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708b01b2-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655384, "uuid": "5d63fe4c-abc2-4228-a7d9-541bc865ee8f", "comment": "Malware payload (Dridex)", "value": "1122fa7d2507262f6006b724ff9455dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655384, "uuid": "a58d0ca2-7de1-4aaa-b33c-93e616aac6cb", "comment": "Malware payload (Dridex)", "value": "93952dc55e7818e5bc022c7923e68b4abb8e4fbe3e281e073d11359cd98d08c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655384, "uuid": "8757864c-5f3c-4a6d-8059-da42b872a1e6", "comment": "Malware payload (Dridex)", "value": "5c2b2b0585732f2ca767c4ab5677e62638b8af35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655384, "uuid": "ae272467-c1ae-4d2b-ba2b-d6e9ccd71588", "comment": "Malware payload (Dridex)", "value": "3dfbec2e85e4d49079b63f7eea793d64456350c3eda24967ba193b5bfba46cfe1a198d555c78af99415b9672defb54fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655384, "uuid": "33f1fa2f-dac5-4097-bc2d-c67571589024", "value": "69F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655384, "uuid": "f966f551-da97-4a85-8c2f-781752554fb6", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655384, "uuid": "d1f0f85c-1af3-41de-9e3d-94cb4530dfff", "value": "3072:iA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:i3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655384, "uuid": "815533e1-75f0-49a6-b7a5-09d05f5e6935", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655384, "uuid": "ec5c6b21-f290-4eab-b381-e1cb9848f67f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655384, "uuid": "0017a262-c638-4fa5-8748-af86cdc61788", "value": "1122fa7d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52bca7a-b197-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620655043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655043, "uuid": "b4cb8beb-1d36-4437-8db4-e45fbbe74dc7", "comment": "Malware payload (Loki)", "value": "875fd639095485d90b82897f9538e5b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655043, "uuid": "aa19e5ef-67ad-4cd0-a103-5850a472cd30", "comment": "Malware payload (Loki)", "value": "93b3063717fec56226397cac4c832cb2038631fa6473140f716875b686566391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655043, "uuid": "a894c1e3-9848-478b-a7cf-d4014856e817", "comment": "Malware payload (Loki)", "value": "9aefdf2759ed1322558cf5ef94bcf703339d3fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655043, "uuid": "59e5695e-297c-4b88-8109-b51dd801d068", "comment": "Malware payload (Loki)", "value": "a416711a92de8380fd841955924230c40f9ec234b2f70b74196dea114c9541bd0c530e058de7fd2dc427b65a49031c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655043, "uuid": "a7ec8af9-2b3f-4dba-95ed-49311cda13ea", "value": "B3E4CF203BD8AA59E5BF4BB51D70C64053F2BE17D722CA1E69E9608E1E62741C7B3313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655043, "uuid": "e54699fc-615c-4e56-892e-01ab5c7e308a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655043, "uuid": "0d9b35f1-aa7c-4d73-a0b8-54596ab30f26", "value": "12288:FquMKtAlXFrBVw5hhhgmc5L4wNW3tMHsprKlN1iHHX:FcVlXFV6hhhgm5M7lCH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655043, "uuid": "69bb006c-1bde-4cb6-a964-ab5b1fb61494", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655043, "uuid": "08c10798-a10b-4c57-af63-f91352da96ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655043, "uuid": "3a190064-5ab6-4908-896f-b910fcfed997", "value": "Original bill of lading_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c334da1-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673416, "uuid": "150820b7-1f8d-40af-b6cd-ef6c656976dc", "comment": "Malware payload (Dridex)", "value": "c442a1fe1af6f83c1bb786f42c9adfbd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673416, "uuid": "c4fbc90a-3ddd-4952-b9a0-b2b1e9bacbd1", "comment": "Malware payload (Dridex)", "value": "9434b2014b736ea26bbb3d2360434b89d40b4ca123ddcc42d45f83015858170e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673416, "uuid": "049489ce-3658-48df-b1cf-dcaa260ed9bc", "comment": "Malware payload (Dridex)", "value": "825386cba8f0ebde4c9db7e513d9fe0b57ce3993", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673416, "uuid": "9e7404fd-4171-40b4-b382-583c44e1d7df", "comment": "Malware payload (Dridex)", "value": "c53c3e5c2438694e1f7ab11e5d2d7ec23d87514c4b852e5974601e006511c5cc86483b847997a356c7f5aca0092c4214", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673416, "uuid": "f8e66d7a-5731-40d8-aa31-dbb76a17e058", "value": "54F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673416, "uuid": "ccfbc944-fdec-4310-937d-cb218c4b317f", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673416, "uuid": "291ac67b-6dd7-4c10-9f32-47aa56a5dcb6", "value": "3072:XuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:X0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673416, "uuid": "ca90d5eb-a5c0-4b2f-a99e-4a96353c1702", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673416, "uuid": "437ea378-b2fc-4ec8-874d-55f171723ded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673416, "uuid": "42f6f05e-e7df-4f30-8e1a-6468a89e2f5d", "value": "c442a1fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96171ec3-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669191, "uuid": "5ed9e413-3156-4e58-8e72-1e2bf6157fea", "comment": "Malware payload (Dridex)", "value": "a0d01b4d7080dda1f11f0b41fad496b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669191, "uuid": "ffbf8ceb-9520-47cf-97d6-66e6bf134ba6", "comment": "Malware payload (Dridex)", "value": "949fbda8d8c0ef40097fd53c9960ffebfa1e3c6f570ac7b01d076d50fba4bbcc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669191, "uuid": "4aa86dbc-641a-4d89-a2f5-4ff023c344d1", "comment": "Malware payload (Dridex)", "value": "eec9d62044e4bd3eac8bcc89583dda8263138fd4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669191, "uuid": "a7bd01d8-8318-4c17-8c8f-e61843f8353c", "comment": "Malware payload (Dridex)", "value": "b037ab9c0ca3f98990247c89447f859948511962af599b36de5f6c2af6872d35e4864677999c9446fc648d3dfb8ce7cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669191, "uuid": "5b00b0ac-9ddb-465f-804c-8ff8b12b06aa", "value": "8E7423B4C7FDD46CDC270378CE254F165A0717A79DC3B696FB81E0AC2B88CA3158A495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669191, "uuid": "0277b074-2c51-4dc2-b6d8-62eee8779e5d", "value": "6144:W4QH2DAQ1au2X2liRr6FWKVjdWDVf/4P2d1ienwYEz+uKOIcp:WtC1au2X20rMdWDVf/4PRe4z+uKOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669191, "uuid": "0c0f7862-fdf5-4dc6-ac2b-6a255df84874", "value": 338807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669191, "uuid": "aad57fd7-42c6-4e55-a31e-f0909b9af8eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669191, "uuid": "b2ff91b7-42d4-44a8-9aa1-b4f1bbbe37dd", "value": "export of check 684585.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed457114-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680504, "uuid": "e1125e48-51ec-40cf-8983-eeb778c20a6b", "comment": "Malware payload (Dridex)", "value": "2bf446f7b1a8a40ddcb568289216c7df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680504, "uuid": "8a49c9f7-a7fa-4b0b-8b68-437216cb17de", "comment": "Malware payload (Dridex)", "value": "94b5129077c80e6aaa7888d2dc71c6dfb299987a2cf6dded180af48da6a2c0c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680504, "uuid": "0b116283-bc66-4738-bba2-816a55d4d0ff", "comment": "Malware payload (Dridex)", "value": "b6cea1ef9eb2646caeab7c2a8619f1c7ecedc521", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680504, "uuid": "1bf7f245-b0f7-4d27-8636-93692c561d23", "comment": "Malware payload (Dridex)", "value": "e8a7e38032e9b89b2fa38f14a4f8e9ff46231c7c89b7724fc275d71f0d66fd6f0b4d3afe8589132c29ba75f9f7ce5d7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680504, "uuid": "f748825e-f4d9-4a92-8333-62d31cdbc4b3", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680504, "uuid": "1d51281d-f0f0-40f3-a45b-0ca482fc040a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680504, "uuid": "2bbface1-ae84-4adc-b650-958cbb11a91e", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680504, "uuid": "070322e4-c39c-4521-9c96-3ad183977a43", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680504, "uuid": "335c366f-076f-47e9-b102-1295826267d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680504, "uuid": "8d780aa2-1839-4c98-a38d-c81f32068f90", "value": "2bf446f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb707f8a-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640907, "uuid": "41791355-04bb-4b27-a15b-6cc96fc831e7", "comment": "Malware payload (Dridex)", "value": "9554041bc6297e9ab66a42cf1e815e94", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640907, "uuid": "cd66b098-037f-43d0-839d-476b6fb999fb", "comment": "Malware payload (Dridex)", "value": "94c98aeb36e599388816ba3bd055cd1aa864c8c2c4e509969edd556286a6cbf6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640907, "uuid": "27a27bb3-7992-4784-9c8e-7b746d7c4c77", "comment": "Malware payload (Dridex)", "value": "d881942840ced7d5cee165b053c3bd3d30474a92", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640907, "uuid": "c241741b-94da-48ec-b839-2b28d5a2a9c7", "comment": "Malware payload (Dridex)", "value": "8c63f5fad897c87e3df6ff7755f8b7855176d588bb5287e121c4266893189b85ec74763d92237929029bd959b950d31b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640907, "uuid": "d2e34e41-363a-43c1-ab60-9afa20fc9584", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640907, "uuid": "0655d960-a75e-4b98-bba0-d600505e89ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640907, "uuid": "185e6ccc-c6fd-4b1a-9ab8-64f7cfafc4aa", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640907, "uuid": "e67988db-cf21-45c4-a01c-56451ee68ee7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640907, "uuid": "4e104e02-6b27-43f7-bfbf-50b0c98ae470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640907, "uuid": "1331fac3-ea3c-4e25-b34a-6282f245cc8f", "value": "9554041b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f02d6b-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620649640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649640, "uuid": "889f607a-ba39-4c83-9789-266cdc785e73", "comment": "Malware payload (SnakeKeylogger)", "value": "822ac0c1eb989f97bd8a77dd7c105f5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649640, "uuid": "7e19fa3e-d8f8-421b-8131-f8f89de9efe4", "comment": "Malware payload (SnakeKeylogger)", "value": "94e4b22f59b8181ad790595a8db24572bb41fb6c603d9fb0869211bd4f81e61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649640, "uuid": "1d285fc2-ef6d-41b7-a36f-bbd99cf67e8d", "comment": "Malware payload (SnakeKeylogger)", "value": "1290cd9f11bcdcb0feb6323c4b033d0e25ff2fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649640, "uuid": "0e080f34-395b-4626-90ad-fccc929abe98", "comment": "Malware payload (SnakeKeylogger)", "value": "ac53516be3f0bc32087eec4b1319229bf5e1404ecfbb322e8039c83abdea1df976868dba3acdf320ea4a0fa3cd6ec9ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649640, "uuid": "ed1f3719-3488-4834-ba4e-f6d6dbd10ed6", "value": "5FC1911267ED0337D9B787B96CF793022678FA1099738B5D24E0531EAC236058E12FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649640, "uuid": "129388f4-d15c-48e3-985b-4e8efb020dd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649640, "uuid": "d50a1fcb-69f7-4933-a35e-e96d1c86f1a7", "value": "48:6u74dXoYVRC2HESGrVFgbFJi8hbGbmHum2HuwvHxoaOkzqBH6rJDlmQHFLl4Zlz0:0xzhnCF78hb4DkOD9LsXzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649640, "uuid": "e02c5d68-e9d8-41a6-9d76-fff4ee851be3", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649640, "uuid": "303bf241-2104-42d9-aabb-9288f796695f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649640, "uuid": "4f06e8a4-6c9a-4ca3-b01b-3554ea4b150e", "value": "0908000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398a5d58-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620673331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673331, "uuid": "2ff09367-c0b3-4715-a287-cca5d24d7c60", "comment": "Malware payload", "value": "520b670d563e4cf6c12d26ff0abbc800", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673331, "uuid": "8fa76ab0-a1bd-45b5-8f57-c0742941560f", "comment": "Malware payload", "value": "94fc3bf8eadb40d43f830354c3a03e5b959becb39c8c0dbe53f38781cfed232d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673331, "uuid": "659e1b32-1582-4229-8381-64cc5c60cea4", "comment": "Malware payload", "value": "825717df48dae97894249177140604716e2ee96c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673331, "uuid": "ccab4b89-ed4e-40fd-ade7-e53bada0e791", "comment": "Malware payload", "value": "6f4c1e7cfec42e6c357e3b457b76a6d18a672952c0c27dd7cb16ae6db1a41fdeff3a66e2ce64f8eb958bbad399598c01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673331, "uuid": "c96738d0-5bc8-4db8-b48f-272d0323c953", "value": "DBB3AC0BCC484AD7C16E93FE7D474DF86E0E5728D8926FEF00221F863A255A31D4B56A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673331, "uuid": "9c38a7e9-97ee-4d76-938e-59a5fcb747a1", "value": "3072:DtWf/vKINbjvw548LMb/oqKO8NnS8+60KchLD:DwfaAbT648LM7D98Np+E0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673331, "uuid": "26bb4023-35e9-4bab-9174-116ee2960a9d", "value": 113128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673331, "uuid": "d2c0e209-2473-45f1-ad66-bb5b6d007a20", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673331, "uuid": "3b2a43c4-5f9c-4f8a-bef0-841686789f6d", "value": "520b670d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae30e489-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673526, "uuid": "626882c8-e4b3-4917-bbf0-f2e4fbdb6047", "comment": "Malware payload (Dridex)", "value": "875b54c1ffba3db3812e690d83fd5cb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673526, "uuid": "e50432b3-5419-49fd-ae4d-6cef6ab13cd2", "comment": "Malware payload (Dridex)", "value": "95565989caf55f0bbe8b462a0cb5bcae6f9ab88895f6f12b3c5717caceffa6a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673526, "uuid": "26ac26b5-f97b-4ae2-b08f-85698ea9f5ad", "comment": "Malware payload (Dridex)", "value": "11e17fc80bd470697b0c1dd4db004359d1e1c0a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673526, "uuid": "b9e848dc-2009-4bf8-bd77-91a2898cc0ce", "comment": "Malware payload (Dridex)", "value": "6548bddec24b8b6e3f00f097479803dbc6f4f189a83250221efdc829db9d715a7402299982cc07590a92cc4dcda26299", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673526, "uuid": "5c6861a0-a0b2-4248-9c0a-f6d8027065ec", "value": "C0F3D0906A9BDF0ED9C13CF96AD2A879B173458D811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673526, "uuid": "c8711799-f011-4859-a1c9-9df413ae4a3b", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673526, "uuid": "0ef4fe21-f2cd-4e39-b40e-cede27c59858", "value": "3072:zesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:H4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673526, "uuid": "3c97ce10-4cfb-4c49-b3ad-2bc67a89edf3", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673526, "uuid": "44017e64-f213-4e7e-9c0b-82e3d70c7af4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673526, "uuid": "c8f76bef-2755-4ca2-8ad9-c8ced386d2bb", "value": "875b54c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b6587b-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640892, "uuid": "50da2b06-b4f5-4d65-af98-f91cde4e4f38", "comment": "Malware payload (Dridex)", "value": "e330d8b8aa0a69975f833a7b7e3e826e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640892, "uuid": "bd47598c-53e9-4aa3-8b5a-d5029732bc8f", "comment": "Malware payload (Dridex)", "value": "956a75bbaa4a8669bd7b5c4e242a0f993c877e3bee93696bb9a41e8cbcd9c6e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640892, "uuid": "a38d947f-d5c1-42d8-93b4-4c8418672282", "comment": "Malware payload (Dridex)", "value": "612c8e64c71d4123d47ea9cb432eef1c416fc404", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640892, "uuid": "4a1d10c5-4435-4a90-8561-5005b448cdea", "comment": "Malware payload (Dridex)", "value": "7c68f662748109268f3ad3fd3c101fcd9b668e5fb594277b28559f8130e580dade9779e47dd85f951a93866709296c28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640892, "uuid": "677d97ee-c5a3-438d-8083-8722dc3a5956", "value": "86F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640892, "uuid": "d77b01ea-6e54-4509-8fda-8081927db73b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640892, "uuid": "cce03a98-e1ed-4fc0-bc7a-afddd80f9801", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640892, "uuid": "62e898be-14dc-4e27-9800-6794d6599dbb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640892, "uuid": "a8208473-59fd-4162-9bfb-ef63c95c6510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640892, "uuid": "e5e62aac-8a2f-49a9-bcb5-56367855297a", "value": "e330d8b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6cd9a7-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684096, "uuid": "c1389585-d0fb-4866-8a46-bd3b2be9e7b6", "comment": "Malware payload (Dridex)", "value": "836b5c5587e68d5014fd44ebd953ec54", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684096, "uuid": "773a59fc-5ab9-4f1a-ae20-17431c270ddc", "comment": "Malware payload (Dridex)", "value": "957101e0435c269eecf75278f85e4895086995919b12c29309822a11eba34f57", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684096, "uuid": "394b4749-1999-44c1-ace5-7fcc156ea540", "comment": "Malware payload (Dridex)", "value": "f56be0755d1a17244f517af0d226d4fc64549c37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684096, "uuid": "49551226-d9b7-4b80-87ba-b91b22a19731", "comment": "Malware payload (Dridex)", "value": "9476793c75d076da2cfd88c9aec66b12004fa8ccf56c928346296e340429f7816e50570e2a343ce53dff632667b6df4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684096, "uuid": "546fb488-5f3f-4c3c-bab9-36f1c60b5041", "value": "63F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684096, "uuid": "e45bab62-09c5-4e6c-8aa5-14e1a4e589fd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684096, "uuid": "a5996dea-4a18-415a-a072-8094d8d51e06", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684096, "uuid": "ce0f9e52-98db-439d-9374-2d60cdb36fa0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684096, "uuid": "322829e3-e165-4da1-9e7c-807034ef5931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684096, "uuid": "54a06fa9-5168-408d-80e8-5edd73102859", "value": "836b5c55_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ee62d6-b1c7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620675632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675632, "uuid": "20cd16b6-1b8e-4c23-be49-cf5ea6ee64f6", "comment": "Malware payload", "value": "f73abde5cd5bcc2811c79adf2a14b878", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675632, "uuid": "3dddf1b8-89db-4e83-9aa1-f026172ee630", "comment": "Malware payload", "value": "9579f06eaf0a6f3c01267673b63e292e31bf899fac5c84a4be8ca74a6d1bbbd7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675632, "uuid": "091f3fd4-8608-4d65-a5ed-6c3962f9bb53", "comment": "Malware payload", "value": "e645e0b9d00704b493de127df9983b2ce2338713", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620675632, "uuid": "2fd70b89-438c-4a4f-969e-3b970409763f", "comment": "Malware payload", "value": "8b293d2b3fee9b6a6828719ab676936db652c460bd6b65c64d15e170335b5660880eea27a45dab99f031b08d93427b5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675632, "uuid": "bdbe9c75-319f-47a5-96e5-73853830e7ef", "value": "A7D2182DA1017B0AC123183D9D3B50912FB59D0DF5E05B8EA1D3721B8435BB66A5EFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675632, "uuid": "0a30275b-9e6e-44df-9f13-bfe6b831ead7", "value": "768:XKT9sTsK/i/L/g/J/O/n/c/lpPdYIStlfK4LSZznSUJA7swZHgTzyVdf6zhAmVJK:XKx09aj4hmfktb3D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620675632, "uuid": "d036acad-465c-4630-9c0e-a07aa16a8aae", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620675632, "uuid": "ee0e00d2-8fa3-4c35-81ea-938bd1fd504b", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620675632, "uuid": "88250e4b-512e-44a8-aa08-a4df60ef8a12", "value": "SecuriteInfo.com.Exploit.CVE-2017-118821.D469CLASSIC.5161.8909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443d0f8e-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620657887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657887, "uuid": "ad1106b7-3be9-4a47-9e97-3b590323b0b2", "comment": "Malware payload (AgentTesla)", "value": "a2e442a805ad3018682a20250ec0d325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657887, "uuid": "b462e6c9-9663-4bc7-90e1-8fe43407be25", "comment": "Malware payload (AgentTesla)", "value": "95821be68f627aa047e696021d92a10a4c5d32e7fc9970a765c20f4e3c33081a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657887, "uuid": "f0e659e0-7e78-40cf-92e5-4f1bc26de580", "comment": "Malware payload (AgentTesla)", "value": "d91e789adaa345f41cc5baec8360befeeaae3b75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657887, "uuid": "aa7302de-cb16-4cec-b7e5-bc2f00e54b60", "comment": "Malware payload (AgentTesla)", "value": "8cd32a9a7d55afe77d4c0e96eb9e8aa999469a1d15982431f8ac679e5d5d5f7e595ae8ebc2f9278fbbc997f7e3315d19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657887, "uuid": "0b971824-e533-4948-8c10-5504d0a6911a", "value": "86D423A02B88ABDF07D9B48B0277E7646E5918CC85BCBF5790F75A9CCB3F42D2108159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657887, "uuid": "317dddbb-7d1a-4fd9-a977-8cb7e5ebbf72", "value": "12288:y0cT7aztBAmhzEgd0qSElv0TcJ3Jj1h9QjistWpgV2qKd:y0cSzDAmJ1t1yc5nh9Qjr914", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657887, "uuid": "38f478f1-632b-4f01-9683-2054f67fd6ea", "value": 619926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657887, "uuid": "7bd9404e-947e-4890-97cb-0d674d0f8c63", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657887, "uuid": "4f855a99-710b-47ca-9bcd-1053fd38efd5", "value": "SOA PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec2f494-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673366, "uuid": "1e1356e1-9544-40e4-bee4-ccb2b13097bb", "comment": "Malware payload (Dridex)", "value": "1206e41e4da57187df2d436fd6095ef4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673366, "uuid": "cc84a99c-511a-4882-bb89-b1d92eb5f5ab", "comment": "Malware payload (Dridex)", "value": "95d0143581c8eecadf422c31c4c1051a42ab522e383d3919d83804d01a1ab953", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673366, "uuid": "6fceb2d6-5c6d-4ceb-b2b8-80299a852510", "comment": "Malware payload (Dridex)", "value": "e1875e742ad84b8421cfb8a2f011d85762099e4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673366, "uuid": "d598b91a-85cf-491f-9c97-191abaa3ad47", "comment": "Malware payload (Dridex)", "value": "0e6c5f2409984235f6558338e71c705e6460cb16474655504ddd7e96ca2594eda31c06eba8da12873b77888218b06aab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673366, "uuid": "84e6f145-d61d-469f-9df0-ab79ffc7b9ee", "value": "06F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673366, "uuid": "d614e9c6-bb13-4d76-9e8d-9350c3d7bd4d", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673366, "uuid": "78443cd4-b2a4-4e3d-967e-cddbd76c4144", "value": "3072:Tesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:n4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673366, "uuid": "6d536f28-8131-451e-90b7-184e65c10f2e", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673366, "uuid": "a931c5a6-e876-4284-9a58-527a1d9dd143", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673366, "uuid": "b14e6e8a-df19-4306-aa15-0e2e42b7d09b", "value": "1206e41e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7397adc6-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651953, "uuid": "71c45946-3960-4b6e-8f46-48307895fe36", "comment": "Malware payload (Dridex)", "value": "afca9c1cbb02c2f5198bd6297a1068c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651953, "uuid": "48a77b99-24cc-4fa3-ae3c-a7f89acef316", "comment": "Malware payload (Dridex)", "value": "95d0e1e1d490db3ae8b35655e65c4e29a45a5628242de6d5875fa20d883942d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651953, "uuid": "b6a52d43-c049-46d7-862e-c49e5bb1bc5e", "comment": "Malware payload (Dridex)", "value": "a3b225c25f1ed0720a3e19ea83d818d4b470877d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651953, "uuid": "7f6ed54b-9768-41d2-897d-ee2c4cb7dbfa", "comment": "Malware payload (Dridex)", "value": "86fc118b953024d3e508ef448ebdc9a2d0e612e2147f2b7a4fa847fcfb15edb59a13c1777805328b3de20abe3f6d8241", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651953, "uuid": "4237d41a-bf6b-456f-b55a-ce17bd5a0d61", "value": "AAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651953, "uuid": "47a745b9-104c-4330-b3d4-32f6b938d1ae", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651953, "uuid": "5dda59fd-ea4f-4e39-98ad-55d50b65b50f", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651953, "uuid": "c838c390-9c13-4977-aa41-2a3d79ac1c19", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651953, "uuid": "f26f222a-ca0c-4db1-89a9-45c41c499c72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651953, "uuid": "9d3b641a-a772-4127-9820-15e32eed6c4c", "value": "afca9c1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282daad1-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669866, "uuid": "1e9ad4b9-ab25-41a2-b986-30f33151e192", "comment": "Malware payload (Dridex)", "value": "e7b0c008dd4739badfe9a5717da032a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669866, "uuid": "de5aaa03-92a4-4f9e-b840-8d0a424a2b6a", "comment": "Malware payload (Dridex)", "value": "95f73ad33a6617d58d4a25ded61480a0b87592f034ec0764dbf70ca8ff817da9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669866, "uuid": "d705d9ae-4463-484b-9baf-7cb0becd6f08", "comment": "Malware payload (Dridex)", "value": "2e98f1e2ad7f9895ea7fbd74c0bc4d1d0641f3a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669866, "uuid": "cb0b352a-0dd3-4911-b233-9ceaf5cd3a83", "comment": "Malware payload (Dridex)", "value": "b95363fd4bb9107f0e70a6fa0539b2efd95594cf83d97eef39a6ff0e938badd671cf8dce386939ae18b93a974c448373", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669866, "uuid": "6917fed4-7d80-4669-840a-5bf76d950c5c", "value": "63F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669866, "uuid": "772222f5-9f2c-43ec-9df0-b9eed2e1a647", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669866, "uuid": "96fda070-5f87-4d47-aea3-6852d57102df", "value": "3072:K/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLss:IbrE1kvcB74DXZ2MelZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669866, "uuid": "aa11f622-2b83-42e9-9a1a-fba5cb5bb19a", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669866, "uuid": "9751da7d-6843-43c6-987d-6a455799d18f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669866, "uuid": "9b6eae39-91fc-4176-8fa6-d293456547db", "value": "e7b0c008_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a509a9be-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1620676947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676947, "uuid": "21e5cbd0-4636-45b2-8082-bbf602289355", "comment": "Malware payload (FormBook)", "value": "98c879923a9cd4da08959fd0318c3d35", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676947, "uuid": "ec133a9e-4f45-4920-805e-feece649eb82", "comment": "Malware payload (FormBook)", "value": "960cd364b10841b71b638aca1807d5667cf340e76102389d45d7df4c17401ed2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676947, "uuid": "d6b56fc5-ce78-492d-ac74-49bb0c450346", "comment": "Malware payload (FormBook)", "value": "a3f7a4ee4da515858e2235d91c0206cef37446a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676947, "uuid": "71020cdc-2c2b-4bb2-994a-66b9d2952087", "comment": "Malware payload (FormBook)", "value": "7abcf1d3741535dcc43cdf0e2ca89951d21b847c81986c0279a39c06d1dc28f07335915a6d271b07d31ee0244cd6e142", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676947, "uuid": "d2c45c2d-02f5-452c-93e5-3e9ebe3deb7b", "value": "12F49D22B2D15433D1AF1A388CAFB3605426BE113CE468B97BF47D085E396527D2D29F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676947, "uuid": "20cc5dc0-63fe-4a16-ad3c-ee9de4ade669", "value": "0fcf8c5fce4d78a309629ccf4f3c321a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676947, "uuid": "a95089f2-47d0-4815-9d6c-ef07b06007a0", "value": "12288:nVxdQbSy5VaQdurQthdABmTdEMRa8cZMgGtlALU/Oy/v4:nvdQL8EE+Achpc+gGtKUD/v4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676947, "uuid": "559713bf-5e0a-44dc-aade-fe7e8d5fae1a", "value": 752136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676947, "uuid": "c3b7a1f6-0d8f-4ee1-9ccf-cf499ede659d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676947, "uuid": "4d9ceafc-c93d-4954-9c00-a9ebf5455498", "value": "98c87992_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab551025-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651188, "uuid": "4d53c8d4-24bc-4104-a69e-abafaa137bf5", "comment": "Malware payload (AgentTesla)", "value": "21f1e5b19817feed436433a194f85f9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651188, "uuid": "ff7872b7-1ae6-4049-b5fd-4f2e0f6b2e1c", "comment": "Malware payload (AgentTesla)", "value": "9641b42c328e6e872819d139d20c3b64ed5e00d044de54550d58c2c77917e50c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651188, "uuid": "80a7372d-011c-48d5-b749-8d7e9b1ec526", "comment": "Malware payload (AgentTesla)", "value": "f346c9855d1e6fea01d5e70ac2c58c6afab67b8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651188, "uuid": "5547eac7-0a1c-40f1-9ead-ad7a07763d65", "comment": "Malware payload (AgentTesla)", "value": "5df45264aeca4281894b029f9aeccfbf4540128900556646763867da9763e4479d0ec5bb5b8fb7c9a718eab36d183cd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651188, "uuid": "aca1e846-8259-4727-83dc-862c1926a718", "value": "36254B6EE342E480F65D14B1CDA0F7F0056BFC2BCB1A6E1706863E91747B6A75A3A047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651188, "uuid": "e3586590-87d7-4937-9cde-5a1aace0257f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651188, "uuid": "5171cc3d-caa9-4db2-8d1d-dcf790651362", "value": "12288:qYeQdPzk/J13CXPgr/p2+9fazZJTil/ToQuJEMF+17:tlkD3CX4r/p2+RazZJTiw+Ms7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651188, "uuid": "fe2129ff-9e85-4af1-93e6-73fa049b005e", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651188, "uuid": "f5592360-edc3-4845-b63d-25232c43b3b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651188, "uuid": "a66d3fa5-db14-4330-8f62-ffbe81847196", "value": "171021434-045230-sanlccjavap0003-10004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc6ddae-b168-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620634681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634681, "uuid": "135244d2-f3e5-4a23-ba5f-d8adb8a112c2", "comment": "Malware payload", "value": "d59a0a04abcb38fdb391a09972aa3ff4", "object_relation": "md5", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634681, "uuid": "36ffde18-dd44-4ab7-9290-5b4819f58f51", "comment": "Malware payload", "value": "964ec94fd9c6da7090287b6217b7eedd737f4f069fa27613dbfe33260fdfd10e", "object_relation": "sha256", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634681, "uuid": "1bb3acb1-d403-4538-8c89-164bd1439820", "comment": "Malware payload", "value": "72091774fcd93513f77fbc3d6e72804fb19fb3ff", "object_relation": "sha1", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620634681, "uuid": "68482cd4-d158-4660-ac58-77dbaf077e91", "comment": "Malware payload", "value": "c0afa8701d4dfb34eda856c305916b274996ad61a139083185717a89b226b5cd324e912f2affcc870a024740eda9b69f", "object_relation": "sha3-384", "Tag": [ { "name": "2 TOY GUYS LLC", "colour": "#0D9F74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634681, "uuid": "2df4d7f6-5ed7-41cb-a178-fb5c79aa6732", "value": "A1A38C2137E1D032D4A61930A8A8DB725E7EB4315B7445CB73A8067E5FA03C15B7A36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634681, "uuid": "b86de3c1-0a93-42e9-acdc-bf11f4f9e9cf", "value": "6cfb934d520c24b0ea46b97fdbfaa3ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634681, "uuid": "7a78b294-9467-48aa-964d-9f66b6ab5139", "value": "1536:zXH6qouceFkba+Ui1jdCojU9O2kqWnAnPOMVSgf3c7BCt2rhFU:7H5wbaviuT9NPOMVSgf3c7Qt2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620634681, "uuid": "8d5bbf6e-50bf-47bb-99e4-ced173607f41", "value": 100984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620634681, "uuid": "6b498f85-deeb-4648-85fb-b667d2a2bbad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620634681, "uuid": "f6221ff0-e922-4ab6-bb79-ee29938545f6", "value": "964ec94fd9c6da7090287b6217b7eedd737f4f069fa27613dbfe33260fdfd10e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f8d12f-b191-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620652219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652219, "uuid": "ca3b4138-c037-4d29-b53d-a1a795833ce2", "comment": "Malware payload (Loki)", "value": "076a6951a3ec3bcea88514a8a7bbcbe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652219, "uuid": "aa8d913e-67e6-4f92-bb7d-fd0d831f73fe", "comment": "Malware payload (Loki)", "value": "966c19d3e042b63651d0826d12929cb046e68699bf77af388daed526f461fb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652219, "uuid": "76663449-f48e-4c1a-92c0-fc9569da5402", "comment": "Malware payload (Loki)", "value": "f37c839f20b0657ad2fad73460a38d807bdcbcfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652219, "uuid": "f47a955f-3e56-419a-8371-a3c0016ce3da", "comment": "Malware payload (Loki)", "value": "0e04da348549089348c944969f1b7c8c8d1f91d2926484a989d27db753519c98d632273db35e5ddc1af431eacd310e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652219, "uuid": "29e9fe79-d1b2-4c86-b93f-3e9fabedad70", "value": "F8D449FC755464F0E35B5C23A3CF1C0682251270A93B6A1F9B6013BE5A67E273E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652219, "uuid": "4fda0729-2aa5-4d36-bed0-9d6bc9fe5c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652219, "uuid": "1da9737b-9fff-41db-af26-7705d3d8b81c", "value": "12288:0aOjoLLoS60/K7yh0pAjd4jhnaJi+SnIQIMHFdJ/URThKjt:SoLAp/hnaQIMlj/URThKjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652219, "uuid": "575b4469-31ff-4e09-ac4e-a757a00082e3", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652219, "uuid": "b2d3f564-1eb7-4b42-84ce-c991970b73f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652219, "uuid": "cc6df01b-feeb-4cd4-80f4-0557675a0118", "value": "Cotizaci\u00f3n # 20210510.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7c275c-b18f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620651676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651676, "uuid": "254d9613-653f-4d72-b2c9-031b39ddf5f5", "comment": "Malware payload", "value": "9faeb135c3b9707b14b4d8ec908fd782", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651676, "uuid": "6186abba-5e38-4562-ae1b-57f93673ed8c", "comment": "Malware payload", "value": "9671db739bfdd2febeb6de42bd5618f6c3c68608dbdf17fe94c173a3576e18fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651676, "uuid": "7f5ee54a-abcc-4776-940f-c16881054533", "comment": "Malware payload", "value": "b0f00a0de56a24fe2bc28c606a1e0dedda2b6a19", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651676, "uuid": "b0349688-ad84-4e53-b856-156a319ede27", "comment": "Malware payload", "value": "7c3e58146450ab39647f07bfddc21998c38ca8e6bcd81c2228ed8b58dc9461215cc53f665cd51e33d312158402b48d6d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651676, "uuid": "c254526e-f5a2-4381-b0f1-daa80574a1b0", "value": "21A11BB6A64D5C96D72BC6F2CA167FA30649F606D3C71786732DFA420F17223E423481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651676, "uuid": "ceb65431-d052-48c6-a67b-489af21fbf6c", "value": "96:85PW/wtwHQNM3tOCtcRARcI1jpcd1U9abF0EXAXow5:85YwtrNM3+qNWZxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651676, "uuid": "f8cacbe9-25b4-4c53-92fc-48a7c2c3af4f", "value": 4743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651676, "uuid": "6e0ddfe4-e5dd-42d2-8a93-9e4c2aa5e957", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651676, "uuid": "67a4fa68-ae6e-4443-92f7-e71dbe1ba112", "value": "Price List.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a59727-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658986, "uuid": "652c0433-af1e-43d9-a057-736a0ae7f72a", "comment": "Malware payload (Dridex)", "value": "0ef40757bb1b38d22bb517003f0679bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658986, "uuid": "8574f8f9-8426-49f8-81f4-1deb7be46d88", "comment": "Malware payload (Dridex)", "value": "969591d1518e796a427acb44d193f47365770ec8b8fdd0ac7b49be24d8f3bd26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658986, "uuid": "bf2ef5f7-f635-4061-b5ce-977820a57fe2", "comment": "Malware payload (Dridex)", "value": "1ef2720c6e4536b2eea6d96500b03dcd8a291949", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658986, "uuid": "5689e2c9-7b79-4b05-9f41-e67af11b8c3a", "comment": "Malware payload (Dridex)", "value": "b70387b3c1d9f876ef61c7f4b67a6744f94747c67262f313da7fa47b0180db17b2c737c00bb6f9fe8aa24ca57c95c485", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658986, "uuid": "dd9acfbe-27c7-4158-987d-c0424b6a08df", "value": "5CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658986, "uuid": "7c106350-956d-4c10-895d-9523f265c551", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658986, "uuid": "78ea4922-5086-437e-b23a-7acb2068ae49", "value": "3072:FA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:F3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658986, "uuid": "82e56c95-a2d0-4083-8977-dcf279f39a19", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658986, "uuid": "dedd58de-f868-4b30-a082-0d74649f002f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658986, "uuid": "aef8dd97-deba-46b3-aae9-2e10c3b13a6d", "value": "0ef40757_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0e0da0-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651301, "uuid": "63b0ed5f-819c-4aab-bf02-5486c8661e16", "comment": "Malware payload (AgentTesla)", "value": "8b42029bfe7c8aa966fb1bb9b46bbd7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651301, "uuid": "b3d8dc44-e9cd-4f68-8c9a-0730da7ced51", "comment": "Malware payload (AgentTesla)", "value": "969d7de974220c1a8067ff973c359581fa7ff0aba079a8a81537460b4e3810c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651301, "uuid": "7dcc00f4-7b0a-4474-a19e-b65a85a4d426", "comment": "Malware payload (AgentTesla)", "value": "25c7d253ec7c7b7922aeb5d615b1494a5be87569", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651301, "uuid": "968b217a-950a-440f-98e7-8c9506a85227", "comment": "Malware payload (AgentTesla)", "value": "3d2886fd368c343f0aaf72b1caf497f85ba7499f2b894a611538f0e5532b2e8bb629de1d5cb3d291594f30feaeb8bb44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651301, "uuid": "997ebd8f-a52d-4e00-a2f4-269f5e182f57", "value": "76253B69B742C080F66E14B5CDA0FBF0056ABD2BCE0A6E1702563EC6347B6578B3B547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651301, "uuid": "7956b04e-beee-43cf-971c-177ce9c5666d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651301, "uuid": "0df118cb-4cf3-4551-a908-c2f379ca6e61", "value": "12288:rMWX4Nhba65/gbt0tzpLpW64JEvozrB20ArMpcDDxfQCmdcsycc1:Q/F5/G0n9WFEYrB20qZxoC8hQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651301, "uuid": "b2b509a4-c961-4864-96b7-9807f4984840", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651301, "uuid": "63f0fcef-921e-401a-8e96-d6d399363396", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651301, "uuid": "e417ddc3-6e88-4d12-989f-b806c0d830b8", "value": "SHIPPING DOCUMENTS doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bc1fcf-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669914, "uuid": "c600a520-8814-4d65-9dad-24394c12a43a", "comment": "Malware payload (Dridex)", "value": "9cc03804ae4ca90596256af0f41abdd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669914, "uuid": "6c705f2f-5f41-42b4-a755-b08b6f75b2fd", "comment": "Malware payload (Dridex)", "value": "96a0426f8548319740bb8ab0e839991f80be92b71a3972c9016a0b6f3ffae53a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669914, "uuid": "a6f602b2-fa9e-44cc-9fef-4adb9469a303", "comment": "Malware payload (Dridex)", "value": "829175c4aaabd983192a4acdffa384b217961fde", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669914, "uuid": "bde36439-8d4b-4424-9308-b3924b134228", "comment": "Malware payload (Dridex)", "value": "d4d26024b776a360f04d9f0e305860e32c2feb3b436763ee5ec562d7aa84942741abcd52811d1591c204653ecf4caafe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669914, "uuid": "e6a758f8-4ce4-43d9-98d7-eface98b5e65", "value": "4FF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669914, "uuid": "d4bcf685-65dd-4274-bad5-c8f8ecd6e1f6", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669914, "uuid": "bbd8fdb3-949d-4c11-b7b7-6f80a9143529", "value": "3072:H/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL63:9brE1kvcB74DXZ2Melv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669914, "uuid": "c54a5ce3-b2aa-4928-8d75-50898b5466e5", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669914, "uuid": "6a85e7c7-6111-41f3-b851-f4eed5b7c905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669914, "uuid": "3363d00f-96e7-4da5-ac17-0db831ea57b6", "value": "9cc03804_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07407bc-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649881, "uuid": "fbd96da2-9a25-4029-a9c8-2d7c3e0749c6", "comment": "Malware payload (AgentTesla)", "value": "fdefdebddba0b20348b9b3f070c5d0f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649881, "uuid": "1787cb62-8859-4227-a25e-2a3cb2e711fe", "comment": "Malware payload (AgentTesla)", "value": "96a2f08072425468086bf1d8d1373df5153d821d797a4ba1963798a443e34fde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649881, "uuid": "46b02199-9e69-4b2d-8961-f40b560a3e35", "comment": "Malware payload (AgentTesla)", "value": "91e42af87e5820c229134b3f43e9121668517655", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649881, "uuid": "8221fbb4-fd41-48e5-b83d-2ea1c106ad28", "comment": "Malware payload (AgentTesla)", "value": "9baaf7425e2221d49af0992724959537d3a90fa2f85209dcce3a1ab003b91ba35fae316681c350b185af446bcf519073", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649881, "uuid": "b52f3957-1c57-4792-973f-518a7a42746a", "value": "37F4DF203BD8AA58D5BF57751970845423F6BA27C332CB0E6D9D918E2E32746C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649881, "uuid": "96541bed-21ef-4852-8c5f-ca4b028f39ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649881, "uuid": "7440c576-edf7-4586-a4f6-94158aabd3fb", "value": "12288:RsYR6m9oPXDtBVw1hhhgVqnW22zCLoSfrGaGwGP3JDR0+Ee+zglp:Rr+PXDPGhhhIVJSSBw83JDRRE3zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649881, "uuid": "6a8309b6-a318-40c2-9336-64981adced2a", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649881, "uuid": "c70b4985-137b-497c-a568-eee94340aa0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649881, "uuid": "9da8213e-fee7-422e-ba01-66febd4d49a6", "value": "shipping docs and BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0d7b3c-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651166, "uuid": "71528bb2-4312-4f0b-9edb-1e41ab4e5d10", "comment": "Malware payload (AgentTesla)", "value": "a8d86f61b12b7d0a76793e80893946a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651166, "uuid": "5e20f25a-fd41-46c5-8494-ba0c843d9bb9", "comment": "Malware payload (AgentTesla)", "value": "96aa66ce612c2948ff74cd6a362535816385937df9954873fb5c33dfbecb1cda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651166, "uuid": "f135f1f7-971f-4dfd-b0d2-fa32499df50f", "comment": "Malware payload (AgentTesla)", "value": "aef0c8945fd96c2c1610db3ce3dda0b3bd6c51e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651166, "uuid": "d2e8fea3-a127-4868-9fa0-6430cea7edfc", "comment": "Malware payload (AgentTesla)", "value": "66cca1238c215a89adc4a35fb6a58b8dae2651a4e410e1b902a61ecefc59060e2a573ec276da8047b370ac6c9806a2c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651166, "uuid": "3ede187f-1aa8-4afc-984b-fe4900591984", "value": "0B056BE2A521DC14CB87B734B1C8C94ADF203D4C8629AB9D2D677C9637AA9141DF3378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651166, "uuid": "3a2f123d-381e-49aa-bf0c-2cf095830577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651166, "uuid": "9ae3aaeb-ac79-487a-8404-83cc4f0c7823", "value": "12288:kHFMw7Y9MA59CyMAn0hO3gIpV3yfyHmUK2Xfsrjk1:kH+w09tVUO3gIf3yf4pK2XfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651166, "uuid": "792efe98-cbcc-4cc1-9ae7-72ed5f495a7f", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651166, "uuid": "5fdfc1d0-4444-4164-b221-4fec9f4c738b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651166, "uuid": "f07ad574-ef57-4538-8e7a-2c7b47bd7cd7", "value": "POTHYRDE7726262.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393d09d9-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620629092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629092, "uuid": "13a67f55-b842-4474-8766-d100fe844c3d", "comment": "Malware payload (SnakeKeylogger)", "value": "a85f748b415c166be65d7906c641a38d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629092, "uuid": "3e2cbb72-2526-411f-bf5d-a2c8229c61db", "comment": "Malware payload (SnakeKeylogger)", "value": "96f303aa8f08f2ce40449b9f640b53572d214f79db67a4df923d9ea2bff3a001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629092, "uuid": "0e42395e-95c9-4e46-b8db-dcd62438bfca", "comment": "Malware payload (SnakeKeylogger)", "value": "d196ee28a71c91033ad2c56933cb835c13cf871d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629092, "uuid": "6a051155-5776-46aa-8452-ff4464f35eaf", "comment": "Malware payload (SnakeKeylogger)", "value": "8bc6edb52b69ff9074af3e8030332546fa4875d391142a6cfe17e3968913e97e713d9de2f97d0694e31614cf7d2e8c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629092, "uuid": "db72a511-7f49-4a8b-93ba-4da5d54b2274", "value": "2FF4DF2037D8AA58E5BF87751870954463F2BA27D332CB1E6E9DD04E1E32746CBA2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629092, "uuid": "4bc0f340-e810-445e-b2e2-f282c769b129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629092, "uuid": "94fc339e-95d9-49d3-ae93-6c2458a33c47", "value": "12288:dspWOiG71XytBVw1hhhtFj4DI53inVw6jdAlma6ci+wXUi:dNG71XyPGhhhzv3Ww6jSl56f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629092, "uuid": "d8d8be5c-96cb-49f9-b39a-66ba974c591b", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629092, "uuid": "f5589bd0-f6e0-4bb0-93fd-31ba26b4f1a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629092, "uuid": "8533ff10-684f-40b8-9bd9-f684ad44de45", "value": "PDF.invois.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99484ad6-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673491, "uuid": "ffd2ba67-4eea-4cc0-9990-403ce7502e8d", "comment": "Malware payload (Dridex)", "value": "1997342320fd98c611bdbcbc05397c50", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673491, "uuid": "3f17c9c7-6164-4b3e-8d67-3ceae2a34dd6", "comment": "Malware payload (Dridex)", "value": "972265ceaa138bfc7e518a230546dacd2eb6869c52b6741976eb34ba867a564c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673491, "uuid": "408b6f2e-0bb5-4b0f-941f-fd61ad484661", "comment": "Malware payload (Dridex)", "value": "0359f40b06b05603c22798519af81e601fcaa5fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673491, "uuid": "453b0b92-54b5-466c-960e-6f904ef9b402", "comment": "Malware payload (Dridex)", "value": "bc551b35c59c9a5bb4d88e952e237eda22ea70be4c6c12031d9e0eb36ed29a5c3afc0492bb3a4adbea87f8469117a5af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673491, "uuid": "26c569de-fdda-49da-ab66-76a43ce297f5", "value": "46F3D00FD94ADFC3E6F21C3284EEB26E7E98D12A4D24E2D77960E52E5267D6901344C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673491, "uuid": "94808d50-8f32-48f7-b147-2388101b0616", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673491, "uuid": "a9bbc4b4-1504-4b81-9877-8abe36f13990", "value": "3072:v/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLKM:lbrE1kvcB74DXZ2MelDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673491, "uuid": "06974c5a-e591-45ec-bac3-34932c897a99", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673491, "uuid": "23a37d1f-ca87-4653-a25d-bfb0c7fd1381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673491, "uuid": "1763628c-76e1-479e-82ca-097e7d443407", "value": "19973423_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b847fcf4-b157-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620627587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627587, "uuid": "6292dc2e-e9c9-4e7b-a552-efaa22484deb", "comment": "Malware payload (STRRAT)", "value": "a4d0c2cbb51fefdfa1ce79ea0b5ce0cd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627587, "uuid": "0128ab45-6b8d-4ac1-b009-0f7947ab511a", "comment": "Malware payload (STRRAT)", "value": "97385c77895c2905d48a0a33f01e3e6d7e572396ccbb82ca20915d9533864b06", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627587, "uuid": "1b8e177b-87a1-4562-928e-d4e9c1500648", "comment": "Malware payload (STRRAT)", "value": "d209edf2bafbfdaacdb2587abb3352e7d66087e5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620627587, "uuid": "32763981-1349-4c3a-90c8-c71a82292544", "comment": "Malware payload (STRRAT)", "value": "a66aa3dff8fd72f6cd53ad22dad33b749bee5f20dd5e000012d54015b8c2cba9d452ed28b0d6f94f6e422d2c4f351eb3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627587, "uuid": "8d4eb6a7-3834-4fb4-909b-2434c38d53b4", "value": "D7C323B499575852826D0B3FE88CE921C4E19C3BD32D911B818527B0EB1A17DD748EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627587, "uuid": "a8b877a4-88bf-47ff-869b-e460b0f51a61", "value": "3072:iMjzyKr7L7jJCKllLC+v+ARWejcuZbXUYfz+i5:i8zyW7HlG+v+ARDf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620627587, "uuid": "c09bf489-c31e-4679-9121-f07ade6c4a16", "value": 122106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620627587, "uuid": "ed7a900f-b1b1-42be-a9e7-e5f99e938c6b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620627587, "uuid": "80c1a1b2-e228-4249-a68b-4132a7ce1320", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415c3661-b19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620657882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657882, "uuid": "b10b63c5-61bd-4cb6-9bf3-945674273073", "comment": "Malware payload (OskiStealer)", "value": "62c23b6c7a334ce961214fdc56e41608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657882, "uuid": "e22daf8b-a595-4f6a-9560-37b4bed76256", "comment": "Malware payload (OskiStealer)", "value": "9741701db793dce797654c13c8e6599ac6723583b7bb27d4184018f55d98c907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657882, "uuid": "3d7e8b91-e61d-45af-8a5e-b06e7cc6dde6", "comment": "Malware payload (OskiStealer)", "value": "f829c5ac30c603fb6762e5142a7699e518ab6118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657882, "uuid": "d707b4f2-c366-430a-aa65-4116dba2c4d6", "comment": "Malware payload (OskiStealer)", "value": "890c7de048d602b640ce08d0ac12ce28cc8d50668832fe469061cb3c6f8d03f5a0924b17e9cd36e58b217f04610e982d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657882, "uuid": "7aac07f1-a7f2-4322-97b5-3d9a6355928a", "value": "9605AD88EA948A90DD6D97785532C83043B27DAA6836E71C19DD3CBB3FFB392D01145B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657882, "uuid": "47772994-23ad-4072-a117-77da7e3a7192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657882, "uuid": "1940c28c-93b8-441f-b78a-2bd370b6993f", "value": "12288:N+aM4Y4FBK5WHa0EXHNjh4iBNyZQnoLn1DguHlhAf3M8NJyM6nAwhP7r9r/+pppf:NxFB+d3Njhdzg9ntt4c8NJyznAwh1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657882, "uuid": "08bcc47f-912a-4171-8b3c-6dfc94a2958e", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657882, "uuid": "6d0dbb8e-46cb-48e0-9835-f9c2170bf4d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657882, "uuid": "b3fd0eb5-1d7c-4e9e-8846-a9daae38d15e", "value": "DHL Delivery Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac49c6d-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620662622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662622, "uuid": "6117b881-e0b5-484f-a2e6-0b7083980d52", "comment": "Malware payload (IcedID)", "value": "c662f20f98afd7c950a9632223812ccd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662622, "uuid": "dafa9be0-a203-4318-9ea7-6c3bc3033048", "comment": "Malware payload (IcedID)", "value": "976a009ed5b0df798bf38b6c3d021abc70ba8a1f18a44b678ea5bc32e17edb0d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662622, "uuid": "9bf3014a-a1a5-40c5-8920-39051f5d7ded", "comment": "Malware payload (IcedID)", "value": "ab9f6927ad7ae8ad74c7ad4ada3e820893f946bf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662622, "uuid": "34992b85-8e76-4a5b-90cf-53dd9c0d008a", "comment": "Malware payload (IcedID)", "value": "0d6d7e5ac3ec915f9f6e6951bdb76aa629d13f3af36d6c2d3854eee4f10bcc4d83fd027d388e49c1ccd4ca098094f398", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662622, "uuid": "65ccb467-1060-4a2f-93c3-fde293a6722f", "value": "5623E119F501AC31E764DF39A96A00B1A37F4748EF5084E71C91958F7AA20B9CA8F7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662622, "uuid": "26af7be9-5f45-4cea-8b37-46811cb61af3", "value": "768:hAzEvj1rK9cs1R+Q0qhQK5g3sZ5M0jJrSJCISJsJpl4d13VQ1m9:hHxO9NR+QFhpg3sZ5M0jJroC7sJpqddR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662622, "uuid": "9dc00ee3-6361-4f41-b25c-2aef961d21aa", "value": 47580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662622, "uuid": "8218e07b-68ef-4427-a31c-08e31d550244", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662622, "uuid": "a93240db-6881-443c-b911-c32a8a8791fd", "value": "c662f20f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f019da-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658942, "uuid": "f9a359d7-658a-4561-8596-16f70748901d", "comment": "Malware payload (Dridex)", "value": "164be193b60258df67522063418409cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658942, "uuid": "58047856-c368-4a36-9212-d1c63dbfd2a5", "comment": "Malware payload (Dridex)", "value": "976ea341c224e408aba8400e426272af105c45fe40409e796bd21d5706f5e617", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658942, "uuid": "5834a728-34e0-49e1-95fa-80d3b820e311", "comment": "Malware payload (Dridex)", "value": "7029253d36bc764643701405f07dc6d173dcd6e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658942, "uuid": "43d88207-1c40-4851-a7e2-27d07ca5a9a4", "comment": "Malware payload (Dridex)", "value": "dc442afaa87f5baf32b0a05503f121e0567887cbe9db419b1a0fbaad8b234a7c26cc80f65b6265d332e6f5dfd0e49eaa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658942, "uuid": "3ea3309b-0a76-4072-b7e5-37827e8ba05e", "value": "96F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658942, "uuid": "7762c10e-a0c7-4e54-9a23-2ea915a1c424", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658942, "uuid": "520b181c-c226-4eae-ae4f-794d12a6d17f", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658942, "uuid": "c55538a5-7244-47f5-a611-17bd9cd9ef42", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658942, "uuid": "3157a113-e2f0-44cc-bc67-b8174502b400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658942, "uuid": "883d5a91-285e-4db9-8702-2191a2ffaac5", "value": "164be193_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b492ec-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687717, "uuid": "82650225-2aff-4451-87a0-02fffc2f5a82", "comment": "Malware payload (Dridex)", "value": "b879837a7942d04324ba600d34beefea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687717, "uuid": "ca61414e-5a93-4eec-a1c9-2e0288f92c08", "comment": "Malware payload (Dridex)", "value": "978bd83241398c55d8315165fff1347115d5549bea30c4362eda247162536651", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687717, "uuid": "3b975b39-93b8-400f-833e-f454aef30f39", "comment": "Malware payload (Dridex)", "value": "587e2241e4d72c2a058a862ca538905a7d6e48b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687717, "uuid": "e63ae107-1636-45da-b5c8-e81342d7ab57", "comment": "Malware payload (Dridex)", "value": "d360015444ddfb7aed9204cab7b6f7a4afc75bede0b6dbf7479973585df16f9974dd6226992d171f73ae8ca48472ec08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687717, "uuid": "aaacd0dc-17d8-4684-9255-1d6a3f175395", "value": "7AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687717, "uuid": "44cc4ec0-7cc7-4bd6-ab25-b3057cb599a0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687717, "uuid": "5e9c829f-0f48-4028-a252-01b48a40070a", "value": "3072:1A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:13J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687717, "uuid": "39c3ce86-4e5c-4a72-856a-a4b2ba1e2e28", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687717, "uuid": "3dae8815-f195-4d79-b6fb-dd37e59c21af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687717, "uuid": "9d8c8698-0570-46d6-9e80-fb41545e522c", "value": "b879837a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d57a97-b158-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628113, "uuid": "3662905c-ed02-494a-bfcf-fde7d1b9c2c4", "comment": "Malware payload (AgentTesla)", "value": "8a6bf0ebd9412511444cdc95cbd49c3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628113, "uuid": "5239fdda-0f51-455c-9d71-c7f328b3a8d4", "comment": "Malware payload (AgentTesla)", "value": "9839c831cb2cffcee3b69473bc827dbc5b2c0b194fe5d6a81e6e5dc0b2357e13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628113, "uuid": "17880ada-41d1-4d46-870d-2a15bd4b3b98", "comment": "Malware payload (AgentTesla)", "value": "34500b94814326f33f0e7ac168cfe1d19e42d155", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628113, "uuid": "c0897f09-5818-4b9c-b0ca-adad0d42152b", "comment": "Malware payload (AgentTesla)", "value": "46b05c9040cc55868080d264cb11e06233d3787529f666fcd89ca658e417030a7295fefe3b1f2ca4eca2567a4f8dfa1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628113, "uuid": "41db4269-0cfb-4213-9067-6e45fb5d1bd0", "value": "E0157C1136BCA5C6F56E6F7224A4874826F17D1A8633C12EF94BF2EDC937243C6612D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628113, "uuid": "1fcc33bd-8086-4d04-a0bb-5447d1906cd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628113, "uuid": "40963172-b8e8-4962-b54e-a6c20ec6218f", "value": "24576:kIzeX7PGhhh5RAlYcW8lS2Qdvsw5znREReFco:LeX7Sr3dkmzCRAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628113, "uuid": "7c0defc4-3cfa-471b-820e-8bd2bd6a34d1", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628113, "uuid": "bea6edac-9e3a-4866-9f18-b777177338d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628113, "uuid": "45169011-3ee7-4e75-bbb8-9ba438f05426", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c526f74-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637311, "uuid": "1f3b5ad8-5dc8-4901-9ea5-1c1e82560b59", "comment": "Malware payload (Dridex)", "value": "d602fff25e26fab44dbb11e398cf915f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637311, "uuid": "3123c981-46ee-4ad4-83d2-9661ba72332b", "comment": "Malware payload (Dridex)", "value": "98a6b01119d34b98bfd0faa9c780983fe6c83a3389d15a958c9be9e96de7c452", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637311, "uuid": "66a49ab7-61c1-440e-991d-c801c8740634", "comment": "Malware payload (Dridex)", "value": "2a3d2dbfd7bc62c5c0e8da6d2d866672b3438e13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637311, "uuid": "fefefe76-cffc-4f16-880a-33e4fecc7079", "comment": "Malware payload (Dridex)", "value": "6469d68a5ebaa7224675280f46a8df7e6404b1822697651f34fa5a8ee17a16c272e6b6f028bc596601a81ad02d0cf54f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637311, "uuid": "98fa7182-8b0a-450b-a90e-590b0043ec76", "value": "E6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637311, "uuid": "ec30d11a-2a64-4f00-b570-1d7a48ff5d32", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637311, "uuid": "d3b01809-abb7-4f0e-b6cf-05b73c17a27a", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637311, "uuid": "6288c0e2-0623-4830-9d17-56ff1e6eaab1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637311, "uuid": "d8f01125-7149-4dbe-8f62-f88efeb1de5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637311, "uuid": "714a9207-78f4-47fa-9553-461ee821c6ea", "value": "d602fff2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5ea772-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666279, "uuid": "9fc49b06-d686-4f61-b011-d5940afd1858", "comment": "Malware payload (Dridex)", "value": "64160e38d627e24bf5ad36b27276e029", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666279, "uuid": "ec787005-dc6f-4a77-b37e-7f3fddc4baf2", "comment": "Malware payload (Dridex)", "value": "98bc63c1139e3a5ab35f95e194d09ee463d7274ae1b4e00162a372a290b01ba5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666279, "uuid": "9e4b8183-f9fd-43a1-9358-bae858b703da", "comment": "Malware payload (Dridex)", "value": "32adeff227ab4b7bc497a17a19f58749fa771313", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666279, "uuid": "5c5d79e0-0999-4c73-8d6b-a715f71b2d5c", "comment": "Malware payload (Dridex)", "value": "c843441b98b74b2a1a7b11605da37197423363566a453397336f8c701bcd7bf5ce5e73f08d6ba43280b2c5602d8b86a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666279, "uuid": "ac96fef0-370e-4439-a607-d53343448c73", "value": "12F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666279, "uuid": "78df7401-bb08-44cb-8cf2-34c7ebc5fe15", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666279, "uuid": "18390836-a6e6-47e6-a381-d0ebd81114e2", "value": "3072:MiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:veAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666279, "uuid": "e3b512d9-7c6f-4849-a012-7ed6edfef6ac", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666279, "uuid": "ab548380-ba5f-42ca-b690-50fc8b4d297d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666279, "uuid": "816c68bc-6274-4a71-bb37-340e186a9d35", "value": "64160e38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a034fbac-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620649022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649022, "uuid": "4115420b-ba88-4ad5-a561-4c9165f0082b", "comment": "Malware payload (RemcosRAT)", "value": "beea0097e35ea9c47d1c0ec478f7624d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649022, "uuid": "826fcb18-c337-43e8-9642-7683f1a7ae0b", "comment": "Malware payload (RemcosRAT)", "value": "995f29caf80a4902430611c45e0619adbcd60e3a9f283a562fce6bd7baebc075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649022, "uuid": "b793b678-cdb6-4ad1-aeb0-1b6e54ff478e", "comment": "Malware payload (RemcosRAT)", "value": "d46c5f64926516dc511ce266ad9a82233c52e8ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649022, "uuid": "e8dfefc4-9b90-448e-9318-ecd1fe5199ba", "comment": "Malware payload (RemcosRAT)", "value": "ff0b5f438f98d6b59ca75f1a4cb53a7688afdaca2d4af86134cbfe968099b13ffe32d0fe1a5648681f0250a0d7cf168d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649022, "uuid": "363bce0b-6f51-4afc-a088-e0d3e7d513e8", "value": "55F48D21A2D14433C0AF4F399C6BB27458357F9029F824B977F4BD4C9B7A6817C2929E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649022, "uuid": "0e843653-e60d-416b-9f4e-3a73061a2a15", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649022, "uuid": "7e530c84-e0ad-4c25-b623-2a930abe21eb", "value": "12288:8rnWDrl98a7LUacm7sbiD97T5QM4Pr4rvU/Oy/:8rWnZnUivR71B48rvUD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649022, "uuid": "1b00131b-46ba-41ae-99a4-fc7acfc09152", "value": 738968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649022, "uuid": "646cd965-3c2e-4d45-9eb7-ddf7e770cd16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649022, "uuid": "bf6ec09f-00cf-4b0b-b425-795bc79bc580", "value": "SOA_IN APRIL2021 CARGO.CHINAPGL...Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e312077-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662521, "uuid": "67a872f4-298d-4bca-af96-68efd7b20304", "comment": "Malware payload (Dridex)", "value": "6f31479296345f80539003295fb2cbb2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662521, "uuid": "e233543e-01a6-4827-8708-1673a84c151b", "comment": "Malware payload (Dridex)", "value": "9a1a744f3b50c212c36692ba730a6e88f61790f8f7c433863d78b54af78b4a5b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662521, "uuid": "3514c615-90a3-46e8-a3bf-22117374e28b", "comment": "Malware payload (Dridex)", "value": "9c16bb108a7fa4aeba1e02953e9333286af2d87c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662521, "uuid": "3c8e4004-9e52-45f2-a364-bca932a28fa0", "comment": "Malware payload (Dridex)", "value": "f1cdb43633d026ec0674c427dc172a4a8ab91fdb27a8f0a3d28117725d3d5abd2340d3be69b889890df7849a24bb93c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662521, "uuid": "1b5a7d2b-fecf-4eb1-ab26-be9648272b36", "value": "6EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662521, "uuid": "7af5040b-a04d-4288-a4d8-3f8817132549", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662521, "uuid": "3397c303-cf00-452e-841a-13dabfff51a8", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662521, "uuid": "8b8dfbb0-880d-4669-a973-968192c57602", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662521, "uuid": "d3a59fbb-9dc7-4f2d-86d2-b5fab971a41a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662521, "uuid": "05bb7192-36a0-4695-b629-2550e426bdc1", "value": "6f314792_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124e3a58-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628168, "uuid": "3d2da47c-0c8e-4ad2-bdd9-e5de47052b3f", "comment": "Malware payload (AgentTesla)", "value": "ccc52357e9489ed0ce0f885624c31074", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628168, "uuid": "9c523994-d8f8-49d1-ba36-6d66d53929a8", "comment": "Malware payload (AgentTesla)", "value": "9a43db92479241f1ebaa278aa48333a9c0c80a71f0ac6befd9b3ee60965f4b9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628168, "uuid": "ed830068-5e85-4dfc-b033-6b841dc07b26", "comment": "Malware payload (AgentTesla)", "value": "5ee0c0f7ab556324e9d45f97fa6e02bc759d156d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628168, "uuid": "a997f418-796a-43c4-8c64-63ac21be8e48", "comment": "Malware payload (AgentTesla)", "value": "480e8510d45916af3ac8881e1b1076a10b2322881791a43150720d857f3ea58df33be473d62b26bd90ae8f06c2208a5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628168, "uuid": "6d9e99ca-cb6d-4479-8f91-2c5d729b1f33", "value": "5DF4DF203BD8AA58E5BF87351930C15063F6BA17C373CA5E6ADD914E2E31746C6B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628168, "uuid": "69f0092c-f153-41e1-a821-d8dffcd13ce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628168, "uuid": "1895fd74-126d-4bd3-b57c-6f58937282eb", "value": "12288:2IDdH036LXYtBVw1hhhwYAC5jZ63OR3Wu0j8zQaucylTC:2RKLXYPGhhhwYAyjZEKUYQaYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628168, "uuid": "e5d55da4-2c76-4b7e-8786-29e77d59e63c", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628168, "uuid": "899b1b60-aeff-4d94-8d67-586a9b8f1bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628168, "uuid": "6241ca65-e9d7-4c60-8034-0c7fee0998a1", "value": "wire payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7b3e14-b1b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620667190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667190, "uuid": "22cffe6b-3a3a-4ab1-adbd-8c56e0e9f585", "comment": "Malware payload (Dridex)", "value": "88a1d98c0bbb8eac1d9a6469d9037396", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667190, "uuid": "27c27540-d813-4ffe-95a8-8b2adf1b18e9", "comment": "Malware payload (Dridex)", "value": "9a7247ef703b1f088c19aa258405ef04ea07521351becb42820bc7e1d48ce0d8", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667190, "uuid": "ffdf3f5e-6b3f-4d5d-9a84-fe7ad64db1f3", "comment": "Malware payload (Dridex)", "value": "3524ef222d190faad5999cf8127496d85cf5fe9c", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667190, "uuid": "9722f8b0-1bc3-42aa-b143-98881465a891", "comment": "Malware payload (Dridex)", "value": "4936153e6d007af42d20a448e212367d7eb2f1956a15dc8ec35fc50226caf92ddcc49f32eaf542ce3a110fb6e2d1d984", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667190, "uuid": "417c33f6-96f2-41e9-8997-649ff814a623", "value": "690633EA250CE568E4459D7A293978B4D1C4722BB940C43F7FE6213617B627224FCB1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667190, "uuid": "8f686579-a365-4009-9be7-caae16fc458d", "value": "49152:mjv5dRB35aUszJ8Ltu+aAayZ4HmPxYJxlR8aZ2rtKuekhg+DwOo4w42noLqTgbHm:mjvzGUaAZwmZYJTWvrrD7q4wvng3p6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667190, "uuid": "4877a00a-86db-4b6a-9aa3-0a15e2d6c059", "value": 3720806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667190, "uuid": "fbc149e6-eb27-4737-a965-467e51ca1e21", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667190, "uuid": "8bf17270-fe38-494c-a792-4efd2f0f52a9", "value": "generated check 8460.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9021d5f6-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620658873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658873, "uuid": "6333d495-b441-4036-8668-17c0f698d1fe", "comment": "Malware payload (Dridex)", "value": "0d8476a009b8a7e010544122ba169507", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658873, "uuid": "6393077f-4124-4716-a594-48d58a8e8d91", "comment": "Malware payload (Dridex)", "value": "9aaeffb2ce09b1443d9c9a13496248c646c7690db8b8bbec9324ca1e70e9dac0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658873, "uuid": "4b8a525e-7e81-4770-8596-8c94271f7704", "comment": "Malware payload (Dridex)", "value": "a76b2ce81372decf1f6d4183e64aa8eb6ac3266c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658873, "uuid": "33ac1f37-f771-40a6-8adf-3ebf425e4a0c", "comment": "Malware payload (Dridex)", "value": "7b18294e36fb1bf4fe099f5af03dd2268332f7f8f13ed2e5e7a0f71b1925cff5b630d06df6103da6060e60a971f33119", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658873, "uuid": "1567e3b1-f84c-4b35-bfc9-b31b3129888f", "value": "ABF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658873, "uuid": "f5627a13-6fcf-496b-b469-648c623050a3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658873, "uuid": "390a4308-8197-49a7-a619-eed6aa3ef1a4", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658873, "uuid": "debceb89-de62-4298-8036-840394b7f6b6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658873, "uuid": "24444343-0698-4df0-91a9-8ddabfe2097b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658873, "uuid": "fbe332f4-6e42-4f53-aab9-6a54ca07dd58", "value": "0d8476a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28bad5d-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuasarRAT)", "timestamp": 1620651254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651254, "uuid": "14e1130a-4bc2-41db-91b7-207bbf9b707a", "comment": "Malware payload (QuasarRAT)", "value": "99041ce798087e4d7d1396e8140e70ac", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651254, "uuid": "629a9c6c-9dc9-45da-9a48-cc8969f26eb5", "comment": "Malware payload (QuasarRAT)", "value": "9abfb60a643a4db9a7013e6560270f355f2f71d09eb294603d22649195d49f95", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651254, "uuid": "1269bf7f-4bb4-4963-81ad-517b07b4f671", "comment": "Malware payload (QuasarRAT)", "value": "688d9471ad594ff324899d711d755dc8d8e44f0b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651254, "uuid": "a9b8b917-79d0-4ce1-9fa7-e14395beaae6", "comment": "Malware payload (QuasarRAT)", "value": "f1949a0e56edb10ca7a51f62f7c59cab8d1d4f6e7874d5b260bbfe36aad1cd70990cc34395ef9e24e67963108f6adf5b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651254, "uuid": "473d025e-d9e7-422d-916b-0453f663325b", "value": "25440143B393C211C90C58B585EB255013F3AB866E73EA4C3D9D035E5F833965EA6F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651254, "uuid": "ea74066c-5c30-4e49-ad21-eb8621ceea26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651254, "uuid": "b6ab0f38-6c31-45c5-aac4-0dbc51b18360", "value": "6144:5L9lMalc0EKmtr0lLSvnzzflWmOi3FI7O/E7n4QC/T:5L9Nc0arGSbzJ1IiE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651254, "uuid": "4f7c3a86-6105-4c23-878d-8622be88560c", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651254, "uuid": "868f719b-bb34-41b9-9851-a10c52677a31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651254, "uuid": "9d14c4e7-da00-44b0-a505-f0c2e813ec2e", "value": "dhl_pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ca2a0a-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673479, "uuid": "4b6ec24f-d1b7-4880-8f47-2115026d4d69", "comment": "Malware payload (Dridex)", "value": "69cc3f13d2124615e3a7f34bfde7db30", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673479, "uuid": "c5a7d8ad-2b89-4ac0-9d80-dc16f9ff7261", "comment": "Malware payload (Dridex)", "value": "9b2121faa8cc4cd30de0d3c1a68892b0816801abe0329c4175166954de37bdb0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673479, "uuid": "525f3dd9-64d6-4ccd-9018-d11c34426c49", "comment": "Malware payload (Dridex)", "value": "726aaa0584d407fb87941a0ea61a445eb3ebdb68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673479, "uuid": "ac4c0ee3-9fa7-4ca6-965b-b120f731c2d7", "comment": "Malware payload (Dridex)", "value": "a6838d3b111fc6d4edc7d15a0d8083781d22c31b88ca46c981822afd6df5038eaee5948d18581cda2a69153be4e82fe6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673479, "uuid": "aff56b51-043e-46c5-a4a3-8709c69d52b6", "value": "45F3D0905A9BDF0ED9C13CF96AD6A879B073458D811FD6B4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673479, "uuid": "476f8087-e840-4b12-adc6-7a9df84ecf60", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673479, "uuid": "86f6ce2a-bca1-4362-9ecf-5d1cb9673310", "value": "3072:aesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:s4+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673479, "uuid": "b096e9c6-9738-4e27-a00c-f2de2a187f2d", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673479, "uuid": "30e83775-9cea-4d74-a4b6-2a4acec79a0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673479, "uuid": "73b93e5e-707b-4c0c-b105-95c4274d823c", "value": "69cc3f13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56dc8f1-b130-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620610832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620610832, "uuid": "abe766df-b3f3-4b46-b1f3-2804b9ef7778", "comment": "Malware payload (Loki)", "value": "34802ebdd9742addc8d18d98cfc48226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620610832, "uuid": "d0386582-50f4-4766-867c-504a1ea5e4be", "comment": "Malware payload (Loki)", "value": "9b33aa5d589e8c96c5cacc230d7f800796488288f33e29df921283c7af14d78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620610832, "uuid": "07d07194-87f0-4c48-84a3-95a4277127c8", "comment": "Malware payload (Loki)", "value": "67dc6df326a4254c775df363d7531ef519713012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620610832, "uuid": "5c164c45-42e3-40c9-9d9c-c9894f7fc748", "comment": "Malware payload (Loki)", "value": "f9e9ea5cc4526b5e22c8f45e7417e8343d70452fa8899e197d10f83b6b86379affaf12c397a6ad78abe67e5835e14067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620610832, "uuid": "f4e7b0b7-8bad-422b-bafd-770527a5bc91", "value": "B535079D365076EFC85BCD329AA81D64EA9074BB830BD243A05715EDEE4D987CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620610832, "uuid": "6ce8c660-5f2b-4c44-bb79-20c4e2997c60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620610832, "uuid": "ae00f00e-488c-4474-8bb6-af080b8da79f", "value": "12288:O7CY4EfSucNiQ0pnGMI9sDLRf4+8HU44EbeseuCeRnxPiVWchMYq10wqEasMnlOF:O71fyVwm9of8T3besA6xcWch1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620610832, "uuid": "91d98cde-1506-43a4-bde5-7d5612cab493", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620610832, "uuid": "36eda48a-e2cf-4af9-9a46-2694ed58bea2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620610832, "uuid": "8e004ae9-1133-4842-872a-2a7567bdddc1", "value": "b0YXIQaXcjPgzWg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa8de42-b155-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620626714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626714, "uuid": "6d15048a-4c26-43af-afdd-09132c769283", "comment": "Malware payload (Dridex)", "value": "30c664faa3f1bc6b1236232f00e78002", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626714, "uuid": "135c59ae-b28a-45c4-b30e-5a15122e8f3b", "comment": "Malware payload (Dridex)", "value": "9b718522e900c0bf22ee64b6900a3c013be575c9a441114df942e701e49184d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626714, "uuid": "8373ed57-f90e-4a16-95df-0d937da8d330", "comment": "Malware payload (Dridex)", "value": "b38edea7473fbd02f6a2ffceb4f478e717684b5f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620626714, "uuid": "7c6d99cd-aa96-480f-9c87-e4a9eeb9298d", "comment": "Malware payload (Dridex)", "value": "b6a41feec519741e80f8c03555cc3d45ffc9f8ed1a0545d446aa2566a835c569761daa8bddefa2afa9c7dac693e62167", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626714, "uuid": "b0086120-3642-485d-b558-9704ab425080", "value": "46F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626714, "uuid": "f7f67200-dedb-42db-9cb5-c92d2d702b73", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626714, "uuid": "b91131de-1ff4-4377-8003-be3df64b1489", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620626714, "uuid": "1ed42630-b65d-4d88-a2e0-36c546052163", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620626714, "uuid": "12c33bfb-ce07-4da4-a911-a597c3c3be22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620626714, "uuid": "fe0e2ee3-935a-48df-9cf0-840609c1b7c3", "value": "30c664fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc37f343-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673577, "uuid": "8ec98694-140b-409a-957a-537cd7ef353f", "comment": "Malware payload (Dridex)", "value": "cf0bebd813caada1dc0b2dd52d3a8ec2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673577, "uuid": "48f1ea7b-3bec-4d6a-94ea-d812fbaadb56", "comment": "Malware payload (Dridex)", "value": "9b7f6318de42f58a82f2a6523b6afb22ed0ee640ad4765e7443b4a6d62ace4a4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673577, "uuid": "680c9fcf-ce23-443b-87d0-fadfd575a51a", "comment": "Malware payload (Dridex)", "value": "4bd7b9db128d386b03dcfa3b5aea4945d59fb23a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673577, "uuid": "f64813d5-0353-4d32-a5b4-d9b231390ba6", "comment": "Malware payload (Dridex)", "value": "3afedd4a3024dc14f50e5006e2ac2728bb24be9bf0eba12cdc9a97a49ee260ca72da55275d5a8735b1af07c972f4d27d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673577, "uuid": "214287bc-a154-47ae-9098-2700e43a9308", "value": "76F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673577, "uuid": "d8734392-5223-41ea-b6db-a7868a2ae77e", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673577, "uuid": "856ebac7-9174-4c1b-816f-c32660e906c5", "value": "3072:Eesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:+4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673577, "uuid": "efb724f4-93a0-4d62-9ffa-26700f860210", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673577, "uuid": "9b3f0898-ed6a-4094-bcc1-d2c3747a25ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673577, "uuid": "8e2782da-4726-4a7d-b7b1-7846cfe0becd", "value": "cf0bebd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba88765-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620655349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655349, "uuid": "8714de08-8674-4849-9be5-5d065a98add6", "comment": "Malware payload (AgentTesla)", "value": "20bef858768f5bab66fc0864c57b973a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655349, "uuid": "cf816431-0dc0-41b5-b9b4-777628d6a599", "comment": "Malware payload (AgentTesla)", "value": "9bfdb2c8e708e511affc90d540bb78583fd469e0af20cf8bbe96bc4fd0bfa16f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655349, "uuid": "28897e9b-8b93-4e87-813d-aeb290aed4f3", "comment": "Malware payload (AgentTesla)", "value": "5b563f39fc09ec9897760e79845bae6c570e2053", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655349, "uuid": "aaffe70a-cacf-4329-83f6-a68dff465600", "comment": "Malware payload (AgentTesla)", "value": "13de351a17cf473a845961f8316e8ae3eabce5f84a6fc021105c41b51cc3e6b86896de7bb58de4f0955d8b434c052a33", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655349, "uuid": "3c939619-e97d-441a-a58a-819e4ac9524a", "value": "47353316EDA9801545244AAACE237FDC4FBB36491B733EB0F4A5F767EE00F710058A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655349, "uuid": "9bce5aac-38de-48a3-bacd-c0930f0e0688", "value": "24576:UBKfAcS6C9S24OyBjRL1KV1V45j5QkNrUwJG8PoaSOHWAITlYAHGys:VAQCt/UR1K1VYj5QkNvFTqAITl5HGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655349, "uuid": "bb80ae7d-1d03-479e-b91e-adf16d01357f", "value": 1103841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655349, "uuid": "eb2d358e-ad41-438b-82ad-abd786df5bda", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655349, "uuid": "fd09f789-6f59-424d-9c0d-7c60714c55f5", "value": "20bef858_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d1031b-b137-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620613834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613834, "uuid": "1f44c566-b477-49f3-81cb-507385c6227f", "comment": "Malware payload (AsyncRAT)", "value": "cc5709a18a0a6ac648dfd8adaaf5c3a7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613834, "uuid": "f64162f4-c332-4100-9b92-95d75fc5dd0a", "comment": "Malware payload (AsyncRAT)", "value": "9c5f7b56a45f41ab3d9f7cbdff363a4d738c59679f073af932ac8e1b483075f0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613834, "uuid": "9e9228eb-24a7-4188-a096-37fc7aef8ead", "comment": "Malware payload (AsyncRAT)", "value": "7197ea4eaf157c2400d7d345658e18cba5cdfc0e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620613834, "uuid": "12eb2061-70b1-492e-a9cc-b0442593d478", "comment": "Malware payload (AsyncRAT)", "value": "a81ecf7cfb9671a852fbac2e96f2cb3c0ae7b8e82f02aee0212562dfe91af999e0dcc535a476edfbb043c0702b38e196", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613834, "uuid": "59471708-b5bc-4dba-b7f7-79974a56aecf", "value": "56A4D040E90DACD9E7E5D5B3B5768B100975BEDB92F9819F2269330452B3BC321B7C0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613834, "uuid": "5aa99bd8-8a5a-445c-a6a1-3e9396ff5537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613834, "uuid": "c493da7c-58b8-4123-9e66-1bd63f7b215f", "value": "6144:gptIVqv8/tMw7Vns3no7/MXMA59C/2h4T3wn6Frucf4IDgVDAFzBA3SrO5SK3j4e:THFMw7Y9MA59CyMAn0HfVrBTFyjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620613834, "uuid": "db12f072-49b7-4e3c-9ae8-23973010d5db", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620613834, "uuid": "40c2c43d-6081-4d0b-978c-a2045c2a94b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620613834, "uuid": "31688f49-2902-4d9f-9679-129ef260aebf", "value": "PO#42038-3524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee9e022-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669904, "uuid": "d86e7cb9-306d-4bac-bdff-3720cb1e10db", "comment": "Malware payload (Dridex)", "value": "f871835b57ac0c2296a2b1bfc2863b63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669904, "uuid": "d7700abf-6220-4f9e-878d-f0e5fcada41f", "comment": "Malware payload (Dridex)", "value": "9c83d57bb5b01dbf7c7f7b28368345ec0cf32f6d07ead87b1ea971ca7d9617f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669904, "uuid": "4eaf1b22-6a38-4b91-8ee8-0170f5ef45ad", "comment": "Malware payload (Dridex)", "value": "cdc4f2bef2e8a530b8a7ac906a7c8c2310d72bca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669904, "uuid": "5ebe3f97-f875-484a-948c-2979c44845c2", "comment": "Malware payload (Dridex)", "value": "eb80a079ca815b4fbc52291e1150a34e675ddee4273261941e8e8694aa4c1dd8f0360215a4414c24fcc923ff1e4b90f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669904, "uuid": "ff7b8a44-7773-460e-8d83-d5adc2be93a4", "value": "E6F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669904, "uuid": "8ce899f1-e5ca-4e29-9cee-2098b78b096a", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669904, "uuid": "7f05da43-386d-4f3b-88cd-669ced58a949", "value": "3072:J/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLss:jbrE1kvcB74DXZ2MelZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669904, "uuid": "ea3ecfd1-ebbf-44b6-814d-ff10f9e55511", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669904, "uuid": "7d8244cd-5296-4244-a089-dbeb3bedc5af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669904, "uuid": "5037233c-b60d-40a6-ad22-e98912b2b78f", "value": "f871835b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3315dbc6-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669025, "uuid": "4c29b0ce-751d-4e2b-8939-4b06dfaa5467", "comment": "Malware payload (Dridex)", "value": "5be679689ef0b790f96d52f8d08f0c19", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669025, "uuid": "a47d1677-aa35-407f-bb3d-700d873b921c", "comment": "Malware payload (Dridex)", "value": "9cab036b2947d46e08706314ac7f4c48908aba38a794568174758d5b55027799", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669025, "uuid": "dd89811b-6825-4ea7-9673-d16bf641fc4e", "comment": "Malware payload (Dridex)", "value": "d896efae48def6656d52f78149cdec051afb7517", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669025, "uuid": "d4ddb641-cc69-4395-8c45-0e1c897ca502", "comment": "Malware payload (Dridex)", "value": "f1fe45e9e0c1ccb9e10c0d411e850eed876f1c6eb5e38edb6e0e1bf87d608d12419ed2cbe00fbda628e4ed263d8e6f5b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669025, "uuid": "e60a98cb-59e3-4815-93a8-3ebfd16c024d", "value": "F0063380B85F0B70F6F6DFB64934893156AC1D29FC87F9650D30D1E6E082A3944DAA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669025, "uuid": "dd95ec75-c16d-4b82-bf04-5e796bc2a404", "value": "98304:gjp4ILZuGFJoOk9kemT77pJ5EZn+IZyVGpuXxlSQnD3DjRoqx7VS:gyILUGFJoOkNmT77pTO+GyHhwQD3DNVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669025, "uuid": "873d0a87-72ff-445f-9de9-a62e2ede10e2", "value": 3806710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669025, "uuid": "37475418-51cc-4e00-ae63-374bd0462076", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669025, "uuid": "dfa3c29f-673b-45f1-a155-7b87f6ec8357", "value": "scan of invoice 4366307.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7578f86b-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620628334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628334, "uuid": "a6d09b50-0c2c-44e9-9ad4-5f27a67bd2ed", "comment": "Malware payload (Formbook)", "value": "4c6e32d434ac2e1945c9eaab7b98dfd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628334, "uuid": "9911f2d0-efd3-4e7a-ad2a-4240a455dcfa", "comment": "Malware payload (Formbook)", "value": "9cc9de672d4ca190743ce79b149b5c2cda03ad8cd6d9a1d72e4230c7d4b98b30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628334, "uuid": "06eb6833-25c4-4114-9f2f-3d333eb72e69", "comment": "Malware payload (Formbook)", "value": "3bf83560da56bfc29630a69018cf53e778b108eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628334, "uuid": "5de9adeb-30be-4814-9254-dd60eafc7355", "comment": "Malware payload (Formbook)", "value": "fc50928385cfa3270ca2b491775118f576d0912dd5e768538069772df6018e49d62ffdcc9ae255b990b1a88625b8342a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628334, "uuid": "a3f17259-0e37-44ef-beb6-a73c39224962", "value": "30F4DF203BD8EA58D5BF97792960D54023F2BA17C722C75E2D9DA14E1E32781C772B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628334, "uuid": "59cf7acd-d87f-445f-a824-298ec05741bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628334, "uuid": "82de83cf-78ab-445c-a4a9-7094b97e2260", "value": "12288:WWQxjK+4dX2tBVw1hhh40u4AFyzcC9mfrmMt/I62eIoPIzpdP60ugHC:WOxdX2PGhhhRuV0zcr5tA62eIyIPC+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628334, "uuid": "947041eb-c8e7-4854-95a6-68bcd8f5b2af", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628334, "uuid": "31902409-ff84-49a7-89d5-273d1cb9fbbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628334, "uuid": "f50030da-c774-47f6-be61-7b3a895f49fb", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a630b1a7-b196-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620654615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654615, "uuid": "981d3c93-59ee-4ad8-87ea-029510ef9af4", "comment": "Malware payload (AsyncRAT)", "value": "79c2829462f93369a51e457bd69e1161", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654615, "uuid": "2de71d5a-dcbd-43c8-b4dc-f897dd17952c", "comment": "Malware payload (AsyncRAT)", "value": "9cf92f5d22c8cd21c4fc2840d9d4d675dcc49f04279eb5caa1d5b880721e3ae0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654615, "uuid": "7f665acc-cfcf-47b9-962b-a4d4bdf9e3eb", "comment": "Malware payload (AsyncRAT)", "value": "3f8da577e76a6146b25113d463745c101c3e2199", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620654615, "uuid": "f2ad2100-ccf2-471b-b87d-207516c3796d", "comment": "Malware payload (AsyncRAT)", "value": "5e9e27542862e9d0fbf9a9a8d900a8133adf654353ec121e236a039bce216d6aa98773420691f56b113483e29fbdcd1d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654615, "uuid": "4887ee77-4ee5-41d4-bc16-4c8d5af212b2", "value": "C1233B0037E8822BF2BE4F78ADF26145867AF1673603D9491CC4519B5713FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654615, "uuid": "5c4d7d66-7c9a-47a0-bf1b-ef5770706a61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654615, "uuid": "b822afcb-851f-4da9-b2e0-6594cc8b529f", "value": "768:/uwCfTg46YbWUn8jjmo2qrDpTzEKEOPI3zjbSgXhi0NC6J5iZ+S/IAqEBTBDZix:/uwCfTgp/2sCP333bVXw0sgu3B1dix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620654615, "uuid": "fe1b6674-e2bc-47a6-9957-a7fba457e0a7", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620654615, "uuid": "0be88c06-144b-48f4-8a4d-66150c4876bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620654615, "uuid": "98fab969-d819-4153-b74b-9a25d8cb06f6", "value": "79c2829462f93369a51e457bd69e1161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdfba4d-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620630553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630553, "uuid": "3f911563-cd8d-4b66-8488-7efff8f6e5ec", "comment": "Malware payload", "value": "5c5db2ecf605cec8c81c84e608cc0fe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630553, "uuid": "9c599fdc-27af-4a68-818c-71ba28304b89", "comment": "Malware payload", "value": "9d542ed69de6b74364be769dd60d8613dfe533abbef25a8eba275b27bfc7f5b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630553, "uuid": "2f32edb2-a8bb-4e9d-b059-3ae0392db610", "comment": "Malware payload", "value": "0e3362f56cd66c9d52ba498cca7466397f315d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630553, "uuid": "7339e0c2-9fac-471b-a4c2-b7c88e7ccb76", "comment": "Malware payload", "value": "5df168dcb06aad8874343f7b10fdccf03ccc5f1aa721c1136d0450354ca1bb758da9998b13b093d2bd9fee035837e599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630553, "uuid": "c8f1b72c-5cd4-49e4-8d40-5e06c08764b9", "value": "79D4BE253388AF55D47EA7391531440023F2BD0BEB21DA4DBDE674CE5AB2F818627B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630553, "uuid": "87503224-8987-406e-a98d-03cdf40cb379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630553, "uuid": "8db3f7c8-43ca-4dec-ac27-5e92d102926e", "value": "6144:BeZ/73KSikZmvAScMzl/5nDXCQES3Tg3oT/V5RDmxOe32myqgFtN5yf2XjO5/yDI:Ml739MjXS3opDm0ekFtN5s2CpyYnyy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630553, "uuid": "404234ac-7b4a-414b-ae11-154c4a56c70a", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630553, "uuid": "39139f75-2b9c-454b-ac38-16f106e86586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630553, "uuid": "966c87f8-d4f2-4ce2-ba3d-0982f34f672f", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca555a9-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673524, "uuid": "875dd09b-b869-4a8e-b7a9-c8539f142d0f", "comment": "Malware payload (Dridex)", "value": "5db003b0a75ebc5d8c93f843f3a8bc9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673524, "uuid": "5f0cff52-8d90-4784-84d1-514f6debe697", "comment": "Malware payload (Dridex)", "value": "9d55cb5aced365cf4a7e9c6bcdc06a7ef93bb518e1b5ea2c09c42fcfa3e83fc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673524, "uuid": "ebdacf20-f49c-4ccf-abc7-c47631f16a5c", "comment": "Malware payload (Dridex)", "value": "109f761f63ba309250057d2ad15c4c7768e4e230", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673524, "uuid": "665e1ffc-780b-4d0d-a2ad-96237d0e715c", "comment": "Malware payload (Dridex)", "value": "a7db94ff5f8b39deb712cfd1af236e4bd4dfb4a343ae6689886bc709c2a566f0302e29ab03c273ec8090d305ae09b56b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673524, "uuid": "7be9b777-7abb-4c74-976d-8adc5e5a2ad8", "value": "33F3D0906A9BDF0ED9C13CF96A96A879B073458C811FDAB4D0DE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673524, "uuid": "560538ea-3b42-460d-9753-b43fe3a15928", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673524, "uuid": "2152d890-77f8-49e7-aa2d-4b61a8eb6982", "value": "3072:Hesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLKK:r4+VZQpt5hyPsa1ekiEtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673524, "uuid": "2307d14b-40e9-4726-9f8c-39f6541b5169", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673524, "uuid": "a082da74-cfd3-4aac-8ed7-7104f82dcade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673524, "uuid": "dc4179b8-b343-4c7a-bebb-92aefd3f2cc3", "value": "5db003b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e33360b-b1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620658843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658843, "uuid": "93ea4b17-1d37-4098-8670-d4ee1c0cb0db", "comment": "Malware payload (ArkeiStealer)", "value": "6c041881a5d2fb818e66b46164d9ea6f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658843, "uuid": "f657e9d2-e4b6-442b-9e2a-b679c3ec7926", "comment": "Malware payload (ArkeiStealer)", "value": "9daf087ef991160871f07d75d1577eccd34d926e1bd5d30cc30516fdcbd84b45", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658843, "uuid": "7f88edc7-1df9-4f21-9382-dc5564749d9e", "comment": "Malware payload (ArkeiStealer)", "value": "9731e47ed19ca0490afe35f654d6eff31329b61a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620658843, "uuid": "176edfa0-603f-45ca-a03b-e8f25b32e3b3", "comment": "Malware payload (ArkeiStealer)", "value": "d0d053bb4176d7c1cfcbd746d62ca2d8dba939abbed0df4d3b1d92c2d628ff36c99cf523139557155b09a7191d18360e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658843, "uuid": "af0d51b9-0bef-4c76-9a4e-95d258236467", "value": "A8D4F1017AC540B1E5722D7456E5AB34693CBC211F38C9DFA3E83A6D5E301C1AB36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658843, "uuid": "951a98bd-4659-4777-85a3-0b48793f45af", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658843, "uuid": "4a35ffae-ae4f-4462-8aa6-cfa35ad78bee", "value": "12288:VOOfN590uu6opX+t4sPD0M8wHvUq6K3FVpaHHjgyLXt:YOfNkuu6oLsrpF6KDpSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620658843, "uuid": "9c25c17f-425d-49e8-8ef7-f4fe1dad2658", "value": 627081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620658843, "uuid": "e64a80ed-d968-4f04-9dba-aba3b3d7974d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620658843, "uuid": "eeaaa1da-910f-41ae-a9f7-af15ff3bae1d", "value": "6C041881A5D2FB818E66B46164D9EA6F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdb0c26-b17d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620643948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643948, "uuid": "4e800cee-f805-4952-bbf4-0b74a5c931fe", "comment": "Malware payload (Formbook)", "value": "e215c8ce14ee4aaef36fff8d642d65f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643948, "uuid": "a60a9b13-9adb-4a09-8a11-29bc9e58e7fa", "comment": "Malware payload (Formbook)", "value": "9e393967e94c1f667955493b1b23f0b74c732a46c4eaa04d6e13a51c33a17ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643948, "uuid": "f96a66fe-d252-4d24-9700-d862f7feb347", "comment": "Malware payload (Formbook)", "value": "51ac31f69e5b45e738ed6d38539c228693ac4ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620643948, "uuid": "761de42e-2369-461f-b572-8f0a4f47831f", "comment": "Malware payload (Formbook)", "value": "4db49c87ec057ade805ae637f26826f1f18df29dc890bb09ef3e9126452ded2b250eb499da5cf818eb39466e54666f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643948, "uuid": "6540d088-98bd-49ab-a0a3-4dd3a88daa80", "value": "8A05D02037D8AB58E5BF97761970C14063F2BA17C722C75E6A9D904E2E32746CB72723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643948, "uuid": "5daefd42-96e7-489f-85cb-85a0d3b2f831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643948, "uuid": "d5ebdc18-d938-4aa6-ab84-2601df1019be", "value": "24576:1r8QXyPGhhhAg9UyYmIb40k8F6KF3Lu85Z:aQXyByTI1j1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620643948, "uuid": "4c496201-4b8e-480a-b5cf-ed46a0307015", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620643948, "uuid": "8fadb59c-c2f0-4e65-892a-a5e2624b0516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620643948, "uuid": "6e768aba-13c2-4ccb-b29a-8fecf31acb69", "value": "Purchase Order-10764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0a4417-b1b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620667377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667377, "uuid": "9228fd6b-db1d-44e8-b5f5-9f499a22fc58", "comment": "Malware payload (TrickBot)", "value": "41b25c7d644e4f55d8c2203401ffe249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667377, "uuid": "47c27507-bda0-4f22-9d3e-aec9f8d2b80f", "comment": "Malware payload (TrickBot)", "value": "9e955c173fcb4383d64ae90a591f1c2e4423f8f546e814041c62a04f7fada83a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667377, "uuid": "a4925c17-0810-418a-bfb1-d79da1422b4e", "comment": "Malware payload (TrickBot)", "value": "5067d9516e46e94abe74e9ddb59fbadc4db839ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667377, "uuid": "1e0692cb-a3c9-48ff-b7ef-4b206081dc00", "comment": "Malware payload (TrickBot)", "value": "de71d120f3633168f95632d3511450e5a4fad95eee3721fdad7fd490689b420c5273547551f59c04311fff4b2d8d7d93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667377, "uuid": "03ac7799-a135-4924-869d-4e81ed13b3df", "value": "BCF4BE02B2D1C177FAE202714FEAEEF7EAF5F9114A295447F3D62B0D19719434A36A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667377, "uuid": "2f9698e2-5308-4a02-ad37-acb771c47378", "value": "a854f0696e579de7373340a712e95c97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667377, "uuid": "9620b8a7-d001-4ab0-9c45-05a94b182803", "value": "12288:bZfAStuSnRmDuGQ9bNfvza04ueQlzxE30wIpgfCORMxVB:h5RmKNfbj4ueQhuEZifCqMxVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667377, "uuid": "9e2c6feb-852a-47e5-a158-c161dd5af162", "value": 757828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667377, "uuid": "46ed9889-a794-4e45-8886-94e1bab7be95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667377, "uuid": "77b62ef3-92eb-40b8-b38f-98855170b36d", "value": "41b25c7d644e4f55d8c2203401ffe249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c558f1e3-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640924, "uuid": "471bbd4c-537d-4738-93e7-ef4ab21b4636", "comment": "Malware payload (Dridex)", "value": "4e8dead0b2ac2065a33b0b1765286fe5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640924, "uuid": "ab957e59-e7b8-47e7-9c02-d2394c19de93", "comment": "Malware payload (Dridex)", "value": "9f53965ea6398012de2591ef587c1dc5f6fb6306e0c25d3430bcbe36640d78fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640924, "uuid": "6a5b1460-d8db-4d23-9fa1-b7b328333153", "comment": "Malware payload (Dridex)", "value": "1146be4aab4ef2a31569341971fc1713da7a34f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640924, "uuid": "9f27b38e-c8b4-406d-8b6b-04c29951814d", "comment": "Malware payload (Dridex)", "value": "b382e6c77c8e0116adf15127e22e3cdd955efca57bc9184f13ea1424069f02522907b3ebd6ce1122c10c08df08691367", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640924, "uuid": "60c594ef-db3e-4eb5-8cb2-af4ade1a979d", "value": "F1F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640924, "uuid": "850b3b27-9355-4ff4-8a65-4b77af2f36bb", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640924, "uuid": "ad80a2c7-1d16-4504-a077-113e0eef2f76", "value": "3072:MuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:M0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640924, "uuid": "05e7ddd9-0b49-4b5a-ad6a-4f26bd5cd209", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640924, "uuid": "0e02323c-605d-4f9f-9d9c-8448fb77a4bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640924, "uuid": "82f61eb6-cc6d-49ba-9dc8-e8931ca6b6b6", "value": "4e8dead0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bcdac1-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620651232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651232, "uuid": "4f10a369-ee19-4c6b-812f-9bac248b3332", "comment": "Malware payload (AZORult)", "value": "2cda6936ba8920094b1dcf16702f1290", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651232, "uuid": "0d85846d-f830-49ba-bc1c-26504da7ad3c", "comment": "Malware payload (AZORult)", "value": "9f75d7b0a9006f15297ee21ed5aa35c3a27835b18c83854479e900118fab75ca", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651232, "uuid": "cc2dcabe-93e4-4119-a7c1-5914575cd5d0", "comment": "Malware payload (AZORult)", "value": "a11db9dc93e67933a7212ca6b2db943ac60af381", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651232, "uuid": "6d4da434-e847-4f3f-b634-a6f26fa1533d", "comment": "Malware payload (AZORult)", "value": "6cae963bfccdbc94b5fb6d69848ddf7594a919846fb4bd766ea987ebc24961a41c35a4af63a476d8da7b2f05bb853024", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651232, "uuid": "927acc03-2500-4472-aab0-fbf9765d5e89", "value": "DAD5121923845A1FE57B777244686B0013B17ABEAA63C73DBD58B04BF9217C68233637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651232, "uuid": "83f307d2-cbb0-483d-978d-1950d19b24f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651232, "uuid": "ef3edfee-c51f-407f-a559-85560fc0db21", "value": "49152:JgEXq7CA/AhrAEsE82q7fpKDd8BB4Pzray5ZkkqPSGMheWP89B4:JZ95suqDpKLa/j8EWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651232, "uuid": "74e16181-ca14-4fe3-ae07-ba9ab06c4215", "value": 2931200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651232, "uuid": "7ee8b681-d122-4e79-8357-5d2e82650f21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651232, "uuid": "e8243c56-8fe5-464b-b53a-d9ec4c93581b", "value": "Order _ Confirmation_ No-1191244.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0ecaca-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620644582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644582, "uuid": "3deee7c9-f540-4de9-bf96-10260a472715", "comment": "Malware payload (SnakeKeylogger)", "value": "59932e6da5006de568328a41f81f202c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644582, "uuid": "2f71b079-9294-44ce-aad1-2026ca3fb519", "comment": "Malware payload (SnakeKeylogger)", "value": "a01f6ef9bf49ac894f8dcf6e9312e3c1d9eb4e57dabbfa2ca00cfe1e6ee2eb6e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644582, "uuid": "15928cb7-4149-4830-b073-6de821236288", "comment": "Malware payload (SnakeKeylogger)", "value": "51da945c9801f103fce958f9d7365480a7fbdb3c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644582, "uuid": "21c49e3e-0a91-4bc6-9481-4dad4e68380a", "comment": "Malware payload (SnakeKeylogger)", "value": "45241085633697c83bf798208cf6394b4faccd3467f669f54656e93017fca7f05cca021b122b34d8ee0d24cb361c21c1", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644582, "uuid": "390a88dd-229b-4315-a3c9-c11073bdb00b", "value": "E4F4D02037D8AA58D5BF477519B0D14463F2BA27C722CB4E6A9EE04E2E31746C772723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644582, "uuid": "1c7b8ea5-79a7-4d33-bd3b-a5ef20213b9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644582, "uuid": "e55b88c3-0d56-4e64-8921-9a7255ac6581", "value": "12288:AOkTOIc6XytBVw1hhhz87t+KXS00nFrHEL7v/OtX676wLG:AFc6XyPGhhhSNgHa/OtqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644582, "uuid": "00426a50-f9c4-4779-8405-e114908d00ea", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644582, "uuid": "2d6bc7ef-7b11-4b71-842b-9bfa6e755f55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644582, "uuid": "bc4291c1-d6f1-4f6d-a700-76738ae94fa7", "value": "59932e6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e438631-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620633879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633879, "uuid": "41c36b60-52dc-4c8b-b058-18acb64d793d", "comment": "Malware payload (AgentTesla)", "value": "fad357c1f7f106a818513e712c6fe622", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633879, "uuid": "8f50141f-6fa0-4a4e-bce5-a33e1a339503", "comment": "Malware payload (AgentTesla)", "value": "a039157887221616c98810e4fd62ad231951ff44fa9c2ff26758ef019af767e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633879, "uuid": "0d067e41-4d3e-44d9-967f-62d7fa5cdcdf", "comment": "Malware payload (AgentTesla)", "value": "565791a861d6caeff26449c88ecf7db35e9d88de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633879, "uuid": "081eb96a-d2ab-4ab3-a738-2d5b19b5c064", "comment": "Malware payload (AgentTesla)", "value": "e12d8da7fc8940546a51e3a1c15c677040e0a1893d90bebe648d67d7ae683a9b3bf3513d7247a63aa64dc3a61e5a7695", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633879, "uuid": "d1608b8f-4d0d-45ea-aeab-efb724b2be0c", "value": "9D15AEA06AC4AA44D56F57F60D61C74033BFBE1EC666C60E799BF18D0962B43CA63703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633879, "uuid": "aef8350a-2f10-45a7-bb53-227eb65f051d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633879, "uuid": "3efeab12-6b05-4c40-bf89-c61a49d42acf", "value": "24576:vMvLX+PGhhhL6byl0726XzZ3m4Uzlf+M:EvLX+Ir6C6d3m4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633879, "uuid": "66808825-00f1-4ee9-8c73-df101a52aa2a", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633879, "uuid": "b70ea213-1c74-4632-8774-5e1b2fb381c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633879, "uuid": "77e266c0-a64d-4771-bc50-eae255abe691", "value": "fad357c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900d8321-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648136, "uuid": "9adac03f-9ad9-4e91-9e84-c4de17faec6e", "comment": "Malware payload (Dridex)", "value": "80b9ed84bb2c1673ea1e83cbab5e74d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648136, "uuid": "d86847e2-e33a-4de8-8fe7-cb23484b0e4b", "comment": "Malware payload (Dridex)", "value": "a04ca8272c3d725e209f3cee2db0d202087e4d0c526cca1eb86ff031c4cce957", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648136, "uuid": "b460b168-2a1b-43da-8570-630aad054149", "comment": "Malware payload (Dridex)", "value": "11f58ff6b4a22c4fcf48b03dacdcf640f6213e13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648136, "uuid": "30e4a5dd-bf3d-4c53-a123-db33b157353b", "comment": "Malware payload (Dridex)", "value": "e6d8d4cc4ba607dc3c63a7c2d33c5be23d5cb201feaada82edd9bb6c12989df0657efbdda3a577b31475d515a333ae19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648136, "uuid": "55e6ab41-549b-4cd7-9344-3a3a76e10887", "value": "26F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648136, "uuid": "0dfd29a5-e74f-4502-b1c3-d5b8df93f7d6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648136, "uuid": "1fee5c63-5759-415c-a5a3-805a96b261da", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648136, "uuid": "03e03f90-60d9-4896-bad1-a820a423df2c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648136, "uuid": "bd478306-3bf5-4f11-b62c-b07b696f7d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648136, "uuid": "399aad45-834b-47f9-96d9-3edec5423066", "value": "80b9ed84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3f3d20-b198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620655300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655300, "uuid": "56c5859e-aed4-4f5e-a6ad-a3199a1476b4", "comment": "Malware payload (Dridex)", "value": "68d298acfa822bea92ffbe5295811540", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655300, "uuid": "7a69a9b1-3fdc-470a-b7b8-62d03ac368fc", "comment": "Malware payload (Dridex)", "value": "a094a63e00d321fa6b8121db545d67cd676db756a91b1173f3acb2ad2f7f6671", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655300, "uuid": "5619e17c-0d32-4689-bd3d-133376db1383", "comment": "Malware payload (Dridex)", "value": "8f0175d29c1b89db01b42ba6124503f0ce47a3a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620655300, "uuid": "bbe4aed9-082c-4714-911a-a470c1607840", "comment": "Malware payload (Dridex)", "value": "a66c362f4f95e3bb29a8020423ac9d93b56ef7f761ff083a0be1d0d2381debb3f3aafea020ce3905d676a2d8076622f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655300, "uuid": "326de661-5827-41e3-ab9c-c28d787e566d", "value": "49F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655300, "uuid": "b3e82e4c-6ae6-4bcc-9b33-fae93840d599", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655300, "uuid": "3110da40-d585-4c5f-963f-e2868cfbbfc4", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620655300, "uuid": "d7bf4513-6da7-49d6-b3ef-da4d59632fd6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620655300, "uuid": "0b90f6ce-4d24-4a93-8149-8e9c1dc5dac7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620655300, "uuid": "94cab643-8cae-4137-8609-dbde71bc4eb8", "value": "68d298ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed62ea2-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673474, "uuid": "2640e441-468b-4021-a845-5fdd4a91ae9b", "comment": "Malware payload (Dridex)", "value": "a27da4ea583d9c832e1bc3d17b70c6e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673474, "uuid": "22118b56-0d9b-4d20-b257-aeeac402734d", "comment": "Malware payload (Dridex)", "value": "a09cfdd1308eacd422f29dd8833c82ce8e47358218404e667cb9d7deeadb2632", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673474, "uuid": "a9ab8d4e-7704-48c3-b057-44c41af5612d", "comment": "Malware payload (Dridex)", "value": "0b605f0219e98cc96c8f7ebf2999d93d63a709b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673474, "uuid": "6c263e9b-f4ce-4c5e-a121-1a91ba0151ad", "comment": "Malware payload (Dridex)", "value": "93e24135d0bd7cf3e53097227747e8a139da8971c5e80fc8c80680c7bb6bdba1edba34cae6ab9f369ae3cd91ee3b33aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673474, "uuid": "ee7c8b86-7787-4bea-b7b0-08e25aff3799", "value": "22F3D0906A9BDF0ED9C13CF96A96A879B073458C811FDAB4D0DE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673474, "uuid": "16327eba-d363-4a24-80a7-9a8540c8d28b", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673474, "uuid": "8ab6ab4f-28e1-4fc1-9b60-5a5fd699f6ce", "value": "3072:vesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLKK:j4+VZQpt5hyPsa1ekiEtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673474, "uuid": "042d6506-f54d-4ad6-934a-a8f8000a41eb", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673474, "uuid": "3c1af1cd-ab80-4ab4-ada4-f8b20a9572a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673474, "uuid": "4bf5d030-653e-40af-a4e6-248e80caf643", "value": "a27da4ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5713542-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680464, "uuid": "c7910d7b-1cd1-44fe-b0f5-ff8f0d66cef7", "comment": "Malware payload (Dridex)", "value": "742ceda018cc2de1f80259ca29c7f403", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680464, "uuid": "181d2d62-62b3-4392-8141-f00727aa71b2", "comment": "Malware payload (Dridex)", "value": "a0dfae4df3c5b948ad00fcbc9f256dedb0c2f727bd0d63136a8b0b2a7c69966b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680464, "uuid": "9072752f-866e-4443-98e1-b26c6e00283d", "comment": "Malware payload (Dridex)", "value": "a9987adc37327ba1e99530f031478d6ae63c63e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680464, "uuid": "41cdd6c3-36eb-4aa4-9414-30fee68ca476", "comment": "Malware payload (Dridex)", "value": "7f7e331b7b8759c55a02b3e3d7e2bc6be9f35d6607533c38ab5b2b3670a3b9ad103e476d179d34c30a4b9af1d7f99577", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680464, "uuid": "eda92a5a-df40-4425-879c-48d8d2a8ba12", "value": "E7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680464, "uuid": "f0553324-f990-44b6-bf40-a4e6aab1b4ea", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680464, "uuid": "c6a9a3d9-7ae8-467f-9e66-bb15cfe28bc4", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680464, "uuid": "bf59fc2a-0281-4e27-9a7c-5920b120914a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680464, "uuid": "49597b09-cbcc-4617-9873-97722f51b468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680464, "uuid": "19da0d03-6103-413c-83be-4a5fa058161a", "value": "742ceda0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3e3d2c-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629097, "uuid": "57d3a286-4258-4d07-b338-9f28c4af0fc7", "comment": "Malware payload (AgentTesla)", "value": "c197c051a27543708050b0b8f30f4d02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629097, "uuid": "223c6f45-1bed-4ef9-bf87-da39849947d7", "comment": "Malware payload (AgentTesla)", "value": "a0e9aa9f568659436c4cff3d544a8d4d195ca9a6b30e8a7cdd5aeeeaa8e7d90f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629097, "uuid": "f7a97813-61ee-4a97-8667-afed033f497f", "comment": "Malware payload (AgentTesla)", "value": "39d7ea1f2311ac8968f03f3693a557f532acd084", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629097, "uuid": "3cb2180b-4331-4818-acbf-d01f003e4785", "comment": "Malware payload (AgentTesla)", "value": "550c63e9fe5927b1eb2134847f00cb9fbabeed6c72c7f0d6d418f8e4b1a18a0e070d22a623a01c1c84e64108d51023a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629097, "uuid": "06ed51ce-5921-462b-90ba-d4f7e40ca4d9", "value": "2ED5E7151EAFF60CE7BA4D5A0F9CA984874B32686DBEB0DCA60550350E97F50D630F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629097, "uuid": "d565bbaa-29a8-4044-8c67-744afeda4788", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629097, "uuid": "75a27fa2-4187-4ff1-b22d-7a26037eece1", "value": "12288:f5vnsjbojWePGAaBzXRKviETxx2lGxzSlsWSKecMpUgMnZ2BAabpjEsxzlEcILg0:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629097, "uuid": "4094e530-b824-46d8-ba82-58ad018e9e01", "value": 2919936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629097, "uuid": "7a357ba2-ebce-474f-8d61-c8c83a17b4fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629097, "uuid": "4e1e1c7a-1885-44bc-a316-ae6e62dc5149", "value": "BL COPY-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7b0f4d-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620673602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673602, "uuid": "6d4dc28f-0a81-458d-85e6-b63cb042b70b", "comment": "Malware payload", "value": "ab0024dcc4662d852ae8815bcebe44d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673602, "uuid": "77ea2202-11d6-49df-9cbe-cfd9267d6610", "comment": "Malware payload", "value": "a133fcf997660be64ad288f23ffb29f396cac50739e37177f39711f2afb71b42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673602, "uuid": "eb23c32e-1168-4fc1-b582-6cfdf2827a17", "comment": "Malware payload", "value": "96ef3c8ec5d35d943ed48945bdbf55c622ec9d0b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673602, "uuid": "f26a7a9c-7749-41f2-92f2-e6dec88341a7", "comment": "Malware payload", "value": "7f79e7612d858956c08f50beb6271b2c0d53c179baedbcf1f1741990055835465dd2ce4b8e33c618b8ed0bf0645356e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673602, "uuid": "c648481b-e925-4e04-ac97-d4c57bf9935d", "value": "87F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673602, "uuid": "a901302e-9d72-4df6-9648-fbecd10a23f0", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673602, "uuid": "e08382a1-ce14-4de8-ae44-0e46cd80457e", "value": "3072:Qesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:64+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673602, "uuid": "725a20b7-4c0f-4969-b1fa-2fba9d312cf3", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673602, "uuid": "d3a260d9-d186-4363-ab35-4d74c3858e69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673602, "uuid": "5db56499-cf14-497a-a6b6-f220569d7a74", "value": "ab0024dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50d9656-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630615, "uuid": "6447960d-3f8b-463f-b201-85d8e13f151d", "comment": "Malware payload (AgentTesla)", "value": "cbdfcbb4dd7626a2a761f980385060ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630615, "uuid": "ab281090-369c-42a5-9879-d15cef94035a", "comment": "Malware payload (AgentTesla)", "value": "a16cecad41c08ee5f7d53daeb4159a22c221f22ce642292282d1b83c5196f516", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630615, "uuid": "ce5f4cb2-8c31-4d52-889b-8e9ea7936f77", "comment": "Malware payload (AgentTesla)", "value": "7188440565a81ce0b421281330668e1fa48d652c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630615, "uuid": "83fb0911-d91a-407f-87dc-161ac4256f0f", "comment": "Malware payload (AgentTesla)", "value": "1f77d85043137f45a5454bf39f5d926d0e0b0ef6f099c32b84691f8fb9ac10cba347acb38db90dcc0d08718298df9a46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630615, "uuid": "05f48acd-5fe1-4bd7-8a93-4de4c9095bcb", "value": "31057C1226BCAAC3F47D6E3614A487181BF16C0A8637D06DFDD3B5EAC537A43C6216D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630615, "uuid": "63089e88-4e70-41e0-89a3-dcc270697fed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630615, "uuid": "774e3c7c-0385-4de1-bdef-217e4c401d31", "value": "12288:bzulb7LZOch0wD3IdtMqK04ORh0VwuMdfvRlMeYkfoPyBMi:bzulnFOcFYLMjtTuu+lMVkfoPyB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630615, "uuid": "7819ce18-d46f-4a34-87fe-b182abfeb8cc", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630615, "uuid": "63f7ba08-73fb-4ac2-8338-0f6d7abea2f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630615, "uuid": "4aa07eb9-05cb-4393-8b82-f76a7e98270c", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3728eccd-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684064, "uuid": "fb3848f7-e659-4200-9075-5d9cd282d260", "comment": "Malware payload (Dridex)", "value": "31f3920573a909bcabbf5a999b13b831", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684064, "uuid": "3b973897-5193-4c35-ad98-b675db1b92fe", "comment": "Malware payload (Dridex)", "value": "a17233da5c5395916eab528dce450e55fc842008c0fa70d03b9d751e7b31c074", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684064, "uuid": "efeee597-293b-4457-ac43-0a7b57576e46", "comment": "Malware payload (Dridex)", "value": "ca29379b3aeffb755650ef65502e13d71f20495c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684064, "uuid": "c05dd447-63ca-4395-ae4e-590130638318", "comment": "Malware payload (Dridex)", "value": "493827c48be1d98ef541eb878dbf19e6a6c05239b5721d64bd54e2c629e586d60735602663982cac6e8d6c7d96d74280", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684064, "uuid": "f956637d-e6f4-4bc3-a282-d1a5c2e2966d", "value": "41F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684064, "uuid": "f4d6b323-4150-4caf-bfb2-723198cf6668", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684064, "uuid": "9d2a4ee0-0204-4896-80de-33ba7afc397e", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684064, "uuid": "dc5f3897-a954-4dc8-8a53-44d715976dcf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684064, "uuid": "f2d9676b-5184-4b05-9618-04015ff21227", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684064, "uuid": "710c4f34-2d5e-457d-9a86-6648b8a9b673", "value": "31f39205_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea384b6-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649180, "uuid": "65ee1948-c1c4-4550-82ee-ca2c0952d084", "comment": "Malware payload (AgentTesla)", "value": "f1df3b49e794cb711d35c88dfa7ede43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649180, "uuid": "e230f912-a672-400f-9968-1af9cf0e48d0", "comment": "Malware payload (AgentTesla)", "value": "a1cacbb454164c8b7b968fabc89129309f75895942ee2de375f385ba153be858", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649180, "uuid": "709bdb93-232d-427a-89c7-6dcfde2fbd58", "comment": "Malware payload (AgentTesla)", "value": "93b526ba3dce219dacc88bd8937c5871823dfccd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649180, "uuid": "d0fa3d00-8938-41a0-bcd9-49ec7f7e947b", "comment": "Malware payload (AgentTesla)", "value": "1f089a85d2e21f7103da71530c684fde252de1bde6fb38fbce018f8b4dd9d4891fb40a949c2bf5a7467fcd83a7456c11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649180, "uuid": "eb97b1d6-0be5-40b5-9530-6d1c00bfdbcf", "value": "77056CAC715456F1D36B1E7363CF1C0643652174643BEA0E8FA013FA5A67F172E38A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649180, "uuid": "48df6a14-a014-4395-a94f-8201dc64b6d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649180, "uuid": "cce94f11-f3a3-4d75-838d-61204ced5886", "value": "12288:S7Q5eGS1kooLLoS60/K7yh01u332RcCSrRm1Fh56I6uaaMQf/F:d5eGS1kooLA1un2+CCqh56I9aaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649180, "uuid": "9a6d94c5-0c95-434d-9613-75fb97d81266", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649180, "uuid": "9e990222-dfeb-400e-bbf1-ceef0265cab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649180, "uuid": "efc174bb-71ba-461c-b2f2-a97aa94fd4ca", "value": "Zam\u00f3wienie-290421.85655463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb931fa3-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669791, "uuid": "21d74a46-f764-4d15-9e99-362cac31a8e5", "comment": "Malware payload (Dridex)", "value": "3879590310a7fba6bafae107e138d1fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669791, "uuid": "b277178a-b24a-4934-9e22-5406e017f576", "comment": "Malware payload (Dridex)", "value": "a1e1887e1affdba34f820ad7c896d3e99d117d8a05078c2c6ab67d3bc64bc79d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669791, "uuid": "8525ab20-82a9-4f88-882e-7bf02d38cfc6", "comment": "Malware payload (Dridex)", "value": "00b3cc75fba563c12a71f6bd2b1e81ddb46123db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669791, "uuid": "3a798028-fd69-4067-9600-30e86d2f321d", "comment": "Malware payload (Dridex)", "value": "2255d5b8cbd9f1532bd9f75ca254a825b8906d94d6aa7c712eb1d5fed4ebce07220562605cc7d683c2499851b2d54927", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669791, "uuid": "c03aea9f-8ccf-4d53-a0f8-2b1d19024544", "value": "3AF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669791, "uuid": "6fb5c458-cf06-46cf-9b42-a24da4938c02", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669791, "uuid": "c2838dd9-8151-4561-8c53-30764a9f58d3", "value": "3072:Q/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:ibrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669791, "uuid": "e97b93ed-ce28-40c5-ab57-cab703f9301b", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669791, "uuid": "1b93f40d-6799-4ec3-a4fc-7e6d0bc8d1c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669791, "uuid": "546a05ec-0b43-4583-8778-8bee247bc6eb", "value": "38795903_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01be83eb-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651762, "uuid": "65f514d4-0381-42e9-a194-e1ff01010434", "comment": "Malware payload (Dridex)", "value": "c7a01ede1f26f06353ff62be9623a18c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651762, "uuid": "ee9750bb-5bc0-4742-a70b-8e0d7bff4fd9", "comment": "Malware payload (Dridex)", "value": "a23bfe96d801fec1c016676a7d05eb74d31ffaad0bdc6e5ac691c8e0335741e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651762, "uuid": "97fe626d-5248-42b8-9093-5ac6a10ad79a", "comment": "Malware payload (Dridex)", "value": "e5e82b4bd188bc7a790ad8ab7ce5e53740eff19c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651762, "uuid": "df24f73f-66c4-4cb7-b8ec-ca5c5b725fb3", "comment": "Malware payload (Dridex)", "value": "b11fcf6116ead5f41d6c729337eaa927b30337416b8789b025657c3ae73c4723db41e01a71040562a4767a13e6b130a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651762, "uuid": "c713deeb-6a3d-45e5-babe-6a8f59e276c6", "value": "95F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651762, "uuid": "75a1603c-2b45-4600-9640-0562cb53aa0d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651762, "uuid": "16853103-592e-4810-a7ac-73f48e9a9f59", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651762, "uuid": "da0ee02e-1725-488b-affe-52f46961140f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651762, "uuid": "47b66cbe-c972-447c-8117-b91ab9a30be9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651762, "uuid": "1cee5cbc-8497-4d09-a6cb-b6063378c02b", "value": "c7a01ede_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dbfc91-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673432, "uuid": "5de3d688-28df-4afa-9bb9-f870071a393a", "comment": "Malware payload (Dridex)", "value": "80ae51511a58e50e02a155f209f07607", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673432, "uuid": "5f38745b-133a-41cb-9e0e-c356d25fa553", "comment": "Malware payload (Dridex)", "value": "a25e46dadfb3ec1ad83890e36921a4b327f3aab43df2a95872907e079cb97e78", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673432, "uuid": "9e121438-ee10-4572-a292-8764fc79d44e", "comment": "Malware payload (Dridex)", "value": "a1ce5821454ac008683906a5df07409696563385", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673432, "uuid": "afb0a477-ef73-4a01-89e3-70b0784d6d2f", "comment": "Malware payload (Dridex)", "value": "ff9b56cf2cab67364ac6b5a9d5d1b8e64bcfb965b26250e6687c6044ff0a9b1e02acd865d6c973fea43c001a3503b9d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673432, "uuid": "e50bb7d5-07a4-4830-b7c5-05ac8652da52", "value": "07F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673432, "uuid": "c1df20e9-aca7-40e2-ab45-d869353657e8", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673432, "uuid": "b125eda2-01de-4cb0-81ab-183b5f06a2f5", "value": "3072:1esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:x4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673432, "uuid": "e67d880a-c7ec-4aff-b335-cc6b85a974d1", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673432, "uuid": "18908011-7573-4b36-9846-2524d3ee7174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673432, "uuid": "5f5ef7e8-69af-45b5-b18e-e77058188b92", "value": "80ae5151_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289bdab0-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620633789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633789, "uuid": "40991cc8-e64f-47bd-98c1-f5658b21d221", "comment": "Malware payload (AgentTesla)", "value": "38c039eccf5b1f2e55b87c328f2f7f77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633789, "uuid": "428567f3-d2b6-4a72-aeee-63c37c9faaf9", "comment": "Malware payload (AgentTesla)", "value": "a276865b47ec6abead656aac0c862083c8e551218f49a1e6cf98897e4b35dac3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633789, "uuid": "bc1897cc-a741-4b77-a51b-49a61fe7d392", "comment": "Malware payload (AgentTesla)", "value": "92d27acd36a28a73e4e1fbab13a5f1838ef4a56d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633789, "uuid": "60a68d96-809e-4916-a1ca-ec8c8d311707", "comment": "Malware payload (AgentTesla)", "value": "fef4812f661edf8e4e04340171ae50cfc29fa800f008e510bdf495a77a38b39020bc72b1f776f9024bdaa459e8ed188d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633789, "uuid": "9f3208b7-90f0-4734-8522-ae948a69e477", "value": "A95523352107755DD4CED63036290EE62B7F900AADAFB439592E34A50F0EDA9BCF582C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633789, "uuid": "01d99077-236e-412a-9a83-41d03f594120", "value": "24576:dhj+aCp5IBEYVoewyOGGGnG0GGG7jpP7OGGGTU5dUGGbncOTweFc7+4X8fyZNjN3:D8p5I3VoewyOGGGnG0GGG7jpP7OGGGTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633789, "uuid": "b3109f5f-bb91-475e-a561-5dad1c12271a", "value": 1303769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633789, "uuid": "addc077a-5d2a-4302-92f4-d6816f5696af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633789, "uuid": "babd3ac2-2341-4276-b696-e4b8b3548b17", "value": "38c039ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92644608-b163-11eb-abe1-42010a9c0039", "comment": "Malware payload (RunningRAT)", "timestamp": 1620632678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632678, "uuid": "d94910b5-5d56-4994-b0b6-f6ec230d27d6", "comment": "Malware payload (RunningRAT)", "value": "14e353c6693d3ef687d19d63fd6a4799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632678, "uuid": "beabbde5-8f77-4576-a805-ac98d3f393c9", "comment": "Malware payload (RunningRAT)", "value": "a27c3c08c44a620f56ea19c17df3151e7a3cc59630732087f79e93bcd567085f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632678, "uuid": "6652cf67-e402-44b7-af49-4797488c7fc9", "comment": "Malware payload (RunningRAT)", "value": "7fd96d9c3fe390a4a89980173e235167dfafef16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632678, "uuid": "3f667f25-f301-4bb0-bd6c-3ae64d451db9", "comment": "Malware payload (RunningRAT)", "value": "d0ddd44da82d965cac26b45712c0008a939895f2be1ff29f46e7c71019ae0b16b4746fb37d05d6e8337f703873b79dfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RunningRAT", "colour": "#BFBE5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632678, "uuid": "b13f87e6-02b5-4045-ab76-3ef8f16d3993", "value": "7EB3E542A3E02412E1AF3B74597513364A7D3C795F2582EFF2D5C58E1879AE0AEB070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632678, "uuid": "e48f95e5-f0fd-455e-9a5f-bfd6958dc893", "value": "7e3107c64f6a7a76d8463e3f374f74af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632678, "uuid": "5280e389-b60b-4826-98e8-d0b72ffc5d75", "value": "1536:vqEA70HzLJksPEOajozLElnqiO2gdJ/tHi:vXTLJkQ7zAV3atC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632678, "uuid": "ba6c8a83-ef3f-4a57-bece-4ac0478964b5", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632678, "uuid": "e81c4f39-8d15-4138-afbe-fc79ae0b00b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632678, "uuid": "c27bbc24-733a-4858-a49b-c1bddbd32bf6", "value": "14e353c6693d3ef687d19d63fd6a4799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbecb8d-b186-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620647645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647645, "uuid": "ef149945-7e71-4d0a-8065-577027f3fe9d", "comment": "Malware payload (AgentTesla)", "value": "40ea0fffa22299ee4236a5118660a9b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647645, "uuid": "45efb11f-0b21-4610-81d8-f02e0d8a84cb", "comment": "Malware payload (AgentTesla)", "value": "a2907290b9082b133e5f4d82407976db26620a692834195cbf6a334061c76367", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647645, "uuid": "b4e21d6f-145a-429e-b6a8-6f38fc048cea", "comment": "Malware payload (AgentTesla)", "value": "3fd4bada7bcd6848ba42b674ca6bc7b25efb75e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647645, "uuid": "37a41100-438b-4b51-8518-6cab4876f68c", "comment": "Malware payload (AgentTesla)", "value": "50fbde1614a135002e1b517f61441adbb687dbd18b014015df9de69cd42af78744aae86950b6f18818865aa2b05b8e2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647645, "uuid": "5ce50610-0a11-4b80-b086-91d987a38efa", "value": "6E8109B4607C29E0DE6F80F389F9FEA601F2F6C0A5CA9558B39DEC11070D3665976202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647645, "uuid": "8c68760b-0564-4492-b9f2-03cf0f7740b5", "value": "96:CNceUXmPfK5RV15tHzDBsR3gC5GK088RdM+dINKqSTc7sE:CNcjgfGTlSJSQ+d8KNcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620647645, "uuid": "6ae76c55-1e78-4549-9acd-91cc04a3ac3c", "value": 4061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620647645, "uuid": "00d78345-ff5c-428c-9a01-4753367ac2d7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647645, "uuid": "c2b25cf2-b5aa-4781-b6bd-21fa642accb2", "value": "Tender Overview 10052021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b98294-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669840, "uuid": "0025b530-b8bd-4791-9c7f-280befa03f92", "comment": "Malware payload (Dridex)", "value": "2a15a1d27fbb7707173624a4ebd10add", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669840, "uuid": "3ec78eb6-46a7-47b5-8efa-b3e918516559", "comment": "Malware payload (Dridex)", "value": "a30c83639c992e4bacbd3af85a7ff3cf781f557938e2235202f19e4511edf444", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669840, "uuid": "6aa71f5c-72b6-46f4-819b-996db4c92a1b", "comment": "Malware payload (Dridex)", "value": "2c1c65917ba643cbb947da46eec389c1793b5962", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669840, "uuid": "15ca536d-9597-44ca-aeb7-98f3043adfa3", "comment": "Malware payload (Dridex)", "value": "068f5726afffe3b10c15c11776dd18f9f0f4ccbe1d52e01c5c232a8cf5d719bbb6e7364aebf05a0285c17734c9fa6c31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669840, "uuid": "fef53ebb-e988-450b-b427-6bd5af9409f4", "value": "37F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669840, "uuid": "a3351f98-3b02-414e-bfb4-0e9b6ab843af", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669840, "uuid": "1ecb6fdf-1d92-4224-bc82-f2409771a06c", "value": "3072:5/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL63:zbrE1kvcB74DXZ2Melv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669840, "uuid": "537f9daf-1ad2-4eef-8a3b-94950a04237c", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669840, "uuid": "08128b94-a2c2-4709-9322-edc7fc9230f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669840, "uuid": "03ce4154-694d-47f4-b978-490d45396a75", "value": "2a15a1d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa29dd82-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640878, "uuid": "06a43917-ecbe-477f-ba45-dcb27f7ea1ae", "comment": "Malware payload (Dridex)", "value": "25ba0d6f93c2229f7857488531a29dc0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640878, "uuid": "4b9e881f-ed05-43ca-b2c8-4187a6c94826", "comment": "Malware payload (Dridex)", "value": "a360516f0124d44931810af62c8db0882d8c07c48270106da515a0a080c01138", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640878, "uuid": "f2abc666-f05c-4c08-9b83-f97836e5cc74", "comment": "Malware payload (Dridex)", "value": "4a4777fef84768cc7653eb87cec76142e5a840c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640878, "uuid": "f259f8ce-3ad5-43e9-8db4-d1f79961e098", "comment": "Malware payload (Dridex)", "value": "3f55630fe2ce90b567a593962bcf74fc5186612fe20898fdc9ea19199fe19c5569f5b76abce86cdee945fe24471dba1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640878, "uuid": "19382e54-4f86-4629-b47b-bd68bddc34e0", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640878, "uuid": "8590a679-012a-44c0-aa18-710e009a7ce7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640878, "uuid": "82ee014b-110c-4b43-9b92-ddab73f3dffd", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640878, "uuid": "befb9c05-6772-4350-a1f7-841003c2fed6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640878, "uuid": "d42130cc-2a9d-4a8e-8b18-569d12b5ae80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640878, "uuid": "330eb192-918a-46d1-97d5-12273141dd2c", "value": "25ba0d6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc16fbe-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620630358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630358, "uuid": "4de2b1f3-da5a-4ad1-b9ef-237c38216abd", "comment": "Malware payload (Dridex)", "value": "8d190dd3c9b5328f38bef1ab18b25ef3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630358, "uuid": "d9ffa2df-a9be-4474-aafe-0b7a06b89260", "comment": "Malware payload (Dridex)", "value": "a368c80b70fc7491aabcb4f6667ec7e28da5974b2373a0b0cff28eeb5efbb9db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630358, "uuid": "37f86dda-e57d-477d-8094-197619c874f9", "comment": "Malware payload (Dridex)", "value": "3f9c99a9f7753b2f988867207ae3706aa334e885", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630358, "uuid": "f01d9c9c-d0d6-46ad-b85b-e9a4476ccb30", "comment": "Malware payload (Dridex)", "value": "c648f30cd4eccd7af5a3bb961aa17ec6616cc16296caee7fedff75ec39be1589e8edc72f8aa904e1ab25d3414d26393a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630358, "uuid": "b82af672-2ec3-41cf-8412-0450537ed5d8", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630358, "uuid": "d2c97962-d8d6-4787-bc0e-a47d15edb00e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630358, "uuid": "55129bd9-c2d3-4f7d-a7e0-c600fd878d68", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630358, "uuid": "272e56ae-5f64-4bfe-9d2e-78c451095a2d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630358, "uuid": "c08739c0-5e1e-4881-b82b-71ee361b0ed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630358, "uuid": "67eb084d-5c26-4261-9d88-c858d8871ce8", "value": "8d190dd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45399028-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629112, "uuid": "6f5b7993-c47c-42a0-9345-fe9f91d32849", "comment": "Malware payload (AgentTesla)", "value": "607de3abe2a8d8a3b85a77d46e47aeb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629112, "uuid": "070e7053-f96f-4a5d-bdf0-46d6f939ce28", "comment": "Malware payload (AgentTesla)", "value": "a3aa3605c436f4ef38f404007ce0305562def1f6e77f244232671b10914894f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629112, "uuid": "89f83d44-fd26-46b1-a11e-bf4e47fd7a3b", "comment": "Malware payload (AgentTesla)", "value": "216d1e3efa51998bab15454f5fe7ed7e09e13acb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629112, "uuid": "caee98bf-093f-4505-ad74-1adda6e126af", "comment": "Malware payload (AgentTesla)", "value": "5439e5bae1fc76410314f50058e56f5b424a6a15bc0c3c13107b9306ca0a64c53b0cee7b5ef7d863c5e5bd3696b695de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629112, "uuid": "df630b68-c26d-4367-83a7-fed7fde30c23", "value": "4D356BA8728055E2C66A1E3663CBDD3143202D74A43AD5195BD43FFF39B7F232A3458A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629112, "uuid": "60d21209-dd21-4aa1-9b89-52a07c2cf13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629112, "uuid": "3c021b32-528d-4aac-9973-0bdf52f0ef4f", "value": "24576:hj7bZ69ooLAdqv8KylDWl/86fGu52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMY:he0tlClt+TMMMMMMMMMMMuMMMMMMMMMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629112, "uuid": "93818e5f-cdd8-480b-b5de-13972ee2155e", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629112, "uuid": "0296854e-59b1-4272-b5c5-15cd0607b6d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629112, "uuid": "d0139374-27ca-4b6b-8913-a8da3591fdaa", "value": "Updated R26_Old Parts Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86edcefc-b187-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620648120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648120, "uuid": "4413248b-f116-4e9c-b6d5-8fa43ba3450a", "comment": "Malware payload (Dridex)", "value": "263bbfd1b41a47a7de633e0e879d9e46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648120, "uuid": "a308ae51-0b63-412e-8c8d-ede3b0201c2b", "comment": "Malware payload (Dridex)", "value": "a41803ce02ba8186e736f8867935d63d79f4d507b578978843f26101ec0f36e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648120, "uuid": "4faeee6f-0591-4d8f-98c8-ac022ab7a009", "comment": "Malware payload (Dridex)", "value": "c69c390c6e6b86ade2c8ab86d4b6f65cc8ac651e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620648120, "uuid": "7949b83d-cfde-4e28-bce4-1d2047b8e32a", "comment": "Malware payload (Dridex)", "value": "bd0c4369f79445f5c0920e3cec6d164bdac1d4ba59de2da28f931715117bb425aebae2db163219fb9db8dda1b5c69556", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648120, "uuid": "723a25d6-4e12-4761-9767-cd8a014e0bf7", "value": "00F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648120, "uuid": "3f7e7579-09c5-43d9-8ebd-ff08c9218ad3", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648120, "uuid": "17f60105-58fa-43bd-9ba2-6da86aaa0d95", "value": "3072:wuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:w0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620648120, "uuid": "ffa8e60f-7827-4b8f-b03c-f4b3a989761d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620648120, "uuid": "0d7f02f4-2e49-4703-8483-cebc97c94c22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620648120, "uuid": "b85cc7cd-adac-4a5a-a4e1-35ce2a73af93", "value": "263bbfd1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ccc5fb-b1b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620668915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668915, "uuid": "99739c34-abea-4cf8-aa41-f3d0525edfe0", "comment": "Malware payload (AgentTesla)", "value": "91f97c9f5c1b408c2127157b23d7aaec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668915, "uuid": "1baeb3bf-46f1-4c7b-b006-06fa09075ca8", "comment": "Malware payload (AgentTesla)", "value": "a42d9bd273be9ffd1ca60def6f75fab502c7d04967bc69fe9ee7c8304d80bf16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668915, "uuid": "f657ffb8-0112-43dd-a5a4-4f925d1621e2", "comment": "Malware payload (AgentTesla)", "value": "3bb9b9b44182abf33f7facef819bfc1d077b9857", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668915, "uuid": "9db9dc96-e48d-48d8-81ae-87f86ce78dfa", "comment": "Malware payload (AgentTesla)", "value": "574558ae2ecd955db4ef24e58feb07176251a861d4b0c0dfefdbd5914c9caec68e66434139cbfe51d928efaa5bd018aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668915, "uuid": "137cdbed-5dc7-45a1-9607-8ab0ad77bb97", "value": "FCA5F1AC765455F1D32B1E7763CF1C0343642674683BEA0E4BA013FA5A67F172E3898A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668915, "uuid": "029f535f-ffd2-4079-9a0b-fd8a3bad7f92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668915, "uuid": "10e19a24-12d3-4f95-86da-95f8b2ae76b3", "value": "49152:XM6ydpqygpMPdTUC86mAbZnLagaTEY39LcaD9AYKUFke6r3:XNydUyAMPdTFnupNLz9AYK1e43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620668915, "uuid": "fc3253c9-c98d-436a-9099-e572bce5499a", "value": 2244608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620668915, "uuid": "38d52ee3-c47d-455a-a3ce-f0f82baf8cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668915, "uuid": "604c2476-9be2-4016-a0f0-c5f47c7db5b9", "value": "Zam\u00f3wienie-290421.85655463_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287a7fda-b1b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620665571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665571, "uuid": "f0886818-fc88-448a-8d95-5cd13fb8f36e", "comment": "Malware payload", "value": "85436cf84eb2a615fb37b8600754c79f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665571, "uuid": "2ffb99f1-e0bd-402f-962f-526973616718", "comment": "Malware payload", "value": "a4511d9e20b7f712507c864053da23a7b1801765b18d021792db5a2d55d64bc1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665571, "uuid": "e99c25c6-6056-4114-96a8-c97120950a31", "comment": "Malware payload", "value": "aec7f8fb463b32ac02b9dfd4744ca9151a10f102", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620665571, "uuid": "4d987ff3-53c2-489d-9165-5d76723ef5ae", "comment": "Malware payload", "value": "e40cefdca6f9938e7ad00b7dae2189a2ed17a9e29e81ebc5d07571c6d9b1b15c990f51f9cc568de153f98c8db1924578", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665571, "uuid": "c10cc44c-9e09-451e-91f9-18a16d3bde7a", "value": "81815432A58708BAFF9E8EBC5D83842E23AE2AC113610AB7139150C91DD5DE7F534F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665571, "uuid": "8ed7d65b-a422-4514-b6e2-473470a01e97", "value": "fedf9f199dde0fdb7192322e063acd1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665571, "uuid": "d70772b7-415a-4cb2-8959-f243a5a74b33", "value": "48:SSCn1ASkT3Jd95Ei4TN17POEqCvP3ShdP71WqCM66dC2om/9rnepH:Gn1ASkP34L7L+WUyOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620665571, "uuid": "7903dd54-eb03-491b-a749-ddfa2c92f567", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620665571, "uuid": "46151fd0-50f8-44ac-b1e4-4c16946596f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620665571, "uuid": "8b712311-ffca-47bf-8c0f-6eba36045924", "value": "SecuriteInfo.com.Artemis85436CF84EB2.12575.8170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca9051b-b147-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620620723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620723, "uuid": "a9295bba-3db5-4436-aa08-7ef886d634ee", "comment": "Malware payload (Loki)", "value": "dcdb8439104dce94f175d94a5d7c9639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620723, "uuid": "d1ac73a4-8ac7-4ef9-8df1-fa1ea24eef90", "comment": "Malware payload (Loki)", "value": "a4a8d02601d7351ed6d93939f7f34e0f7e939431413aa481f36f43c55c60a439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620723, "uuid": "96f313d5-0a9e-4432-a09c-69d0edb2b4bd", "comment": "Malware payload (Loki)", "value": "2e5e0696a1ede751b45bae2c08ac0f069232a9a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620620723, "uuid": "d4ae85b5-1b39-4710-a768-a40befb5eb71", "comment": "Malware payload (Loki)", "value": "a83aa4f99ba58fa2d29f76dbd8fd6cf5ada15b9007631518dda7e9428c9c0cf31801b97846ee1ab40cd02cb6e640a4e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620723, "uuid": "0cc28582-beef-4b55-9930-610694f66bef", "value": "7CE4D0203BD8AA58E1BF97751870C14063F2BA27D722C75E699DD08E2E31746C7B2763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620723, "uuid": "bdb5e087-d237-4d91-a1ae-a911079020d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620723, "uuid": "ddd04b05-5c0a-44e7-a339-4cfeea95696e", "value": "12288:hIn9/JDXStBVw1hhhsr0mr61HSmpxCEIGZZ4DFPHiWSzh7g:hqDXSPGhhhsr0m2PDvI2+DFPAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620620723, "uuid": "b848e253-a018-419c-8e29-4419131a4cac", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620620723, "uuid": "6a1b70ac-7a9e-4ec9-ae84-7a9193f7a7ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620620723, "uuid": "dd366195-9611-4635-abcc-1aa630d7e8bb", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a109b2-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644487, "uuid": "26e7e172-be6d-4f3a-ad64-99c392cb11d7", "comment": "Malware payload (Dridex)", "value": "ad915e70cb345d6a28d30a26e2a159d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644487, "uuid": "8adf752c-c4fc-4edf-8a0b-790dd442e7fa", "comment": "Malware payload (Dridex)", "value": "a4ba43f65e7ff8b255ac84a602dca47d42febde5e4d6d06a1290448fda9d7215", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644487, "uuid": "8db65267-5c42-48d0-901e-29cdb3dc4534", "comment": "Malware payload (Dridex)", "value": "e485dce08f0484b6911402309c629b0835c40acf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644487, "uuid": "f8b3217f-dad2-4e7a-a10d-d7bf1e10a510", "comment": "Malware payload (Dridex)", "value": "5f1b82de2970fc3118a4d69d9841ef1005fd286d805b5847388c2617518ef6fa2ff22b1eccb5de2e1b60153cbbe31c97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644487, "uuid": "65e88461-58fc-4401-b5fd-1ff1d896faab", "value": "F5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644487, "uuid": "1283b8bc-4ee9-4135-8000-3b7418cb2803", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644487, "uuid": "60fbd860-5d40-41f7-bbba-04ecb1732a24", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644487, "uuid": "64c1cf16-00a5-4d24-b822-3b4a3ef959c4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644487, "uuid": "7ae67560-c10d-45cd-a719-9248422b6b29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644487, "uuid": "9c8ddb7b-90fe-4a49-adef-3374277d382f", "value": "ad915e70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1968d33e-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644501, "uuid": "13dc7581-c96e-4467-b8c8-b43e3441dd67", "comment": "Malware payload (Dridex)", "value": "653cd66f12a3cecd864030a7cfeb1f6a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644501, "uuid": "34c2a2db-be7c-4c64-b5ac-cfc913dcd318", "comment": "Malware payload (Dridex)", "value": "a505d2ab393bf7e8aa6d8fb696d5cc933a72d9bd832e066f4e86ccbf3229c135", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644501, "uuid": "65fb96ae-9325-4be6-ac64-90cda13155a5", "comment": "Malware payload (Dridex)", "value": "8113950614b3238d46df7c190257e725ea0e634d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644501, "uuid": "509a998d-899b-41d5-986b-86d52a049ace", "comment": "Malware payload (Dridex)", "value": "5e68727939ed1b2899b3941c02d601556387b8e194a6b60be6acb8128e0eec48bbaa441d4239b5a79eafc09671bd7ae3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644501, "uuid": "cd092976-2d88-48dd-be58-21b439e1b506", "value": "72F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644501, "uuid": "1d810df5-0eb9-40ed-9e12-77fc37b58199", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644501, "uuid": "d71b50a8-f5f5-4e47-a152-77738100f99b", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644501, "uuid": "05e6fe44-ce16-4a88-a6e3-7ad00d17800f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644501, "uuid": "955a2ed4-9344-4a17-907f-f63d8cc680bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644501, "uuid": "ea435bd5-b61d-443c-9001-9b48bacb2a03", "value": "653cd66f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9d6952-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633872, "uuid": "4f9acce3-3fb2-4633-be6c-be651b9258f8", "comment": "Malware payload (Dridex)", "value": "17cf1f25497edd87f5f3c47ee13d383f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633872, "uuid": "ee7fc03b-9281-4145-a79a-2e329f3513e7", "comment": "Malware payload (Dridex)", "value": "a53d280a2c42e44b4c8bdd17618ba582e39c3b2e2f3461164480e67de46094ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633872, "uuid": "2b29b0f2-5d5b-4acc-a4ea-fb3d02dc936c", "comment": "Malware payload (Dridex)", "value": "fb527ba69135ccff3e18fab3456070642986dde0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633872, "uuid": "a7304c5e-6e2f-4686-b704-699231214dba", "comment": "Malware payload (Dridex)", "value": "ac2bd69db938c4cef9c6b141aa32f49abc6205892d303aaee1529ff9b343bddb3e936b35c06e29c0b210718404a3beb7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633872, "uuid": "d8643069-8a88-4a69-8e76-f3a3893705d5", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633872, "uuid": "3b499c2c-9038-4d76-94fd-fadd9ddd4830", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633872, "uuid": "b243a07b-8263-4f94-91b9-98ba02804a07", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633872, "uuid": "9f41b48c-af3e-4861-9085-b7e29288d660", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633872, "uuid": "2567630f-4299-4c42-aa97-018546db643b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633872, "uuid": "6cc662b8-a541-447a-b7ce-2a06193ab1a7", "value": "17cf1f25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecfc0ff-b18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651247, "uuid": "d6e27eb0-af5e-4078-83d2-25dc1e38303d", "comment": "Malware payload (AgentTesla)", "value": "6d50990943c5fb880c4435eb5d93e35c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xe", "colour": "#AEECCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651247, "uuid": "5a244c6a-c6b7-4543-a6da-1c127f77bfaf", "comment": "Malware payload (AgentTesla)", "value": "a56b70e41664dadf269b381f7b34bf08091cc5810c25c107f92cdaabae6eecfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xe", "colour": "#AEECCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651247, "uuid": "738d0cba-ed31-4959-a4d8-d1ec76e81feb", "comment": "Malware payload (AgentTesla)", "value": "b66c3c0203e0a4bfb8fd64b865c7e5ec26109034", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xe", "colour": "#AEECCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651247, "uuid": "9b484c6f-04d8-4afd-bebc-a152d48d8394", "comment": "Malware payload (AgentTesla)", "value": "4d810ba5539954de9021d21d1dd0083170a8c7a6ce831f9e226ed26203d51528064ecaa08a96dd9ab6336b3d24f083b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xe", "colour": "#AEECCB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651247, "uuid": "9989a230-94e6-45b3-ae49-5e4dcda0e86c", "value": "97D4D02C37E48947E67E56BC8075212043F4B12A6917F76D9EE030EE3C77760EA1296E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651247, "uuid": "6a050192-08b4-4588-ae3e-7acc8d20bd3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651247, "uuid": "01c418f6-cf6d-4938-9467-89d908672234", "value": "12288:xi7zAvej0ITlvx5urPVk9Hq2oBpwtK7eHYvB0V8E:J2lvjuri9HtYBeHYi8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651247, "uuid": "0097e68b-c96a-43f7-baae-6bcf191b1f63", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651247, "uuid": "73f73777-ae6e-46eb-addc-83c1e5b99c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651247, "uuid": "33080434-c257-4ca6-8b6b-0b8d6933e3f1", "value": "file.xe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f067eb03-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680509, "uuid": "89510d16-3ed5-4e3c-add5-ae2e37938ca8", "comment": "Malware payload (Dridex)", "value": "195405f75e876e1c441d4ef8e6995e8a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680509, "uuid": "846724ca-a9d0-42c9-b9c1-be4577730618", "comment": "Malware payload (Dridex)", "value": "a572348c03a170465a08ffa64594f05b48257bc744a90736ee9baaeab8b5bc7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680509, "uuid": "405766c4-6b63-4c67-8222-3a46ebe20271", "comment": "Malware payload (Dridex)", "value": "013a8af67147e76d5835781d57ba5f56e43ed4d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680509, "uuid": "0e9a9b97-d64a-4ef5-98e5-51b0b5fb3a8f", "comment": "Malware payload (Dridex)", "value": "01a25998ff43e0b7015b76b90bdaa22f2714a90b1692f25cfe6f54da1fafab5d19d9b0815c932bef08195f82116a8469", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680509, "uuid": "b4ff7032-35d6-473b-ae04-9274204151f9", "value": "ABF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680509, "uuid": "4f6fe58a-747c-49d5-a527-464e94da10be", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680509, "uuid": "0437f94a-9f44-4d98-9698-32fd6435914d", "value": "3072:ciFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:/eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680509, "uuid": "300a91d4-d580-4581-88b3-8512e69ed787", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680509, "uuid": "2bc5ea9c-d9f2-4e2b-a25c-271a1cc831bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680509, "uuid": "a067235f-ee4b-45e2-88b2-4985f7b4773f", "value": "195405f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96da357c-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624954, "uuid": "9db89d6c-9d37-4ef2-8e70-be5c3ecaa4b5", "comment": "Malware payload (AgentTesla)", "value": "82ff1bd28c1f988a0dfade99ba202942", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624954, "uuid": "8bdb4cad-ccf3-442f-8671-693e1f287267", "comment": "Malware payload (AgentTesla)", "value": "a58b212d35c518bce8ada5a1952613e9028aee9ff5483515dc8c54a60908174e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624954, "uuid": "700b0f92-2d58-48ef-b871-b7470076455f", "comment": "Malware payload (AgentTesla)", "value": "ff9a67ffa09e98aa3652084524191adb5cd4f6b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624954, "uuid": "9267b3a2-b736-4833-b9f4-6d1164907f1a", "comment": "Malware payload (AgentTesla)", "value": "ba853052b2a62443678598cb4fa126c4e20a6ddfe071d7890853d502378ebb52047449f91d4a3269da27a859d8bad211", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624954, "uuid": "c41ad641-4106-4687-b25c-b509fee3feb0", "value": "E5F4D0303BD8AA58E5BF57711970958063F2BA17D722CB1E6ADD904E1E32742C7B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624954, "uuid": "f3654405-bdcc-4c6b-8701-a10870d4d2cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624954, "uuid": "f17a5c38-bf86-44a7-b3b7-324a6d21c452", "value": "12288:1I69ISVXqtBVw1hhhzEnYocBya+Po92fpjJgNA9DQCfd8Dj8aUXX:1JVXqPGhhhznocBT+K2fpjOs9Isn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624954, "uuid": "5b5ad057-5b20-4667-9a19-251214caccf6", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624954, "uuid": "cd20c68d-02ad-4183-b35f-cb3e75e20ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624954, "uuid": "60817a22-098e-457e-97da-c4b91bc33005", "value": "laPMTrYEUrZUexI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89572975-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620662727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662727, "uuid": "29c59b24-1056-409e-851b-102709b5c2bb", "comment": "Malware payload (SnakeKeylogger)", "value": "6219714daaec52b52ae0dc69c183b12a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662727, "uuid": "79abe00b-5d1b-4843-b4f8-27f733536bcb", "comment": "Malware payload (SnakeKeylogger)", "value": "a608e12ae5bb4560a9ca9d4be49ddf2e04a3cb65ff3367b5bd8e4a8cc9325a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662727, "uuid": "09344e23-9538-4fa1-aced-3f82a2567e22", "comment": "Malware payload (SnakeKeylogger)", "value": "8d61758b445921155ff455748ef93a638657e6db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662727, "uuid": "390a0bec-8313-42d0-ac20-59162b0f07c8", "comment": "Malware payload (SnakeKeylogger)", "value": "aedb7158c6f7211399bbb4f07a75ede085b4c82a472fd3ce6a6e4064cced3db62911cf93a85d65f7c7276f0252343611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662727, "uuid": "b0d6fa04-fa0f-47d2-86e2-ff68eab63d15", "value": "58D48C7748480A04E25E3B38C190F77983121D946BE9EECFAD897D96923A3F1F4109DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662727, "uuid": "368a1606-ca95-4a00-87bb-92bfd2b473c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662727, "uuid": "af197c7e-a0c8-4d00-8f20-16c083d53c43", "value": "12288:EGHHFMw7Y9MA59CyMAn0b++oYfwyRJNYc2AAMfmKOu:XH+w09tVw4cZ2AAMeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662727, "uuid": "2d4d2e5a-bbee-4144-b175-9cf1350d8513", "value": 635192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662727, "uuid": "42252c31-f516-447f-9cc2-c41d9f6f6e1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662727, "uuid": "1bb9c215-06ae-40d3-8fc3-653a21a23198", "value": "Eliorhcq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2eaccb-b1e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620686171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620686171, "uuid": "61d13a72-396e-4b6c-8ca7-eee017e5717c", "comment": "Malware payload (RedLineStealer)", "value": "ab578681f8e3584b5a367978b3452483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620686171, "uuid": "faf09770-7993-45d6-a0e6-c09025a02ead", "comment": "Malware payload (RedLineStealer)", "value": "a6f82c75e0d8bdc6e292c6caf903499633f631d5ae2c2cd18c83d873877665ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620686171, "uuid": "f8e3f3dd-b076-4041-b9c5-ab4c881c3fe4", "comment": "Malware payload (RedLineStealer)", "value": "5505df55c3af0987d88aeb891b5063e2958bceae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620686171, "uuid": "644134d8-e2fc-4183-adf1-f226a1f5a3dd", "comment": "Malware payload (RedLineStealer)", "value": "a43d95ff8a9c3dd7489231cbbb2ab6e00bc32558874c43b61e8c66123d1de96fad2c4b448279aed49851915c8ba33ad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620686171, "uuid": "96d82906-1c46-4f8a-a23e-0bbcd3ab3612", "value": "7A13ED229B1718FEE43EBDF10761B96CC9052C065ED16BA3688C361F0CBA5CF0A1DB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620686171, "uuid": "e5618ef5-8605-4479-a191-da1d11c11309", "value": "5d34ba5850be08880fb0d8ec736d715b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620686171, "uuid": "6e9433fb-45c8-4979-9f31-a8e820389195", "value": "384:/TZ3X8150rSXUJDipzQvX9uiMbtB4kONxJqKg+9mXE9uSn80VycTdX5HlWAsqteI:/t3knw+pzQ/Jk4kUxTjgSDB7b7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620686171, "uuid": "280eb834-58e9-42c0-8d94-9d18f24a33f4", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620686171, "uuid": "2306db09-176e-4a42-a707-ae43ff226ded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620686171, "uuid": "0592df53-f218-4a83-9e3e-b8c88a57cd09", "value": "AB578681F8E3584B5A367978B3452483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97adb504-b1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669194, "uuid": "100a15ab-f9ff-46ae-9824-d5e0be2c2aec", "comment": "Malware payload (Dridex)", "value": "32ef239e48a12d642bd9992d58c5082d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669194, "uuid": "90e6771d-9d10-48e0-b023-f7a414280d37", "comment": "Malware payload (Dridex)", "value": "a7925bc93fdc8a6aa1d966ee04dd831b52d178b8e9ff909af38460a96ca08776", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669194, "uuid": "fe7187c7-af0b-49ca-933b-3ce0e9dff9f5", "comment": "Malware payload (Dridex)", "value": "93aec6c038b32915643f0120c3534b97570a6180", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669194, "uuid": "f7ffd785-20ed-4594-ae8c-8fef2c4c8c2c", "comment": "Malware payload (Dridex)", "value": "33b72b4d1a793d01464ebbc6e069bb5afdbbcbc46077ade188ce049c871bd64c1590cd1b827d148b0b2167f935fd13b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669194, "uuid": "b84101ff-7b0d-49b2-8931-68c0b1565a48", "value": "D2E4231DC6A8EF8EDD36637AF31C06699E072FE181C0675B6BD041DE27D8ADB0443686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669194, "uuid": "858e54c3-3499-4c64-98c5-a9b26ca12174", "value": "12288:D332P8c6sZ8hmrIqBbIJLFSRd5pxhEzbvu31SdFHt7U124z+uKOd:j889smgIqBzdnxhEzbvOSnHa1Lz+od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669194, "uuid": "a7b06bdc-f9c1-4889-81c2-fd6c31217bd6", "value": 671432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669194, "uuid": "56cb7d11-b841-4b32-9d81-109a58c83914", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669194, "uuid": "f53061ad-1851-4385-bf06-979b3ef77f1c", "value": "scan of bill 0905.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c864bb42-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673570, "uuid": "2c6ca605-4053-4671-a7e7-a11f936cc838", "comment": "Malware payload (Dridex)", "value": "b25c406309c5d561bc22401d3e2d2941", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673570, "uuid": "8f716d91-4ebc-401c-a9a9-ccbd97ed58f9", "comment": "Malware payload (Dridex)", "value": "a850108a5320c26b8d58e53a80a3da3b13f79842843919b21c4acc8bed69ce42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673570, "uuid": "c8329af5-e990-4aee-85e5-239cb22c76aa", "comment": "Malware payload (Dridex)", "value": "9de9c2b4df538550841cea74bbd456796e901d08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673570, "uuid": "50785b7f-2b9a-4f99-bc31-a5fd880c6d0d", "comment": "Malware payload (Dridex)", "value": "b30ac7d2ac8dd7953aa3e4fbe6665bb1d90a5bf1dcd53b754ec577d9f3a88b349e078254ab21bd51a77e70406d92938a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673570, "uuid": "faf238b9-4575-4d11-be1b-d39e87197c96", "value": "A0F3D00FD94ADFC3E6F21C3284EEB26E7E98D12A4D24E2D77960E52E5267D6901344C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673570, "uuid": "e0b59de2-803e-49e3-9fc4-7681234f652b", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673570, "uuid": "4fd713db-8628-4fba-97b0-ed5e99f906c6", "value": "3072:C/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLKM:AbrE1kvcB74DXZ2MelDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673570, "uuid": "a10e4277-cebf-419b-a40f-a89d55b17868", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673570, "uuid": "d35a62a9-5d65-457a-8bd3-baf2fb25688f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673570, "uuid": "07949f8b-c123-4ab4-b40f-aec7ef0b63d7", "value": "b25c4063_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4403d2da-b166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620633835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633835, "uuid": "06af19bd-3fce-4464-88bd-2679059cc6d3", "comment": "Malware payload (Dridex)", "value": "3b4b14388e6f48bc8b599c7f145ba0c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633835, "uuid": "7f92d537-a6bd-466d-820b-de436e92ceab", "comment": "Malware payload (Dridex)", "value": "a8f99f44268e30207932168f8f8a1567980384ed939d1017faf482650b495118", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633835, "uuid": "2401cd47-0244-41e8-b2f0-414e4287bb5e", "comment": "Malware payload (Dridex)", "value": "bfac4338610aa6f5e49d65076259ecc04059d6b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620633835, "uuid": "c4d7079a-a273-4780-97e6-a55232344642", "comment": "Malware payload (Dridex)", "value": "53a9b07212b11ab0d4d4d4a9df899b7d525486c672b653194f2ded4089c043d82cf1254a2d74508fafff43886ded5a49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633835, "uuid": "c72677c8-a186-49d7-86f1-f5bac8d115cd", "value": "6EF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633835, "uuid": "0d841bb3-e344-40fb-9cfc-78cc966d77d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633835, "uuid": "207124e5-94a6-4620-b749-7563dcf0281f", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620633835, "uuid": "b8ff36fa-76c8-429b-ab09-5b7f0772f056", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620633835, "uuid": "816191da-4d7e-4060-b13c-84dc34ab770a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620633835, "uuid": "45882dc8-932c-4151-91d8-ab3f8d344602", "value": "3b4b1438_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6ac5d4-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630785, "uuid": "79da3744-075a-4b9e-a8e9-f3effa2e594c", "comment": "Malware payload (AgentTesla)", "value": "b2a9b58cfd1ab5b674e6214c4434f053", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630785, "uuid": "b5542f7d-c6ec-4d66-b191-e8170f9dc6b0", "comment": "Malware payload (AgentTesla)", "value": "a92f927714b305a13227d54bb3fa1aa7b500c64eed315753b5fb4edff957e100", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630785, "uuid": "32c61f1e-1b52-4034-bb02-6c677c7350a0", "comment": "Malware payload (AgentTesla)", "value": "eac0b31b4bd2e625c3c5a8de54d24e44f5b5ddce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630785, "uuid": "8fb8f7a1-799e-402a-966f-39f9fd7507f1", "comment": "Malware payload (AgentTesla)", "value": "882a784ce8eda20d7f5c934f7b74326ddadece9d9060c18883e7795eb0a320b5e7aa307253ea4c14be37459c218fd970", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630785, "uuid": "a6628830-5eca-4869-b571-07acc3906e7d", "value": "E1E4CF3523D86F55E47EAB395074000067F2B80BD732E54DBDF698DA5AB3F818626B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630785, "uuid": "0b5d091d-82be-4fda-a71e-59655db1dec7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630785, "uuid": "40980fb1-369c-4eca-a330-d1289071a218", "value": "12288:Ppr765N5NhQDcrfGVK90K8DIZ9Tg0FR2YKFNt245hAlM5:PVqN9QDcrx61g80UNt248l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630785, "uuid": "8bd8d0fd-41e3-4a8a-bd61-55a0e31d540d", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630785, "uuid": "4f3f72e7-763f-4ba4-82bd-17cf16e1fcca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630785, "uuid": "756cb743-db0f-44eb-a184-1b814cc1b734", "value": "q76bZd6eAEY1VqI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09c0fd8-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630634, "uuid": "112ac795-8703-4fe5-8d4c-096861b6b984", "comment": "Malware payload (AgentTesla)", "value": "7b339e0adaca8e4439e2d193f32c33da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630634, "uuid": "82138817-d9ab-48b3-b9f7-ad838f663519", "comment": "Malware payload (AgentTesla)", "value": "a97c788cc16a7294c6e5157ef27caf2a491d9127e656d4886bc56cd8fa86addd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630634, "uuid": "c6103236-8493-47ad-9ab4-82b68d44a35b", "comment": "Malware payload (AgentTesla)", "value": "0b1869775bf8b33e6c7ecde8c8749bcf49121638", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630634, "uuid": "65bf5c96-f9cf-4d64-9710-2a6643043531", "comment": "Malware payload (AgentTesla)", "value": "b9d1825d69f5f77d0e7cc5a80b601125b1be385009bec1ad273bb717d3d133ffe947ad1b73756f2e321e0fd4044fec53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630634, "uuid": "1009d81e-9e72-4fa8-b7b2-98e7c7132012", "value": "9CF4CF2533C8AF55E83EA7395474150053F2BD07D722E64EBDF6A4DE1AB2F808626B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630634, "uuid": "58ee4ed1-53da-4b8d-bb50-339e79a43025", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630634, "uuid": "b442b6d0-0bbf-4f55-bbcb-0ca961bda67f", "value": "12288:vH7K4O3pXIr2o5TBE2Wj70gOf/Io0vZ/OcWLgt6Wy4wTJicUM:vbKhp8d5BlWj70HHI1rWLgtNlwIcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630634, "uuid": "e323dc8b-9e68-4140-baa8-6847837a7b95", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630634, "uuid": "4aa3959b-6391-4b75-a790-900039962dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630634, "uuid": "e1daf10f-7175-4f87-b001-69d289278040", "value": "PO1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451baeba-b17e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620644144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644144, "uuid": "cb9186e4-7ac8-47d4-a86c-8aa0768660d8", "comment": "Malware payload (Loki)", "value": "a62307903bb6a940e3e356074ab8d417", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644144, "uuid": "7e1af15b-bf0b-4a57-8447-85c26c31638d", "comment": "Malware payload (Loki)", "value": "a9a5824c4e5d0a76516a250cc684a153a2db671e3fa28b664b4a6d08a7e7967a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644144, "uuid": "7be714c4-a94e-45b7-861d-d164553ea603", "comment": "Malware payload (Loki)", "value": "834be6c4389f91dfd3de41d483a1a1961b66acfe", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644144, "uuid": "7baee159-d51b-4572-a92e-8a56a130c510", "comment": "Malware payload (Loki)", "value": "27b0271adba00b794389e0add4b786c9eadecd08870ed4a58c0b4bfaeecd58f2cd9568088f221fcddd851ece346bd9b0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644144, "uuid": "de30e3a4-92ab-43d6-95b9-4387b5d9a21f", "value": "CBC423DDD02D652EE3C839D09CDF5FEDAF2C0A9F17E34A462261E91F9685404540B8EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644144, "uuid": "8df0cfd3-bb45-4916-b3be-4d20a1cefb24", "value": "12288:6P9Bn0vklytJHIZCWqKiPeiqhHr0JT7dLy5GAik3UZOG1NTO:2f/ytBYCWqzfqhmTUtpUZv1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644144, "uuid": "ca1c4c68-e0d7-4b8b-92d3-e19995a1e136", "value": 573089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644144, "uuid": "ec39740c-a462-4fbc-84b2-be88e9eec9e0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644144, "uuid": "9a241e5b-c9a7-4c5f-b3b9-769456553608", "value": "Revised Purchase Order #84734.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c58754-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620630724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630724, "uuid": "395eedef-9b3f-4fab-9cd5-bdd2c988a412", "comment": "Malware payload (Formbook)", "value": "9904ec065111725685cbe8865bf33e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630724, "uuid": "3665877b-080c-4514-8203-f7ef21874102", "comment": "Malware payload (Formbook)", "value": "a9c017e2d279ba3ef817b6db811ce21af904951e7f5a7460f1ba74c563b96cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630724, "uuid": "1907eedf-2cb4-4cbd-9e62-72f013074ffa", "comment": "Malware payload (Formbook)", "value": "b55d215d3480c6ee9178a548f2cf3b3ba00f691d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630724, "uuid": "354539f3-472d-413d-aa15-e8ffdb024337", "comment": "Malware payload (Formbook)", "value": "1abbe08059f3f66355e0f0c54b10f635cf072fe4443538d931cbccaada37d9afcbe7e46e5a726b16da6e28d36fa0180a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630724, "uuid": "6e263d35-f886-4de5-8024-85b569a8fbce", "value": "4CF4CF253788AF55D83E673A6530150017F2BD07D731EA8DBDF6B4DA1AB2F808626B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630724, "uuid": "791629b9-d7d7-4113-9780-382c6220cb17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630724, "uuid": "ed5b9922-5236-4f5c-a609-623bf000630c", "value": "12288:U7vbJCGg2WKEE8BEEFv2JtPzbiJr68E458M:8vbEZ2WHbEBJtPypbR58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630724, "uuid": "15936fab-68ef-4ddc-965a-4bbe489c804d", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630724, "uuid": "6dd79e80-a444-4813-839c-eca1b1ffd040", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630724, "uuid": "651c65bf-afcb-4c96-96d9-27f58479967c", "value": "in.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69cb757-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673514, "uuid": "4725248f-ee02-4439-9228-f9214d8a78ba", "comment": "Malware payload (Dridex)", "value": "e986eee0b3d086cfff04414c990af35d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673514, "uuid": "b10e3b88-1bab-4780-af3f-d94cae0106e8", "comment": "Malware payload (Dridex)", "value": "a9df56e4408deaf85803cb8d285eefaab112284a0a43509778388b348fd0594a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673514, "uuid": "77a49588-a5ff-4daf-8e24-1b804ff99939", "comment": "Malware payload (Dridex)", "value": "4bd92052d5674b895df06a6f7514ed64de826dbd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673514, "uuid": "984ed57a-479a-4598-bcc0-c769537cb0f4", "comment": "Malware payload (Dridex)", "value": "8dee254464f5403c67a86f6639c7bb47e20e2732c7b089df1b62a7568b2f4176e77e3c586ac854bec706f690ab25421a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673514, "uuid": "c10afe8b-de9f-4dfc-bab2-d29282a39b18", "value": "70F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673514, "uuid": "411fd428-8e94-4a9e-9ee9-99b7e0706ecf", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673514, "uuid": "fe4d03ac-3ccb-4387-9a7c-2324903fbad5", "value": "3072:Iesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:C4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673514, "uuid": "40656e12-0019-4e0c-b5b3-1e8228797a17", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673514, "uuid": "374bd769-a3ba-4e80-80c4-7409341068df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673514, "uuid": "b0c133fa-c6d4-45ed-a5fa-9766a474e853", "value": "e986eee0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69754fbe-b1b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620667398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667398, "uuid": "62850adc-4205-493b-83a4-04e5c1dc9516", "comment": "Malware payload (AgentTesla)", "value": "f85b4279b699b51e57d60199acf4d0af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667398, "uuid": "1f118492-1b3c-4dc9-b61d-241f512ffb3a", "comment": "Malware payload (AgentTesla)", "value": "a9ebd53b04c770e9500e4685195a122d8935294c452b2659ab67ecc910772706", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667398, "uuid": "943d42f9-4b09-4d11-ab22-4e156a9866ac", "comment": "Malware payload (AgentTesla)", "value": "58859bb07dd9c9daadc7d51c756d6eac82e2b2b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667398, "uuid": "147f6cd6-c9c5-4fb1-b02e-45880471289e", "comment": "Malware payload (AgentTesla)", "value": "d79e2a182d1fa9fa4bf69aa39636cd083783eb26cc58c8309bad03d0708fec934f98438a9fa5ba3a896fee6ebadb561e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667398, "uuid": "2af13c7c-8567-4c9b-ae9b-98675d9788f2", "value": "49C4D0243398ABA0F07EA73990B0010497F5F81BD339EB4DFE9950DD7966F818652B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667398, "uuid": "053ef139-f7b8-410a-bbad-831556721c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667398, "uuid": "7fd5107b-fc9c-4644-9973-7029fb67667c", "value": "12288:qz1h4R97SsUbGnZv8DIJdIlr6Ca2M+8j9eqP586qU1j:YE97SsUY0EL+7a2rqBr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667398, "uuid": "790460b0-ffd3-4e98-953a-bda84ac954e1", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667398, "uuid": "24c89712-8aa6-489b-8711-f6026bc435d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667398, "uuid": "22092f35-f7e6-4e2e-9bb6-630bacbdd71d", "value": "f85b4279b699b51e57d60199acf4d0af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dcc295-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620628232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628232, "uuid": "5efe062e-36f2-4b81-8c28-ac0da018e644", "comment": "Malware payload", "value": "6a7bd45c84373b00086d7c0ecab1ffcd", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628232, "uuid": "85a14c3c-0866-4709-88c0-ecb4c3e1fd22", "comment": "Malware payload", "value": "aa0c23ff57c890910a1ba814b727ab5512b55ff7785d975ed634bc6824d4502e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628232, "uuid": "1ff27fae-afe2-4d87-b0ee-9c378819b5bc", "comment": "Malware payload", "value": "ad3328cafb1fd86491f76705f2b5c9cb80394bc9", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628232, "uuid": "939a34bf-c871-49aa-9302-7c6b4b448693", "comment": "Malware payload", "value": "4b068c820ab0f665528d6a3b18a48eb1d01b96bc9824fb95ea082586ee659c84745750c1bc8c919998d2e144526f465f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628232, "uuid": "99350703-153f-4d69-97a3-4d05dc75f2d0", "value": "009403952742DE4FD64B06314CABBBF63365EC048F5FA2C7A150F21B1D3EA92EB61406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628232, "uuid": "a533ccd4-0d26-4ca8-9f3c-69ff7f5663e1", "value": "6144:cxEtjPOtioVjDGUU1qfDlavx+W2QnA+xVwdzozR2gMqqGr3xkhwrKUl/o3eoPyHS:Ko9xMEUwOXeosvzEdR1ODPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628232, "uuid": "d20eccbc-7557-45f8-9097-0d8878a586eb", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628232, "uuid": "d2fda845-e442-4193-93b8-ae407ddb3d7c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628232, "uuid": "14369832-f3c9-42f0-973d-664d7d302d9f", "value": "Shipment Information.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938a730a-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666180, "uuid": "9a895859-b038-4a2c-a7fb-b010d15a4287", "comment": "Malware payload (Dridex)", "value": "b7970ef9c451e4a4f225941a249571ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666180, "uuid": "871eee0c-578a-4a24-81ff-a7f58f1fbafa", "comment": "Malware payload (Dridex)", "value": "aa733bf3a1b6532eebac824fb8913701baf31282e0934f1da6d12115eca7f550", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666180, "uuid": "dcfe7620-1fef-47f6-a8c8-32d84d023ff6", "comment": "Malware payload (Dridex)", "value": "f4a4efac2fad6651a74891027eaf37d1afdf8129", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666180, "uuid": "e4e85c5d-29e4-432a-bea5-9383752153b6", "comment": "Malware payload (Dridex)", "value": "f3e464162d7a0d9a3ac8bd5bcd9c673fea132c21bcbca56c6d324fcbe3d3f5b4ede4426d4421bcaba68a15f0284419ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666180, "uuid": "70b8369f-293f-48da-b758-b3d2657d9e02", "value": "73F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666180, "uuid": "299559b7-b0f4-4030-ab55-f5feb92831ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666180, "uuid": "d74c10df-793c-4fe2-8e98-e1774f384ca1", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666180, "uuid": "c7df77e5-8084-4d6f-b9af-82710f664e4b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666180, "uuid": "6f9439c2-5651-41e7-ba01-0064343409aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666180, "uuid": "eb27c3e9-0034-4138-bc70-f5a05655f7dc", "value": "b7970ef9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f2996c-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644496, "uuid": "2cf8949b-f26c-48d1-a474-9b2206b62f5a", "comment": "Malware payload (Dridex)", "value": "a5c52e7fce2a7f217359ac2d76180cbf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644496, "uuid": "f4ccb31b-b153-485a-91fd-38e785b7e53c", "comment": "Malware payload (Dridex)", "value": "aa9439f6e4642a109e5920bc55db04a59d7f6faf6b8bcb112922ea080a3c8679", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644496, "uuid": "9ab551eb-ef87-4c10-b766-6d5536480827", "comment": "Malware payload (Dridex)", "value": "bd2a239978884db606ee91bd32dd1696a9191540", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644496, "uuid": "b5e883d6-cd44-482b-bba2-c8e851946216", "comment": "Malware payload (Dridex)", "value": "456dd8fb251f1c25dee951837ee4d21e6ae8cf80b40ea250eb46e04c1128b472670021397b45c9f1a8aba2b65b891011", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644496, "uuid": "7e4681d4-d5aa-4cf2-ba7c-b41833874f70", "value": "CAF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644496, "uuid": "2441f007-edef-4d3d-90ed-69aa406c764a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644496, "uuid": "dd86a533-94fd-4d61-868d-41ad285a7443", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644496, "uuid": "2ef83ee3-4240-4a6e-acef-5d3514b8c89b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644496, "uuid": "857da5fc-98d7-41dc-a4df-649c8f8e4e74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644496, "uuid": "6248c14d-eef4-4a2c-9415-ddb810da6cbf", "value": "a5c52e7f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670c5a00-b12b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620608553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608553, "uuid": "634feae0-6041-4bcd-9904-4347a0c2d237", "comment": "Malware payload (Dridex)", "value": "59c3030e574784d1aa701fd24e53f0da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608553, "uuid": "aa26bb0d-7f0d-475b-ab32-f63d972de63f", "comment": "Malware payload (Dridex)", "value": "aa9dd36403ba7201ae14aa653602aceb365dcfd783ba03c6aaa27decca452092", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608553, "uuid": "5196a226-9037-4a33-b23a-de7286bf814f", "comment": "Malware payload (Dridex)", "value": "adda74dabdbbe85dba40b516d943080aae91cbe9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620608553, "uuid": "9981bd69-dc77-49ed-8dce-bc6f824ee749", "comment": "Malware payload (Dridex)", "value": "5561a9f2e55c3faf6bae85e2f23ca0dcf39a82f235b4772ccced9c951e38fa708981b420db1ff0009f10575377fbfd88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608553, "uuid": "a2f8946a-a7e5-4222-aa8b-9d2332ad7b6e", "value": "9EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608553, "uuid": "bc78b18d-8ed0-4096-9e11-280d1de9d5fd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608553, "uuid": "415b4117-3fdb-4fef-9af3-d8721306a632", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620608553, "uuid": "bfb6c658-2c30-4b3d-abc0-7378f38ea789", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620608553, "uuid": "c17e2efa-c47c-4edc-9e3d-d3b6337e3b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620608553, "uuid": "68159c10-61f9-43e1-8abe-aeda425fff66", "value": "59c3030e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93091aba-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620649000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649000, "uuid": "90b107af-7dd1-4a3a-b3a8-d1bdc2eb4d40", "comment": "Malware payload (Formbook)", "value": "4e71f90d1817f44313f4e101ef393968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649000, "uuid": "b302e577-ab7e-4171-a335-e828083b0659", "comment": "Malware payload (Formbook)", "value": "aace20e28e61cb328da74ff938231b1ce9a07498d477efe3efc5c5d3d04b9dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649000, "uuid": "99e8d4b9-a431-4393-8810-358663417c52", "comment": "Malware payload (Formbook)", "value": "3932f9822134761e7bf9bc1902f8cc28b6820559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649000, "uuid": "0e6670d6-b1b3-4945-a0e4-47003f05b976", "comment": "Malware payload (Formbook)", "value": "adb9d067dac506749b97e17bee13e68be7c4efabbb018f3a428729455cc786ce2c8ae57534b9e37a23bb8230e85e7488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649000, "uuid": "f60838f4-7a25-47f4-93cb-8c2621475db8", "value": "03E48D21B2E14173E16E1E398C5AF37454257F5029F4247A6BF4B908AF3D3E13D292AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649000, "uuid": "0441a08e-7139-49ce-9aa2-2440f9b48bff", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649000, "uuid": "b64bb575-f78c-470e-8591-10608241ef20", "value": "12288:hrnWDrl98a7LUacm7sbiD97T5QM4Pr4rvU/Oy/6:hrWnZnUivR71B48rvUD/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649000, "uuid": "a140db8d-d9be-4fab-8e69-43393a6a2f52", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649000, "uuid": "a416584f-30af-4692-af6e-3ee33b9f2c0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649000, "uuid": "3475017b-a886-454b-b787-a882205f6a12", "value": "Citvonvhciktufwvyzyhistnewdjgsoqdr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1658f4e5-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669836, "uuid": "fc70f0f9-243a-4cbc-8b7e-26731a1b4db5", "comment": "Malware payload (Dridex)", "value": "2b8c797aeebf444d3ef85174788f9a08", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669836, "uuid": "28ceabfd-b089-4b8c-8c91-8417fd8edb07", "comment": "Malware payload (Dridex)", "value": "aaf6ebe2e1223ff05ee36f46f8d6e5dfbcc17b3c7c1e7bceefdbdef9c95d85b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669836, "uuid": "9dbfc39e-f335-4b49-adb3-b73fa56fb35d", "comment": "Malware payload (Dridex)", "value": "813b03514862fcbf3a23a96e028f3f96a9d92d94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669836, "uuid": "7994f5db-2b15-4922-acb7-d7ce9374b66c", "comment": "Malware payload (Dridex)", "value": "0a2ca64cd02bc0dfa765483e85168facdf3a910dd1bdf5a985fe7cfa0bc539826f3bc76d6e1393cadff59b70efca6d99", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669836, "uuid": "35a6b611-3d51-4e52-9c9b-78f40ac665da", "value": "0EF3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669836, "uuid": "31d8f225-cc6f-49f9-ae5b-d543e94b9911", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669836, "uuid": "ee510ec7-375b-414c-8f0d-4152fbb849d0", "value": "3072:K/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL0D:IbrE1kvcB74DXZ2MelVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669836, "uuid": "c6a4a6a1-189f-42ee-9a55-7b0a5e2b9e55", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669836, "uuid": "ce6d1c12-d687-48aa-9655-0ca30216e565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669836, "uuid": "1c618589-e80d-406c-aa4a-fb90b6f8d9f2", "value": "2b8c797a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fa1d8a-b1ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620664554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664554, "uuid": "1a7afbc2-9b5a-41e4-8e55-8eb6fc3f425a", "comment": "Malware payload (AgentTesla)", "value": "db49a506f8e8153044de405f71a2b953", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664554, "uuid": "6b473e76-4f1c-4b90-b0e4-6177eb2abae8", "comment": "Malware payload (AgentTesla)", "value": "ab3f16b02d36e2704f91ee7fd1bec80221d1bedc7eb18d85bca4323380635b07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664554, "uuid": "9b1c5221-bc7d-44ac-8d4f-90ce3937c13e", "comment": "Malware payload (AgentTesla)", "value": "51d257efb294e5df12d4c6dd384b994bba537466", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620664554, "uuid": "77b703da-920b-40ed-8244-3db42451c307", "comment": "Malware payload (AgentTesla)", "value": "fadbf2776b2745599a06b5eaa409a8a691244008714cc38a6850462742a22f70421f9f307632a24e04bd336b1c075126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664554, "uuid": "65191e94-0a90-4d78-93a2-69d5f4f62045", "value": "EFD4CF2C3AE88A45D9BE56BC9071D17083F8BD065513EB5D4ED02CEF3CB7721EA01A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664554, "uuid": "ba12f4a8-891d-45d5-b274-0102b52cf606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664554, "uuid": "64a8c895-bb37-403c-af57-f3d10cd60ac3", "value": "12288:ei7Bjn16LnXwbkK9SXHVYWtZhzSSb8z3zuYUjvHccZ:bcXFKwXHrDSJ3qYuEcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620664554, "uuid": "b737c38c-c641-420f-b38d-cab4615c30c5", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620664554, "uuid": "9354d05a-763f-472a-b7f3-61b8c00dd2d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620664554, "uuid": "c930a801-859d-4450-b0a0-310baabb491a", "value": "UxG2fNET6MxP3XO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb11a05-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673529, "uuid": "71c4f207-ef33-4ded-bb62-21e99e15ad56", "comment": "Malware payload (Dridex)", "value": "08d9b94fac0c82d1a12b2b7f9df1b579", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673529, "uuid": "ed207e6a-391c-47d5-a418-973d20b78869", "comment": "Malware payload (Dridex)", "value": "ab89d60f37a9881efccd327ea6fd2287b1047ad56ddf3f30b7045a3232e89ea6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673529, "uuid": "d14557f4-577c-4fb4-86f0-438e583020c4", "comment": "Malware payload (Dridex)", "value": "035b752ca8c7d8b0b272fe376ff9fcafba8e9416", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673529, "uuid": "b5444bf4-20e2-41f3-a85d-07c4f96604e5", "comment": "Malware payload (Dridex)", "value": "dc2b835f79a34259840313cc98ecc814181c6e10347ab804e5508693936f5943195b552e3a789cd3370320c72c71e3ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673529, "uuid": "fa32d333-00d5-4cda-a509-6dcf51f4188e", "value": "36F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673529, "uuid": "f8377670-6d05-4ff4-b390-0ffb9c16b376", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673529, "uuid": "c7143a2b-5e30-4e43-a2c5-d068b1dcb2b9", "value": "3072:+esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:w4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673529, "uuid": "e92c78ea-0067-47dc-9202-b1a8781447d6", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673529, "uuid": "33a885df-fa71-40dc-bbfe-f13790d5660a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673529, "uuid": "963ed0a1-d9c8-4bfd-86d0-60a0779bc873", "value": "08d9b94f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b73e336-b1b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666542, "uuid": "833fd53c-60fc-42a9-9598-558f3c59aa16", "comment": "Malware payload (Dridex)", "value": "d1ba0ceaa5adeb465d9e6d7b996e7489", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666542, "uuid": "0cc4ee01-dcbb-4325-b6ce-e5b49779c04e", "comment": "Malware payload (Dridex)", "value": "abc895a87082d646bdeb8810d94cfa2b9197edc3dacae46ea443b026f42f254c", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666542, "uuid": "394fd006-a388-4511-886a-e94b4a993ebd", "comment": "Malware payload (Dridex)", "value": "8fa1f2c1e0df0f831a94533ed280a48d7611fccf", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666542, "uuid": "0111401e-3446-4eb2-8d4f-97d3f3d6961f", "comment": "Malware payload (Dridex)", "value": "40554b4c37df5605cedb86a4637caf1deab4fa9d8ccc1dc706a73df6fb0bb54b951306da6b3666fdcf29b10a06120739", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666542, "uuid": "8bc57687-eaa9-49ff-be55-9fb1b6616e2a", "value": "620633AC30DED233E01728726248854212490EBDDEBF56603559A10E9DBBF6F78B8DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666542, "uuid": "70453bd9-d615-44b3-9927-453eaabe3bc7", "value": "98304:7GcvRySGDTq2hN4fe6e+Eb56sssyX1IPjA0w5aXR:7bySGq8NQeVx9sapB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666542, "uuid": "2a32421d-0c3f-45b2-af0d-bb3cb11c8d13", "value": 3771305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666542, "uuid": "1ce74312-cf31-4d3b-80fe-41b4c5c093b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666542, "uuid": "a7b58a71-cc2a-43b5-916f-6927c2137f6f", "value": "generated purchase order 6149057.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e7e8c5-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620640817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640817, "uuid": "796af752-7ba7-471b-ae49-e2abd9f62668", "comment": "Malware payload (NanoCore)", "value": "366a26356c266349642aef2c7435c616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640817, "uuid": "cf82a8af-6304-44b0-91ca-4211d5e9b636", "comment": "Malware payload (NanoCore)", "value": "abed7721d1f3d825fc8b9250500ccfc74adad1db2f5b8fdcb842ee8ee4c607bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640817, "uuid": "c17801ac-fa16-4d12-bef7-c71685909993", "comment": "Malware payload (NanoCore)", "value": "96ae00203b01d2ec30597204f2738004ee93017b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640817, "uuid": "6f5ccb89-77db-4757-95ed-2f7e6d625fca", "comment": "Malware payload (NanoCore)", "value": "3a39a1a532b5ab21a8e84375a153f3b22d90bb5f8e556bf8186478df7c32998b5d7ae7adfb06fbbe7442c366b9a1ef9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640817, "uuid": "fa86013f-0b0e-4e55-a5a9-deaf1ef0c68a", "value": "5935F170368C6F29C36E09B2E005C1805EF5AB165363C71D5BDA9F5F2762B06B73239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640817, "uuid": "53764314-1b46-4101-b862-4609d32bf0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640817, "uuid": "cda9a391-dedf-46e9-9dff-3e5bb9b26e2e", "value": "24576:ZKhhhkixOC1opPuJle4EhNC3Dg0ADqndl:cxOmo2tEHC3Dg0ADqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640817, "uuid": "b8a55458-4015-4032-9c7d-d7ba99cc3e2d", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640817, "uuid": "e7bde084-f054-4af6-8054-b838e1d22572", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640817, "uuid": "b202090c-803b-4504-9a1e-16a28fbdc9e7", "value": "366a26356c266349642aef2c7435c616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e612c8-b134-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620612311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612311, "uuid": "090dc639-240e-4c67-873d-34d03d78b245", "comment": "Malware payload (Dridex)", "value": "6e70936803d1bf06676d6e05c50ce2ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612311, "uuid": "cf8033c8-5d8e-4e8f-8828-f30b6c7391fa", "comment": "Malware payload (Dridex)", "value": "ac12746bd4a0f7e6d56217c58912616cca185475fb6a7bebe847fa0b07b5566d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612311, "uuid": "c3462731-64ca-4c5c-8ad0-1523e77712dd", "comment": "Malware payload (Dridex)", "value": "9b506481d03e615cbaeae1b2e4d5499097509fb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612311, "uuid": "01dca39a-79e7-4efa-9b57-fe2ecf6e1aa8", "comment": "Malware payload (Dridex)", "value": "c658bf455f20b4a83bf88486489f6347dea8c1d89c79e8a21ab4020f4870d41e253bdb4a0ebd83d427eda4d34b900ea1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612311, "uuid": "21b77457-bcbe-4501-9163-ba1f00cc9702", "value": "4CF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612311, "uuid": "23a2bb88-c9b3-422c-afda-7395fbc7cf66", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612311, "uuid": "f7e21f2c-bbd3-4ae1-b41d-d0847352560b", "value": "3072:iWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:i42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620612311, "uuid": "2277ffda-c48f-4f1e-bfe8-96b80d943e33", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620612311, "uuid": "6942d2f3-c4a0-4b97-bcb1-dc4a72506b4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612311, "uuid": "8a0c0b2d-5ac5-47e3-b150-aa9a6c3c8cae", "value": "6e709368_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faf6c24-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651893, "uuid": "22756bb5-3efc-4fd5-8e8d-d21b5fdf33a1", "comment": "Malware payload (Dridex)", "value": "0d3d25e001eda06f0b48e312fa1912f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651893, "uuid": "39162434-069c-4696-8abf-1fc4ef256b84", "comment": "Malware payload (Dridex)", "value": "ac2ee88f53ab7a53737f49a12ce299b77396a687eb8bb7abcf761866fe74c882", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651893, "uuid": "853e3476-4805-4bc3-ada4-6ac14628f4cf", "comment": "Malware payload (Dridex)", "value": "5f26ec7288f1f3b4f1f205ff27aad2e59d37e524", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651893, "uuid": "b5e6d6de-99d0-40e0-8539-e7f276c3b1d1", "comment": "Malware payload (Dridex)", "value": "7864f971c06caa69f260c3a2f874882411dc6710f75920086ead31c0a973b1d2b5e963980d034fbf4e96432ef6587b1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651893, "uuid": "b330bc6b-9daa-4bfa-9330-f87f8bf9f378", "value": "FFF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651893, "uuid": "3566a9e9-1b4d-4244-ad70-e620aa53ad6f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651893, "uuid": "27e40ce3-363c-416e-b3ce-e9468ca9c9c7", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651893, "uuid": "56cd31e7-66de-4287-ae20-c224549a269b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651893, "uuid": "20c6f9aa-b0e9-4108-ab7c-945c43ce91e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651893, "uuid": "09e0230c-71e2-42c0-9061-4bc0ab2859f1", "value": "0d3d25e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5510eb6b-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628280, "uuid": "bd43d809-2b8c-4a1f-9c48-0146540bb2f3", "comment": "Malware payload (AgentTesla)", "value": "400fbc6fd1907a76fe32cbdec6c81ba9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628280, "uuid": "9701e4f6-6f7f-4dee-a925-095789afc326", "comment": "Malware payload (AgentTesla)", "value": "ac378093221cf284ea649b78bb9940e5c9074b7bf48579ed82b004cee2b2402c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628280, "uuid": "fd787f07-5264-40fb-b768-e0d6e42ab9d0", "comment": "Malware payload (AgentTesla)", "value": "201d28328fcec86532d80977a577495131fc052f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628280, "uuid": "640c3d93-f42a-4a89-b0d6-4ab79e1e9211", "comment": "Malware payload (AgentTesla)", "value": "e1882bbb8cf1ca025f0f8e924fef4a4889168d545847009c71f67b5008779d373a4c27406f89099261dd77dd0d2a5ba8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628280, "uuid": "670dc440-284a-4a2e-ba2b-d16fcd4bcfbf", "value": "1B056CAC715455F1D36B5E7263CF1C0243652274743BE90E8BA013FA5A67F172E38A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628280, "uuid": "39734423-231d-4f65-9e16-f7bda23deaee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628280, "uuid": "dd654672-ae5b-408b-b7fb-032e7400db7c", "value": "12288:g7Q5pbZ9wOkooLLoS60/K7yh0Skk4ENpLOhl9v6Iso15AmqJ72F9FifwUCFAq:n5pZ9wOkooLASt/Lwl5s8ve+0fwUCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628280, "uuid": "d12093e7-7d5b-43cb-96c8-caf719bb8674", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628280, "uuid": "323117be-129e-4200-96d3-6fa78865f1ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628280, "uuid": "d8176bff-d4aa-4dc8-ba97-0419ffd5aca7", "value": "#CMA-CMB.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa38c9cb-b18f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620651750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651750, "uuid": "8298b2f6-b39a-470c-ac5d-a169f048819d", "comment": "Malware payload (AgentTesla)", "value": "fce9b37a0e60bb510deab2b37e48d669", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651750, "uuid": "bffc6a5d-d76b-4c6f-88bc-a9a7e7f913cb", "comment": "Malware payload (AgentTesla)", "value": "ac85282a041acbb009cd635d49a1323ffbb4efce661c21a2689380c4079201d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651750, "uuid": "3eb9a2a0-b966-439b-bd89-b912176081b9", "comment": "Malware payload (AgentTesla)", "value": "ec38d8bfa6f054453a46955af6d6635aa79c76b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651750, "uuid": "f38768e4-a9a0-44bd-8a03-33294545f929", "comment": "Malware payload (AgentTesla)", "value": "aadad924eaf35472af86bf0e725500149824af8ab941ab108930e45dc09a7c6c158f450c9cf74f7c2e8c2b4e7b90b497", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651750, "uuid": "d912dc2c-4122-4abc-b259-9d3c82a1fa2a", "value": "DF0523C99B6517BB85D256BAE34ACD20CDCA0CC1D53FA723897BC558EFA2F2C1D00196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651750, "uuid": "e69077ea-de71-4bb2-9bb8-ce952825a819", "value": "24576:o4pA4U1TxYaqEVsOjsf6FYuAKDMREEfsa5N:LpA4UBv7VsOs6XAKDM+CvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651750, "uuid": "3c2775eb-13f8-45ba-8926-fcaaafeca82c", "value": 832561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651750, "uuid": "e4ec0b02-5806-45e8-b005-d936dceef37e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651750, "uuid": "11e8ddc2-a257-421a-b508-903ebc1b1b27", "value": "fce9b37a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ab6201-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637307, "uuid": "8f6271db-9df9-42f3-8cbd-5f4a55816b95", "comment": "Malware payload (Dridex)", "value": "733733dae9472b331df5b143b0ad119c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637307, "uuid": "85204978-b768-41fc-b189-1673adf357f8", "comment": "Malware payload (Dridex)", "value": "acb2c5c43778f620f2b20b40329e4dc9ffc843bb0601b67285cb9700e5b81bf5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637307, "uuid": "ba79cd8f-e098-4691-9a05-d08572f6671c", "comment": "Malware payload (Dridex)", "value": "3b5560b79012291e338ee23846e8225e15c38bfb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637307, "uuid": "53bc0e86-5bc7-487c-aed4-24948ed8b1bb", "comment": "Malware payload (Dridex)", "value": "08a4a6a4b44c2fb87c50eba24332faba008b98a48142666cec88ff2e3ea80999202ce58d27f83552d7d804e4514e51da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637307, "uuid": "0a1f1365-462b-4d68-8f09-db5e6b4353eb", "value": "6AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637307, "uuid": "9a5c370a-8389-4faf-bac1-463e058d4b28", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637307, "uuid": "98101bf6-bb09-4b0e-82cf-d70c170d30c1", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637307, "uuid": "2ae4ed30-5b6f-4638-8248-3e4b81321117", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637307, "uuid": "3b0c5e6c-873e-4044-b5a9-6df5f6c9e3bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637307, "uuid": "c2a2edab-520a-46a6-aaf9-744df16c7dc1", "value": "733733da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddb4f47-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666251, "uuid": "784a2d84-dc68-472d-a537-3994cf0a441e", "comment": "Malware payload (Dridex)", "value": "3a7311ba536d1866e8372180755b0c36", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666251, "uuid": "877c36b4-617f-41ff-a3c3-cbc9d3ddd7cb", "comment": "Malware payload (Dridex)", "value": "acde9ae72956cc0d30974ba7fca9df896097f50e3343e44dfcfb640f51ea62da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666251, "uuid": "801ff97a-2712-45fb-ba12-4cfb66278e06", "comment": "Malware payload (Dridex)", "value": "ec26dd5fbb190af2dd1e1cfce7e694be775abca7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666251, "uuid": "dea5291b-53e4-4223-ba80-18f3e7d62f78", "comment": "Malware payload (Dridex)", "value": "e9172d9daff8c281d473f2c4a94a1ed66d68c8529eec27b71bc68102cfce42265dc4990408122247216a8716f04b6081", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666251, "uuid": "2cd4dc2b-303d-4765-b95a-1466cd0855ac", "value": "8CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666251, "uuid": "4c7e44c0-4a47-44dd-ae0a-e588d6020eca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666251, "uuid": "9492d936-6507-4431-8912-02020d7dbacf", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666251, "uuid": "ba2d3750-6ccf-4b63-a1b7-a003631cc4fc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666251, "uuid": "ecc174c9-2262-48c4-b49b-8112be14e85a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666251, "uuid": "82241bc1-f6bd-4816-bc06-40859ed7ee3d", "value": "3a7311ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b4a74e-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676982, "uuid": "7932c2ec-80db-42f6-9750-e9df3f67b532", "comment": "Malware payload (Dridex)", "value": "a4927ab50deee3daceaa837de5d86a17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676982, "uuid": "7f246ce9-5aba-4538-9879-13226f1fd4ab", "comment": "Malware payload (Dridex)", "value": "ace13c6f3df4507e2933582c164a436613a6f9a22a35f54608c021d613d9247d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676982, "uuid": "ee1d1111-555b-4ef2-91c4-ff1957560670", "comment": "Malware payload (Dridex)", "value": "f2e8a27a49dfdbf17652afef5fa5f7e61d45fa83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676982, "uuid": "677c9962-67d8-4d36-a9d1-c96140edcc1d", "comment": "Malware payload (Dridex)", "value": "d861bddc1fa64f3ea622e03c409c40dc40b02694c8ce7c97e5f9823f3f5236e75451c149edf02d5bb0fd7a00721fb00f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676982, "uuid": "ab7dd635-d3d1-4103-a06b-4b8ee4200bc9", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676982, "uuid": "778e45d7-0359-4191-ab22-7bb693971dd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676982, "uuid": "0ae9aba3-e7b2-4147-b7a1-1ddb4ad7c79e", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676982, "uuid": "45bc95ba-bfc2-4b9c-b954-1610cfae9627", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676982, "uuid": "dc891301-019a-4d44-8679-1d9be599d68c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676982, "uuid": "3edff6e7-b4ee-4b72-8504-bdd5aee36a5e", "value": "a4927ab5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec69103-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620662548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662548, "uuid": "7742cb5a-ddbe-47da-a1c8-849a0d7a0a9d", "comment": "Malware payload", "value": "fda16205c8785e34795dd7b8ed314e01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662548, "uuid": "a2f0dac2-cc32-49ed-9ed9-d5544c4bd6ce", "comment": "Malware payload", "value": "ad0df2dfd749f0d84f7fc56204e1001307183575ebb488d99fcf4da7a46a8ef6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662548, "uuid": "0794fc37-153e-47f6-a43a-9a3514ce0ac6", "comment": "Malware payload", "value": "338961a0ae250057b5d263495a1217e3146e57b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662548, "uuid": "9228b6e8-8f79-44c9-a8bf-ef56d7221f4d", "comment": "Malware payload", "value": "a868fefd7260ef5e61edc437d5675ba299ffc81f1646515594494739052c90b219d1fa7e32e2ebb351b244fbf9e527dd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662548, "uuid": "1eb77f75-5e49-4a54-8554-5302390668b0", "value": "0623D10DF006DD30D2649B38F96D01F1B37F0B88E74146E65855CA8B7AA54E9478F78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662548, "uuid": "583635b4-88fd-4fce-924d-137e73e5ab8e", "value": "768:h+lZdWtpelSIrz4RO1Q0qhQK5g3sZ5M0jJrSJCISJsJpl4d1K/D1mhI:hQdUwl3f8yQFhpg3sZ5M0jJroC7sJpqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662548, "uuid": "f32cc25e-5339-4ae1-b135-b3c847d36d8e", "value": 47659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662548, "uuid": "2ca0acd5-7515-403d-8190-e5f75fc6606b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662548, "uuid": "df6a741c-49f5-4610-828b-3a94bacf1621", "value": "fda16205_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd835684-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673579, "uuid": "4528f6c1-1921-4e7f-9b9a-b9f2b46416fd", "comment": "Malware payload (Dridex)", "value": "4c9a473a95b30fa79058ff662dac1e7d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673579, "uuid": "aa2ec112-0acb-4deb-92d6-371f1e375266", "comment": "Malware payload (Dridex)", "value": "ad3fab0899e8c2f54bca27a86deec1e996b59c88f65b8543aff80e450cbcf83f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673579, "uuid": "b59b54e6-82cb-4440-a9f3-b7a911f3d5ff", "comment": "Malware payload (Dridex)", "value": "225f59200b043180c06103a8272a4c00e88548ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673579, "uuid": "2330e404-2ff2-43b0-8ae1-277470ec1d5b", "comment": "Malware payload (Dridex)", "value": "d00c34ef320c6f5b76f228bb3a1db5152dc192f54aeff211eb5116536a76207ec0777adbff434696f20f965070bd7042", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673579, "uuid": "99a59f89-cb33-49ce-b346-1891fe9270fd", "value": "CBF3D0906A9BDF0ED9C13CF96AD6A879B073458C811FDAB4D0CE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673579, "uuid": "d0faa500-a374-4fe7-b859-0a43bb8e0a79", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673579, "uuid": "5dc93d1c-f531-4ed0-951c-f2ae537a21ad", "value": "3072:2esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLKK:Y4+VZQpt5hyPsa1ekiEtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673579, "uuid": "13e2d852-67a8-4f76-8608-8ac45fc3b3c4", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673579, "uuid": "c4f08dd8-84a9-42c8-9c72-6f869030cd4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673579, "uuid": "623c58a7-dca5-442f-8505-cdc7ae049062", "value": "4c9a473a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8181b13e-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673451, "uuid": "4ec4caf5-ace4-4846-907c-2947eab32017", "comment": "Malware payload (Dridex)", "value": "91357068695fff4b030544969cf62e10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673451, "uuid": "1fe6bbdd-de12-4844-89aa-8de90024276c", "comment": "Malware payload (Dridex)", "value": "ada67a011bc389e5211861512c3c65105129c1560519435c59a36948062c7c88", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673451, "uuid": "38971cfc-9e55-4a66-b929-a0aa8ae10119", "comment": "Malware payload (Dridex)", "value": "e4d4d6c17bb75ee762308826145bf553b140d995", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673451, "uuid": "0668b038-d0f0-41f4-9e0e-1ec167888e74", "comment": "Malware payload (Dridex)", "value": "573f31f55bc10f97177909dfabe02c250bf33a4c9debefe393986c1249dbdfb8675c5224c81cc711552296c1ddb2560b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673451, "uuid": "7d967a7f-b2c7-4fec-b5ec-5b55f72ef262", "value": "FDF3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673451, "uuid": "f73da9e2-7394-4857-ab6a-25382eee2d2f", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673451, "uuid": "c262448f-03b6-4217-9d05-142ed57912bc", "value": "3072:Desl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmI:34+VZQpt5hyPsa1ekiEtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673451, "uuid": "44633c36-0360-422b-b021-5487a5875d13", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673451, "uuid": "4163a3aa-2460-49a8-a448-813330f72e2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673451, "uuid": "6fa24c73-31de-4436-a7a2-28bb4cb8e361", "value": "91357068_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b232b4-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620676973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676973, "uuid": "a4fdfae0-4404-418b-a0f8-b815180e33cf", "comment": "Malware payload (Dridex)", "value": "780095ddccf1732028681c959b3ab2c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676973, "uuid": "e981fbe4-f6df-4d95-a76e-bdd95912cb97", "comment": "Malware payload (Dridex)", "value": "add3e8aeb48794e7cbfcd8c75dfc05fa4f599ae1fad2230a9f91b00e01507061", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676973, "uuid": "017689ab-725b-40a3-9106-207bdcac3a8a", "comment": "Malware payload (Dridex)", "value": "bc596622338f2914cc47ee2ae534c4f5c4c56b8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676973, "uuid": "b07a0f6a-1a79-4de0-ad61-b63ec6151104", "comment": "Malware payload (Dridex)", "value": "2c57907f13974b8f5c654f8b1efe585f5ab1b4ee18ec78eb0db1f4336f021189d3b3ca75c3ba6e7aee49c4ab4de0c8bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676973, "uuid": "5adf77b1-e10d-44b3-86ed-429eaee49ab3", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676973, "uuid": "568ef5c6-1836-411f-8ebe-c4820179985d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676973, "uuid": "61045f6e-6620-473c-91bc-e85f7ae056a5", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676973, "uuid": "c3a89b26-5c63-4ce6-8657-5b4d6c9d4d79", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676973, "uuid": "bfb31264-d23f-4ddf-b085-ff17b3c8c7c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676973, "uuid": "72849f00-4950-413b-a774-d2cdb6391190", "value": "780095dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846591e3-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673456, "uuid": "bd8b3b8e-6e33-47c3-9615-14ca91f720eb", "comment": "Malware payload (Dridex)", "value": "d2edd8c45b28cb31ed076ab484597727", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673456, "uuid": "972087bd-6eb0-4c9f-84d4-9ad3a440dbd8", "comment": "Malware payload (Dridex)", "value": "ade9b70069ce4f497654ccb63b93580c45d2fee8d805939cb289b7c837fee3b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673456, "uuid": "0bd64139-9d01-48d1-9c4f-589e64a18cd6", "comment": "Malware payload (Dridex)", "value": "5c15e7d520cc427646f77958b05693ae1414c897", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673456, "uuid": "016d77fa-f067-4949-8bae-7b84ef4edbff", "comment": "Malware payload (Dridex)", "value": "29231f3b8371d0c7c28db65f675006c1dc89b02a04200f52806a1eacd2e6937f82923761266012048181bffe69ef8dd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673456, "uuid": "3fb6dda4-4b33-4092-b61c-a3f753bd16e2", "value": "FBF3D0906A9BDF0ED9C13CF96A96A879B073458C811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673456, "uuid": "0eb8c7c8-9203-49d8-92db-fa988023dbc4", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673456, "uuid": "7a8e30e4-bd6d-41e5-abd3-e4ae0caaf326", "value": "3072:5esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLKK:l4+VZQpt5hyPsa1ekiEtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673456, "uuid": "84877468-2a6f-421b-a58e-a34a0eaf2ce7", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673456, "uuid": "8f74ba60-f278-46e7-be0e-9a8553992bc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673456, "uuid": "30d422b4-910d-48c7-9c5c-250d55bce625", "value": "d2edd8c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9b5207-b186-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620647643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647643, "uuid": "f9f757ce-a796-4eff-b9eb-0a71c8d1fd28", "comment": "Malware payload (AgentTesla)", "value": "f01a9fb42fbcb8dd47594d9ed587653c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647643, "uuid": "4d66cd42-c4dc-47b6-b0b6-c03e470c9bb0", "comment": "Malware payload (AgentTesla)", "value": "adf8ee9b13fdad76805ff5d94df7bab6cc4847aedb8da87fe57f70756daf9af3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647643, "uuid": "3758cc69-f229-4c59-a736-d6e8bbf7cc08", "comment": "Malware payload (AgentTesla)", "value": "6153ac800fb8ca36ce306c315c68c3c4314764bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620647643, "uuid": "11d934b7-a973-46c8-9b5a-d8dc2ffa007d", "comment": "Malware payload (AgentTesla)", "value": "5c6daa9e2a73befc657a9eaf68f2a4f168359d7537ebf2cb56d6f52a5e1713d5daf598c8bfd1e27a0836280dce39a20a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647643, "uuid": "37d26b6e-2bab-4c91-8416-4a67b5e1ed6f", "value": "3281F72587744D4FCE2BA4F6C035FC5711C6F52689CF1280B32CE6B00B2BBA45C2A05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647643, "uuid": "0c0c13e9-c265-4abb-89c3-2118bf3c58f4", "value": "48:/vMLw8GgtURyx9Xjc3/B6hEZWf/FXywv8siSoIhYPJXKF4axg5a4Y2wjkghhYEyg:/kw8G7ow3/B6wutXywpuLghRw3gHboZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620647643, "uuid": "fb0e921e-e061-4f8e-861a-92809bb3bbb6", "value": 3977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620647643, "uuid": "3555db8a-e292-483c-b2f2-6a849da41aca", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620647643, "uuid": "06580f65-3ebb-464c-b4f2-a5f65a87b3ad", "value": "ORDER 10.05.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3079b3d-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669750, "uuid": "b82cde02-61bf-4f1b-892b-3074d7e085b3", "comment": "Malware payload (Dridex)", "value": "8652d84ae3d36f8804f741a8fb216e88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669750, "uuid": "680bf11c-5400-4963-b946-fce6e6c61e39", "comment": "Malware payload (Dridex)", "value": "ae0d704631bde00d8a404a142eac77f724d5f824efae359bd97b3731c56b5ff2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669750, "uuid": "672154f9-5cbb-487b-8305-1d77660abd24", "comment": "Malware payload (Dridex)", "value": "bea74219b4471c965737232b061a495b29cada50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669750, "uuid": "04560556-0e67-4712-b508-5e8de28865ae", "comment": "Malware payload (Dridex)", "value": "61dba7fb2311c7144820bbf129ef7516edd75b82295235b67f747f8a2cfa857140a8ab131dda9a82540bf362859445df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669750, "uuid": "530ed25c-74c3-47c5-9b60-c8b74a928075", "value": "03F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669750, "uuid": "1a655bb0-8b31-47de-9c7a-1431504aa039", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669750, "uuid": "30ff9933-5d51-46ba-9f1f-ae7b4f23c60b", "value": "3072:C/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL/7:AbrE1kvcB74DXZ2Mela7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669750, "uuid": "74bf3a91-1068-43d4-a91d-b05ca347ad67", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669750, "uuid": "d11d1634-df18-4c36-ab46-1dd9b761eb40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669750, "uuid": "57025ed7-6714-4992-87ad-342975a6d1c6", "value": "8652d84a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012a8618-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669800, "uuid": "c27be3bb-8377-4ba0-aff3-cac4afd051ec", "comment": "Malware payload (Dridex)", "value": "22bb358bcbcca78438fdfc1e385fad04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669800, "uuid": "44b34820-0167-4797-9ca6-592afb7536b1", "comment": "Malware payload (Dridex)", "value": "aeacf4a82f78334ccbacf0d3a1e2cbeafe4b4996a8fd3ade4387ab76b096cbaf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669800, "uuid": "037d0a85-fa4c-4fc2-bc6a-c50a42e39e53", "comment": "Malware payload (Dridex)", "value": "79358fb1899f451cb8f362caf40044f1d5772aeb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669800, "uuid": "9827e038-452c-497a-8717-99d59a46c3a3", "comment": "Malware payload (Dridex)", "value": "ad8e1a189b235f071c80a314b063b6ae18813801908066b2acde5ef750cd104032ee4c50eda5823dcfcd2e30f4b4295b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669800, "uuid": "a6ca5861-67ff-48fd-a1a9-b6e9532a537c", "value": "E9F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669800, "uuid": "56fcdb6d-f9bf-490a-821e-b0ed8306024b", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669800, "uuid": "5d8dfdda-eb67-4ba2-b110-6dd0c872be15", "value": "3072:T/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:hbrE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669800, "uuid": "28566193-178a-4d3f-8b94-4b6fe15538c1", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669800, "uuid": "ed490631-5e73-493e-a96d-4e56f4962a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669800, "uuid": "372fac0b-0f40-4a9e-8796-8bdb38dd47b0", "value": "22bb358b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bdeb90-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673351, "uuid": "76b108b4-a615-41c4-a233-efdb4bedd8a6", "comment": "Malware payload (Dridex)", "value": "2961a1dcf334f07f749384264c9f2c9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673351, "uuid": "c9e516a9-77e7-4c95-8997-9f9e18328e5c", "comment": "Malware payload (Dridex)", "value": "aeb2e6d8c28f857bf808b688ac01908b26db60f759a64a6aa8fd35d8a0daeb22", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673351, "uuid": "69464890-6356-4c0a-a159-4d8808ab5d7b", "comment": "Malware payload (Dridex)", "value": "3cf34ad8d54d95b0b81387808286bb700a3d5799", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673351, "uuid": "e356452a-0f96-4b24-a5e6-eaf846056f6c", "comment": "Malware payload (Dridex)", "value": "0cc45dfbf267ccb62565ea746dfacbbdcf44067b0ad26c6d446b2d6d36c5e6118d444713c4aec875a56a3decd8088416", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673351, "uuid": "9f767a5b-0831-42e3-b8a3-7b23ed56d024", "value": "19F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673351, "uuid": "997dea4c-a4c9-42f0-82cd-15dbdc68c8fc", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673351, "uuid": "1d3391bc-d692-457f-b2b4-eb8b18904254", "value": "3072:Iesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:C4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673351, "uuid": "23ac58c7-5fc4-486c-a20e-1f49d05f5911", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673351, "uuid": "b006777a-30e3-40ad-a1ff-a02ca45b40ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673351, "uuid": "575ced01-707b-4623-8f68-e8d5e28306e9", "value": "2961a1dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f9e85a-b1b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620668872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668872, "uuid": "494f979b-e47a-45f4-83ee-435410571e8c", "comment": "Malware payload (AgentTesla)", "value": "151cab7fdf132b81e8a06efbc9dcec0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668872, "uuid": "e1ef7c4e-40f1-4500-a285-b9fac0ef5664", "comment": "Malware payload (AgentTesla)", "value": "aedc0dc0a6e305ab1cbfc39d97221b4dbdfa5407cb8f5b1a87f93903db03c8dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668872, "uuid": "4fa4841c-df9e-4b68-92d9-e0e21ed04633", "comment": "Malware payload (AgentTesla)", "value": "28554694ad2742cac5a5b445be6513352057dd66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620668872, "uuid": "5c0a50a8-63aa-453a-bfa2-5de66ac6805f", "comment": "Malware payload (AgentTesla)", "value": "dc81f6802c049c6a20ce20ecd3f3459a455673540d819f223f1c43a09e93e1198fed01c6cba3730e81de50bf698a0dc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668872, "uuid": "5d4d36c7-1f11-4b1e-bb13-26b414407737", "value": "B2E46BFC755464F0E35B5C23A3CF0C0782651274A93B6A0E9B6013BE5A67E273E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668872, "uuid": "b874cf70-5ebc-46d4-9528-99ed122fe64c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668872, "uuid": "13a653c9-788e-41b1-b426-6a1371701087", "value": "12288:H4yoLLoS60/K7yh0vz9c3hHyentRJ2LJJtCUd36Ta:XoLAu3r7J2F7PqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620668872, "uuid": "7c169284-15bc-4827-b68c-378487e9f44e", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620668872, "uuid": "9b315b16-d84d-413f-b137-41fa79d371a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620668872, "uuid": "e4a5ee98-8e10-4f72-8d9d-e6fd483843ca", "value": "NEW PI#001890576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe490a91-b1d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680533, "uuid": "b441b587-5890-483b-b44b-ee04647f4f6f", "comment": "Malware payload (Dridex)", "value": "1557f9c8a55218fca3e803dc5ad45bbf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680533, "uuid": "06b0cc45-ac50-463f-bcab-8df5bd39c3b6", "comment": "Malware payload (Dridex)", "value": "aef1fcc9ea8ba188f0836a23c57eddeb8d7b3cd566aa5d57a6847846ab7bd781", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680533, "uuid": "f92c00ea-5df2-4c6a-91f3-bba7c0ffeae6", "comment": "Malware payload (Dridex)", "value": "e6bbd90bcfff57182bc178739db25af4a392bb41", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680533, "uuid": "aad3d24e-3aa8-4362-b29b-8d3267be05ca", "comment": "Malware payload (Dridex)", "value": "2bccdb80253f977ea3502dee402af67de7e6cd98812000b8800cf66e5cbd17c67aa8757148c0fa934689066daa84c061", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680533, "uuid": "f298dbba-87e6-4087-987b-6729579a3ae4", "value": "55F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680533, "uuid": "8a677dfe-b614-4872-ae1c-07ae4a4eb537", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680533, "uuid": "393e04ae-076c-47b5-bc2c-3bd8f2338cea", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620680533, "uuid": "f86479ce-7deb-4b42-8e51-180b8cbd6a83", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620680533, "uuid": "49b2adc1-b770-4a4e-8ac0-efe21f2c1cdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620680533, "uuid": "2969e596-e93a-436f-8592-079036de524f", "value": "1557f9c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b823aa-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620666241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666241, "uuid": "276bf9d9-23d8-4fd6-9d0f-dfba08113a73", "comment": "Malware payload", "value": "551f47ac50b90566906330060d2d0d55", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666241, "uuid": "497f2228-4f67-4e28-8c8d-f6a09b40d3b0", "comment": "Malware payload", "value": "af00e06755294d2f89ed0a2d30c45d169d1f54ae7a35a80e9fe6c8710b18a990", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666241, "uuid": "bc9bd150-0982-484c-81ca-892b6e9c1b37", "comment": "Malware payload", "value": "720e305d65fff4a6227ba433a8cece690208b19d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666241, "uuid": "5bb6e135-5a6f-4463-b52c-902808c6ce4f", "comment": "Malware payload", "value": "7293d0ebba4b426ff4232491366322818589396c79bbd15ffd06454c1bcc9cec1fb5b6ba7aee977e1f3232cb782761b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666241, "uuid": "dd853c00-c9e7-463e-bfdd-ceca22df6e05", "value": "0206337CA97BD815ECB425F941AB951304D3B20ECEE67C309A33029E9C04EDD16D6BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666241, "uuid": "379ccaa4-df13-48fd-808f-553848ec5888", "value": "98304:sfSTrNl8kefaRW3BNhRcD3wGeTU5/oyVilacXM:FNl8kdRyBY2yw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666241, "uuid": "bb023fd5-00d0-41cc-b786-18ac5115b57c", "value": 3808802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666241, "uuid": "e2ed7f92-092c-49f4-9581-444985fc0829", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666241, "uuid": "d5f5a26f-1b8c-4fe7-9b35-708a3ebae9eb", "value": "551f47ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4306db7-b158-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620628117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628117, "uuid": "7293b85a-7a21-4030-945b-cefe3f535c81", "comment": "Malware payload", "value": "8c19326e60d3571bf41e108ca2adcbf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628117, "uuid": "f70e56dc-fe2b-435d-88ef-fd8da7f64d13", "comment": "Malware payload", "value": "af9d88aa0208ea04534e50f18c2d506ad021912a783be78ffbe691e8b252ba6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628117, "uuid": "e343a6eb-bf78-496e-aefa-6b9ef41cc44e", "comment": "Malware payload", "value": "62e0f9c963b1a258b3ca2655335695523047bc33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628117, "uuid": "4e4c198c-482c-4e3d-b20b-f10422488761", "comment": "Malware payload", "value": "4f064b67eb2fdbf304721a2b27645b3b0ff83f153208989645e219105a57f315b849856bb157681160f8a46ad75923a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628117, "uuid": "58f9c09a-d48b-4e7e-a364-78fe9634b85c", "value": "ED9422A732B4C0A7CFF08AF019341AAF6FEB9914091A474F6B9083D87915FE8994F1D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628117, "uuid": "b5291a12-e5d4-43b3-b348-15e011a3f382", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628117, "uuid": "30d62458-2fdc-42d4-b54d-d0e9c9924551", "value": "6144:lPXZa7ibTDHMtaBXC812mhHgGlunc+TpuHUvZe5Tir3f2L1qI5VpDuVcRWuttw1D:TLBXC8T1gS8cou0ehJd5nD8Ytw1uJ3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628117, "uuid": "81922b4d-86f5-4c1a-b865-519108517fc0", "value": 409947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628117, "uuid": "d9006376-fce7-40cb-be7e-34055838ee68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628117, "uuid": "df38f4f4-478a-44c9-a326-19b9c9e11de9", "value": "TNT AWB DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6269aacc-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651924, "uuid": "ab6f3711-e834-4e54-ac1a-b1a2302681d0", "comment": "Malware payload (Dridex)", "value": "0c82500d0ec5bedd93c2880b4046bcf2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651924, "uuid": "088f20a1-19be-43e2-b7e4-b3995e320421", "comment": "Malware payload (Dridex)", "value": "afb575e1e5bd2401030e972ecffeb8b01beab047d14e91e558f809bb602404e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651924, "uuid": "6ee90a00-e400-4227-87a0-7eeece2e95a6", "comment": "Malware payload (Dridex)", "value": "47e5e72cd45417c52a3f6ce6fc6158e73b89fbe7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651924, "uuid": "4758b6b7-9144-41c5-a3cd-7ee16b1b1f06", "comment": "Malware payload (Dridex)", "value": "af105d1bd6d2ed5345c2ffa4027d3412fab49e10e2dde158e0ce8edd287bb40587aadd4209848eae2cb48c5e8ca95128", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651924, "uuid": "8c961b8e-5bd4-497a-bb57-9f06e054216e", "value": "8CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651924, "uuid": "46df9186-44eb-4208-b2c7-b9047be37828", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651924, "uuid": "97bb6c6a-f7b7-4326-98c8-5b75f359e432", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651924, "uuid": "9b7b6386-ea17-4f44-b2cf-c45f56c98754", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651924, "uuid": "e04e6fdb-9ce1-48e7-a5a4-97d75e2c9318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651924, "uuid": "c6f297c5-298e-4acb-bd2e-12a996bdaaa3", "value": "0c82500d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a252c6e8-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666205, "uuid": "3cea9ec1-7142-415c-9d6f-da97c5aeb504", "comment": "Malware payload (Dridex)", "value": "75a2cc3363c745c33382c44bb9c2bc13", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666205, "uuid": "31805446-24aa-4dce-847d-6c92579d749d", "comment": "Malware payload (Dridex)", "value": "afd06071fc352dea0ef4c9588ba6db098ddd5b87ccabc1e7857df9ef374558ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666205, "uuid": "41fba371-bebc-4d81-a42c-db3bdd2d2c20", "comment": "Malware payload (Dridex)", "value": "c90475d48ac571228c530f1a9a2fdd8b962c38cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666205, "uuid": "2f675734-7620-4f5f-9796-fb7c35402620", "comment": "Malware payload (Dridex)", "value": "1f381dbced99d49bcf87ced19e113ab068a535833d4a4e42b42d4e9d831ed695c73bb7deb53474a7962a0c02c41ddbd5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666205, "uuid": "60be8c7e-1ef0-47f2-9e3c-3e875cbfdc8a", "value": "A2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666205, "uuid": "cb4c6ef2-3858-4f44-9b84-1f7e4e21a804", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666205, "uuid": "fc8e8e7c-a3c6-4007-bfeb-0a219488aea7", "value": "3072:HiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ceAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666205, "uuid": "f9c0c54f-3c7d-43e6-99c3-b4a41577c4e6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666205, "uuid": "a142615d-4785-4f46-b885-17f427d82011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666205, "uuid": "aea90033-15c8-4b19-8faf-7d17c1dc62b2", "value": "75a2cc33_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d554dd55-b133-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620612174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612174, "uuid": "6c63d4fb-67da-489b-b6d3-41103d9ac557", "comment": "Malware payload (Dridex)", "value": "1df75a0494e5b5023530e8ca1a4709e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612174, "uuid": "31cf7edc-383c-4798-bbb7-a5b30c0273e3", "comment": "Malware payload (Dridex)", "value": "b05c7c71a4b35ebdbbe5a5629b3bb1c605f346e622ea4fdac04ba4ea2e952c4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612174, "uuid": "2c3a71bd-d158-4a8b-b03f-71d5bc47d948", "comment": "Malware payload (Dridex)", "value": "bdfe006a5b31bd2c7b67ec44c0d2c2dceb837e09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620612174, "uuid": "0d28c25f-c642-40ba-9b00-8053ae506b80", "comment": "Malware payload (Dridex)", "value": "3e5fce3f564882e299605e420955dcf235188b9a8e6843f7348b87bb2e836699b6f034418b6a1202f640abab6c51c35a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612174, "uuid": "a26301b8-d618-4126-8851-3b5b75d10820", "value": "4EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612174, "uuid": "42207014-6966-4321-9581-2d353e103dbd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612174, "uuid": "bdd969ec-f5cb-47d8-a37d-f60ba7def79f", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620612174, "uuid": "4b77a48c-8493-460d-9a86-5b3402b4b7a1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620612174, "uuid": "5a3544df-7863-4130-8303-571036743636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620612174, "uuid": "b76c97b5-1037-471c-975d-4afc3b2f912f", "value": "1df75a04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73b5892-b1b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620667126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667126, "uuid": "1185d6fc-0e23-41c3-a3cf-5ce4c3bee1b8", "comment": "Malware payload (Dridex)", "value": "856ffbfe5018e77d15fa067420910bf3", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667126, "uuid": "b2ed117f-8d60-4bf0-8ec2-ab647493b7ca", "comment": "Malware payload (Dridex)", "value": "b06d587c7f838d81494383503b357cdbffa3304f29a4a1ae0af56a1555df7ead", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667126, "uuid": "24cac6ab-751e-463b-b286-13653ff14c41", "comment": "Malware payload (Dridex)", "value": "540744290b04a9d1c1b9ef35585169358464a98a", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620667126, "uuid": "8a081a88-c10e-4834-970b-acc926b0900b", "comment": "Malware payload (Dridex)", "value": "f74080405ba36ee6a74a72738dda64d8f35e36155dd188ea6e56380beb205d1cea86a4ea1d8792d8b67f9825dde822db", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667126, "uuid": "e0b879f7-71dc-40f5-9b4c-67d9d697ff49", "value": "580523DF889A924EDA9B24361B485F8A764354A491F3EBECF227F3FDF1E09015C52049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667126, "uuid": "1eb55420-bda9-4c0d-a81d-412c8df22caa", "value": "24576:jzSoaaGjHMHzMRdmMl801YLK6oWrs9C447VpB3rT43KKYrx3u:/SoaaXQRdbl11IZNT5x/3fXx3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620667126, "uuid": "7a45e374-c83b-4826-8dc0-791749b8bd88", "value": 816836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620667126, "uuid": "ef7bf63e-adb7-4d1f-b6a5-49ac0f79a929", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620667126, "uuid": "8bff5b31-652e-46ba-a519-ef9864575fb3", "value": "generated invoice 465856.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143f70f2-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651793, "uuid": "6b8ddeca-b3e6-4e25-98e8-4b0219072333", "comment": "Malware payload (Dridex)", "value": "130b576e0ead3fa68bc3cdd5162b5fb4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651793, "uuid": "5883da87-3ef1-4dec-aecb-d3ebe9d29aec", "comment": "Malware payload (Dridex)", "value": "b0c7c26af459143233060ecb8e663dd945c59e271becc34b81606d8e3cb6e663", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651793, "uuid": "69ff9763-f40b-48ce-ad78-3f08de5482f0", "comment": "Malware payload (Dridex)", "value": "8a8de51fd6761e4c0439c8e82cf45f814fb9e683", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651793, "uuid": "f5c6e6c7-dfa9-4f8e-b8da-1b9f5276823a", "comment": "Malware payload (Dridex)", "value": "831c2f0953db461bd2ceb942b013b98b54d99823e1273e6e2a4e4a221077492fc8d10fed7fffef4bb7b9737eb093fcc6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651793, "uuid": "c49ae564-0a88-489d-89bc-e8453d8b6a04", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651793, "uuid": "2feefb27-96fc-41af-8d24-7c9bc190ed7e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651793, "uuid": "5f8f863b-d3fa-46c0-a1ba-19449ce3639c", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651793, "uuid": "8839c3c1-2e5c-43e9-822e-1fb4a3bc7ab5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651793, "uuid": "9b4497a7-35ea-44f2-b692-fb518dda2161", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651793, "uuid": "a92e3c01-9fbc-45b1-aae8-ea34fd19dfe8", "value": "130b576e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9eb6073-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620669654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669654, "uuid": "dffb4ad7-edfa-4e40-99ab-ece9c594ace5", "comment": "Malware payload (IcedID)", "value": "d2ea09be7ccaebce75a29ad3c310912e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669654, "uuid": "f454d4f2-06b1-47ef-83e3-1c6a776b6267", "comment": "Malware payload (IcedID)", "value": "b0cd30604c6ef97118e9a8929f4edf2381e5fc25b4e4db1da734767465e2de9d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669654, "uuid": "96f1da65-328b-484e-b994-1d4f5ade9135", "comment": "Malware payload (IcedID)", "value": "eef57c1a0cf8614061115389f6a539f2c113122b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669654, "uuid": "68087964-468d-4033-84d4-9569e4ad3cd3", "comment": "Malware payload (IcedID)", "value": "0d8836a54015d894507d429824f0d70ae042d3edeaf07123c64bae05e20a8622c879dc406797333107162cbd9ffeb254", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669654, "uuid": "c38241fb-0dd4-49a4-bd03-0386c6813d8f", "value": "C633CF2EAF544E9FFD5240F8A95ED2519C713B53081C656F75FAC3A10D84D333E02AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669654, "uuid": "7a5de3ed-d238-42ba-ac2b-741969a3c39b", "value": "582b57469e873707c1b54ed8fbd62b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669654, "uuid": "23d9669e-0afa-41b6-a0fc-ca4961aacae8", "value": "768:g84GpouvUHA3fMIoex24FbQMaatpayk6fSGdMQH/0dCoujPds655neW26/:g84Gpt/vPxtpFkErdME2C9SC5neo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669654, "uuid": "aa673060-7152-46a3-a126-6cf8ef2bc88d", "value": 52824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669654, "uuid": "90ffba52-1b24-40cc-94e8-90caf4a135d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669654, "uuid": "5a54d2e9-2b54-42be-8419-56d58302e9d4", "value": "d2ea09be7ccaebce75a29ad3c310912e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d8e320-b189-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620649115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649115, "uuid": "4eb5a67c-5967-40da-9da5-6b2b31b95729", "comment": "Malware payload (AZORult)", "value": "c452b3b6eb8f0bb0ca0be29370811c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649115, "uuid": "4d3a1e59-8705-403e-aae5-bd18c121c78c", "comment": "Malware payload (AZORult)", "value": "b11a974fee906fcfbfadce6a615552bb396a0ab0fa891f87f78476f5e63da275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649115, "uuid": "a9ed38fc-f2eb-456d-8878-f4c14eadeb2e", "comment": "Malware payload (AZORult)", "value": "aea155ebb9d87bbc9dcecf2d4fc3e9e84aeb8d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649115, "uuid": "b9270977-ca46-47b0-bbaa-364ace794d76", "comment": "Malware payload (AZORult)", "value": "06f681c781a7058fdfb3659a967ace02dea261bbaba2d0d5c7fec1230cdc32f38b045b0604f317ba7e099fc903a45dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649115, "uuid": "5b9fb7fc-4e3b-41bc-b52f-ff903ac7d4c0", "value": "6AD512717AE4AA18E5BF4B378DB08480D3BBFE17C722C16DAAC6318E1C72B555621713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649115, "uuid": "63009a47-7335-4c57-91f0-8bb18f4530af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649115, "uuid": "9ed8300e-99ec-4748-b76b-040db4c414fb", "value": "49152:Yj2HaOy9fvBviRLSCYb7SLScrhetKwctPVGWI0Dul/YAb53DjXx:Y6ap3BaRW1GScrTwcyWIKm/Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649115, "uuid": "5d0c594d-d92c-4881-8a77-9792139e7f11", "value": 2847744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649115, "uuid": "3b2844f0-acea-432b-a479-b169e1c1e7d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649115, "uuid": "12a388e8-7b2f-4388-a891-8b8d74b9c1d3", "value": "Quotation Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7585fac3-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662694, "uuid": "b991ee37-8680-4273-b0b7-aa28b78fea0c", "comment": "Malware payload (Dridex)", "value": "91417edab758f59d5cbc65d3c0b562db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662694, "uuid": "2771bf84-29ab-4625-a515-e4020beff6d5", "comment": "Malware payload (Dridex)", "value": "b1a528c837c1775d96b4959d54841f75da36428a3ffe830fd14384530805fdbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662694, "uuid": "0221e67e-6f6c-43b8-9f11-0400398b2953", "comment": "Malware payload (Dridex)", "value": "21bfc63b5ec878e8b7f1cfcb8b483aed39557020", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662694, "uuid": "4a8b61f3-8c4c-44d3-acbf-7fe56b530d0c", "comment": "Malware payload (Dridex)", "value": "a859fb4a6fd51a3b9a3c8f74e8d23cd32a381add4941bf2188677ebfaf5076e35a9f436dd5f66585d6f7339544c7622f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662694, "uuid": "73e3aee2-94a0-432a-9472-fa703a41adae", "value": "D3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662694, "uuid": "38ec9ef9-58d5-4444-95fe-a929eba4249b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662694, "uuid": "1a7f4345-dd4a-408b-a9dc-171518f5e887", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662694, "uuid": "9f4d9db0-8b22-4819-9391-9151cc33b031", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662694, "uuid": "d06f5b95-0fe3-4728-956f-6436b6ab8106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662694, "uuid": "5f3aa80f-49c6-487f-81c2-ede1325b3663", "value": "91417eda_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a017f3e4-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687676, "uuid": "3c77a721-3ed7-4056-99eb-8fc21f66f90d", "comment": "Malware payload (Dridex)", "value": "28bb714ae415e9889b0e91d9f4c31d5f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687676, "uuid": "38460c8e-4cff-460a-86e2-953a70075923", "comment": "Malware payload (Dridex)", "value": "b1c8388df3a3af8ebac4e5e13903da6bd07fd4cb766045bf3bcc381d48ad5ea1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687676, "uuid": "e0d2d9f8-55cc-492b-ba46-c6087a37898a", "comment": "Malware payload (Dridex)", "value": "a5ef45c1a9f82669d8374bfb318dbc778fa1e26d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687676, "uuid": "d6b64f5f-1219-413a-bd54-6b2e820625ce", "comment": "Malware payload (Dridex)", "value": "27fd5b5eab3a913c37a562f69d52a4bf272534f108595e0fde8fd9c3260a16b0d0daab50d2161c80170f81f451c6d3e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687676, "uuid": "fef44f45-a16e-4a7e-b474-b26847e35a81", "value": "1DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687676, "uuid": "fa18f305-94f8-4399-8a6e-a2ada282cf32", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687676, "uuid": "97465c22-e84a-4e85-b15d-ef5dbabdc4b1", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687676, "uuid": "486bb02c-2742-42d3-8b5f-df16e3edd62b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687676, "uuid": "6d9b7cc2-961c-44a1-95cf-1cc7b9bef34c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687676, "uuid": "27dc20ac-b054-43db-82fa-b25687ea9bb8", "value": "28bb714a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dfe812-b1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669853, "uuid": "7a150772-29fa-48d5-9158-1317c1e6a2b2", "comment": "Malware payload (Dridex)", "value": "60bc11c92941684a8100335f3140fb8f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669853, "uuid": "9de1fc83-b92d-47b3-bdb6-8a62855d4d2b", "comment": "Malware payload (Dridex)", "value": "b1fd3bbb82f99f9361c5006f774f2b2b2b800f5024ce892a397121a58460c876", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669853, "uuid": "05f30cb3-a78d-4317-a501-17c0402df4bb", "comment": "Malware payload (Dridex)", "value": "b5d7b2a189600cd276b49ecdbf20d8da0dcd9d9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669853, "uuid": "5cd767c0-92c4-49c4-9e78-0c5fca9ce8da", "comment": "Malware payload (Dridex)", "value": "a0ddcf914ab2e803b2e663465b69469ea925d900fab910d1c613b52eeaad26132b2f6b1935ceaff2ac7f59b182488fb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669853, "uuid": "99621c32-9604-4a74-b9aa-3d2d9cb88002", "value": "80F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669853, "uuid": "8338c05d-56fe-41df-a7a0-3d065becf9c1", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669853, "uuid": "abc5708a-7a59-44b0-89dc-24386e24c47f", "value": "3072:m/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaL63:cbrE1kvcB74DXZ2Melv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669853, "uuid": "7bfc9c0b-9b79-431c-b57d-c2623f223974", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669853, "uuid": "57cf5ae0-6490-44c2-bc5b-497e31100fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669853, "uuid": "a36c31f7-62a2-4adf-a6e6-2476ce3de0b5", "value": "60bc11c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad8ca00-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687641, "uuid": "db243440-f2f9-4c44-ab0c-766ed0b9cdb2", "comment": "Malware payload (Dridex)", "value": "8b9dcee28e10ca7afc481c18354b7d31", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687641, "uuid": "8f9ca116-37f9-47cf-a95d-1ed1ab0b8d27", "comment": "Malware payload (Dridex)", "value": "b20ea7a058f06aa77096798dd8d23ec31fe6ffca617015a198b27c3f48101ee1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687641, "uuid": "7ed87b32-58b8-479c-9966-ddf668c9eb97", "comment": "Malware payload (Dridex)", "value": "d03f2bcd3dc7faff21ce4a3ecc5edfad74cc1870", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687641, "uuid": "4ec6fa92-1c40-4b0c-a441-8101820e4195", "comment": "Malware payload (Dridex)", "value": "6eecf3ee59bfbdb13d8ff23c03b5a5f8afff68e135f0c18762dfe2843b6b9e719b663c58b7aab7f49e2a03032648c78d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687641, "uuid": "941b1fd2-3db0-4c08-b7dc-e5bee2dd0f34", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687641, "uuid": "1dcab32f-d55c-47e4-9d0b-a997c324a913", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687641, "uuid": "b0324cfa-e1c9-46e2-b51d-6bf25519a654", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687641, "uuid": "c09e4392-dfeb-4084-af78-f96d20c3f7ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687641, "uuid": "b5600be9-22a8-4e0e-9191-813bccc6d67e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687641, "uuid": "b273598f-d7cb-4ca9-8e40-efadf370976f", "value": "8b9dcee2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4156e275-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673344, "uuid": "066afd22-a916-4978-b025-e32472e75e68", "comment": "Malware payload (Dridex)", "value": "2df2b57c420be6b5b5fd47c9f8b0b31e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673344, "uuid": "c2a376ea-738c-42c3-ad4e-d3a784648732", "comment": "Malware payload (Dridex)", "value": "b215de3ed0d79bdac36631e8ec2bd3b74d1624acc4728c470fc260b1b6b2fe2b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673344, "uuid": "9a1e423a-8e8d-4540-aeb6-f0eb2153bc69", "comment": "Malware payload (Dridex)", "value": "900faecbd7f653bf33a8760efbbbc624cacb9c3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673344, "uuid": "2cee4d6e-9143-4db9-a79e-284bfa27ae15", "comment": "Malware payload (Dridex)", "value": "bc516ce93958dfa06ef83e65f51ef7a5128fe401139e59304277665bfbe08d4f3ff45c9abea9cb7fb4eee7fc51581c74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673344, "uuid": "643db906-a57f-46c5-a928-557fdefebba1", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673344, "uuid": "3ef589d9-0fad-4106-95f0-40f9630f3914", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673344, "uuid": "64433f7b-1811-445d-bc2d-f70f5c20e712", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673344, "uuid": "19412055-5638-4450-90b7-b15fd8572158", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673344, "uuid": "4a9998f1-47bb-4f24-9a68-d01322e494e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673344, "uuid": "0523240f-fac2-4611-afba-d22ecca648a9", "value": "2df2b57c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7def4d-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620676884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676884, "uuid": "6670391b-46c1-4c95-a779-ec5032455eb9", "comment": "Malware payload", "value": "4b092c1ec9cf0831c6f4853d01248598", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676884, "uuid": "a77da16a-77f1-41b3-92b7-10808a69aeaf", "comment": "Malware payload", "value": "b296aaa167b19184295abc6bb32378cee4cba81a8c089ea46d6bc8eed7502e4c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676884, "uuid": "49dfa879-8fc2-4934-98fe-2387965c4600", "comment": "Malware payload", "value": "97b1d7d1ac998cc7833bab2532d9542568d57842", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620676884, "uuid": "95ac9490-d519-4adb-bec1-0f6141ad9346", "comment": "Malware payload", "value": "840d353ea43527ec773a59212bf34ab2d8c308163a573e4ff1edb1f68e3c5ba8fae1c0a303a717e3e48c90a33cb55198", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676884, "uuid": "282e0df9-cdbb-4375-a996-b2ab627f9e73", "value": "84226B6DC914E069C213047FE0B806B8FB0C1192E553E5AD2582F1DE5B913EB8B9F4F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676884, "uuid": "a9c8a652-827c-4ddf-964c-f7d12a8b25c9", "value": "192:ScIMmtPWcqTL/G/bPRvhjMOSgpR7cCQJVadLKvKkLt:SPX+rTLaBhjIYtQaYvxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620676884, "uuid": "cbcdcfd3-ce92-47e6-b1e0-e290c87af7d9", "value": 10326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620676884, "uuid": "28919045-db0c-463c-8614-5bfeba6b2f51", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620676884, "uuid": "d1d3d272-35c9-47e6-aa5b-77292265f6e3", "value": "4b092c1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f62778b-b15b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620629076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629076, "uuid": "1d217514-d8ae-45d3-8809-35c39db9e0fe", "comment": "Malware payload (AgentTesla)", "value": "8c1b61293640f17d6489326211831caa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629076, "uuid": "fe9d081f-da8d-4a20-bb09-6fc43ce4b60a", "comment": "Malware payload (AgentTesla)", "value": "b2d263b6849356375e66551abbf32c31859fa91fb6b3d8c7de7ddfb7cc27ae66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629076, "uuid": "fb0a41cc-7b95-43fa-bf1d-3434f270425e", "comment": "Malware payload (AgentTesla)", "value": "d82f6cabf8adf4ee1280f83f405304946c77c5dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629076, "uuid": "e31ac05b-65c0-4350-86c0-c5f7b3c08638", "comment": "Malware payload (AgentTesla)", "value": "b61166b88a874d120939809f2072639879896c0357805a3985852960d7ea905edf28388625eab4acbd8b454a2c375b45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629076, "uuid": "e765f31a-b5c0-4a90-981d-061cf2b76ce6", "value": "CE056CAC715459F1D36B1E7663CF1C0243652174783BEA0A8FA013FA5A67F172E3898E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629076, "uuid": "ddfa7bd3-6e33-4418-9e0a-a582e8f739f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629076, "uuid": "fa5811b3-ee33-4603-9e23-8a09bb9021d3", "value": "12288:GhC7OrukooLLoS60/K7yh0PTHq+ZEfs6VpM/gdkokUY8ZIqnN:uC7OrukooLAPDliBFdPj/ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629076, "uuid": "355263e9-c900-405a-8a07-7f52513a0733", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629076, "uuid": "587e4a50-3f28-4af8-b774-9869e9cea6f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629076, "uuid": "46e55f40-1bd0-4b8c-a8b8-978312e3ad50", "value": "Sofidel 4402560171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e444499-b162-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620632161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632161, "uuid": "b9e93dca-02bf-438e-8c59-8973db8fe39c", "comment": "Malware payload", "value": "b62f53839c95c52d1271211e97dee0b6", "object_relation": "md5", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632161, "uuid": "3970d64c-ea22-4c0b-9bfb-62b10fa8a464", "comment": "Malware payload", "value": "b2e822ea0272723c3b4d4e177486823dc1ac0799082e8460e7fb35cde9443167", "object_relation": "sha256", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632161, "uuid": "420794cf-4f75-4cb3-9242-5daeab404d7e", "comment": "Malware payload", "value": "4260efcc3db3b5ffc3725404f60180784437a6f5", "object_relation": "sha1", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632161, "uuid": "daaaa5dc-1190-4853-b8a0-a682f613f06a", "comment": "Malware payload", "value": "94fae10762da1aaa7e143f0c5b04cc68b8e1c7d41b98157e4e9723ca8e0098234da7f4bca98885a5419240ba1d231fc8", "object_relation": "sha3-384", "Tag": [ { "name": "TA551 Shathak", "colour": "#A465AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632161, "uuid": "4470db51-4aa7-4ff8-ad7f-2eecccee2c05", "value": "05733720AB6A9BD4DCCA79370359CAB1D3324FC0570373E7BE6C764D2B68941892616F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632161, "uuid": "2efc6673-2169-4a4c-9b51-6d3dfc5a1149", "value": "768:ZfE4uF+TmXm7k751bTD2LdNnh2OiImFqGYjloqiE2DpKrflUPYPbskMHsa7mQy:H0+4R1bTDkNnhipFnY5IE2vYjsRMa7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632161, "uuid": "e91515bd-8103-4436-b0ed-943ed96d3d07", "value": 77969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632161, "uuid": "bb75bdfd-00c6-4540-95e2-784cf8b426a0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632161, "uuid": "3de99070-6405-4bb3-8702-c33fc29a8868", "value": "deed contract-05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02d740c-b176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620640861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640861, "uuid": "f2d6cf50-f7e2-49a5-8f10-81fb8fbcd164", "comment": "Malware payload (Dridex)", "value": "16452aa64c2a050ec1859e138ff2a767", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640861, "uuid": "506f7e13-e170-47d8-895e-948664ee6a73", "comment": "Malware payload (Dridex)", "value": "b2ffca3afefc60134e9db4393f5ea79eac9308304af3a59410b4902bbae937ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640861, "uuid": "99aaab42-9838-41b0-ab14-78ade2c043ab", "comment": "Malware payload (Dridex)", "value": "b7e1d65bb82317044fd345ec41cc5dadf6e3f0cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620640861, "uuid": "08add841-b564-47df-a071-4161ab8d7c4a", "comment": "Malware payload (Dridex)", "value": "62a3f3bb11c93e0b0ba806d3429652ff9f3e03c9dc9a09ad7abb34b69d19e7e52f3d996195940cae3fc5016a3f21e2c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640861, "uuid": "1c2706f6-9cb5-4f67-9635-d53c993317e0", "value": "DBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640861, "uuid": "7cf110ac-6048-44ca-a61b-eea357d1b408", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640861, "uuid": "dffdf9e6-3586-43ee-8af6-0f0a0b8512d6", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620640861, "uuid": "94f9b647-bba2-4962-b3b1-144e4af34bed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620640861, "uuid": "60c612e9-7a8a-4478-883c-42aa03f7151a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620640861, "uuid": "b6d26196-bb29-42bd-83bf-fd1065f45fec", "value": "16452aa6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce0aa98-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684047, "uuid": "be51b176-e13f-4d0d-b601-b499e5868116", "comment": "Malware payload (Dridex)", "value": "9d9140834091b731408c6cf90400ad43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684047, "uuid": "b35db50b-647a-481d-9fca-06f2cb694b95", "comment": "Malware payload (Dridex)", "value": "b31a1d2c725a0b97b283a1f49704d2a642d6ff7de1b919dd187bd4c859d01024", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684047, "uuid": "33703dc1-4751-41a3-aa95-2562b47c0957", "comment": "Malware payload (Dridex)", "value": "2dd6a1dff667d37ab987b26a56fb8ac16b72bb5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684047, "uuid": "5dbd831b-8a41-4aeb-ba91-22b8027a5e7d", "comment": "Malware payload (Dridex)", "value": "5f088c340ec3ab6265ccf59ecaffd46997029552d205d451bed967ab59a5926a247a3efaa9024ca2985ebb044c6ce03d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684047, "uuid": "d570181f-e213-4dcd-bbeb-528cd7469f40", "value": "B7F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684047, "uuid": "b8a9f049-408a-4e6c-801a-aa767932313a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684047, "uuid": "831fa1b4-16ce-4050-8919-5432d4ad33d8", "value": "3072:MA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:M3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684047, "uuid": "46fe5975-c691-484c-b8db-84f53678b29d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684047, "uuid": "4c4d3c3d-eda8-4ff2-a4c1-813617c9c867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684047, "uuid": "55a36d9f-0ece-4976-90e0-6313457d953a", "value": "9d914083_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d843a3a-b18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620649876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649876, "uuid": "2ca03805-5a47-4cc0-bf53-785af12217b4", "comment": "Malware payload (AgentTesla)", "value": "7586f087a331b05d95638c0e84f9e2ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649876, "uuid": "9168afdb-675e-430d-9a90-bd4da7ae3097", "comment": "Malware payload (AgentTesla)", "value": "b36448538d1e8029314a7998ce8eca1ca7af53b9ad36fd162783830e7b0e3071", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649876, "uuid": "2d273301-389a-4b32-9745-a4bbc0cedefe", "comment": "Malware payload (AgentTesla)", "value": "40ed629cc93d97a09f62f62334d29b1be81b2e71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620649876, "uuid": "d92cf563-b648-4b29-8329-8cecd20326da", "comment": "Malware payload (AgentTesla)", "value": "1bd9d3344c85e89ad1fa2bcc39c3e0108c74ddf7a55bf4c2b7faa7103520e970c06ee661bf360187c89cdbcd1267493c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649876, "uuid": "949f7c2f-aeb0-40fc-923f-bfc403fd4949", "value": "D805D06C3AA4D946D7BD42BC84B1927447F83E6A6D03E71D0AE430EC3E7B721DD1261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649876, "uuid": "e1b54836-e0e9-4fc5-9e78-70ddecb1f731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649876, "uuid": "8783b3d0-3760-4670-8bae-ab713b8dfc87", "value": "12288:1+aUQUZh2sjP7Do2PSmZF8APs+stTWG7LK0j9cqGMjvLe:QTh3jPX3SmZdPr+WGCEcqNvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620649876, "uuid": "78cd6b17-5d0a-4317-b4cc-825b20559326", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620649876, "uuid": "7443ffdd-5845-46e4-b9ce-95b1203f5010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620649876, "uuid": "883ba32a-d611-4422-92b8-e5de382d2cbe", "value": "PDF.9066721066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a2acf4-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673507, "uuid": "451713fb-8733-4e64-be9a-77e348a1f285", "comment": "Malware payload (Dridex)", "value": "00c2ecccddf2c0221adacbfe801da45b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673507, "uuid": "bc5b2dfc-21f3-4986-897e-4373cbd29800", "comment": "Malware payload (Dridex)", "value": "b37ca5302f42044022ae3ced7496f7651f640efde38bd4dcb535b69c0b75862b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673507, "uuid": "04edb378-a2ed-4876-9cb5-64e2ee7f7d00", "comment": "Malware payload (Dridex)", "value": "68d02c1f720f06047ebac3f03a6d9e9abe35dfdb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673507, "uuid": "f22e0597-b2d7-49eb-82f9-889b3bcf658c", "comment": "Malware payload (Dridex)", "value": "f02b6df63d50b0874a5e6af1934b6ecbfc2278e612c554970fb13ca0a3e217eebc1aef30172234064b55b3833b3d1cc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673507, "uuid": "3a502d07-e5a9-45e3-a7fa-60ef437c50da", "value": "61F3D0906A9BDF0ED9C13CF96A92A879B173458C811FDAB4D0DE84CEA4B75B30227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673507, "uuid": "82adabb2-e819-4b44-91a2-4bdc41e1df82", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673507, "uuid": "2455f31b-7a98-4e5e-8a9b-79f92d3f4126", "value": "3072:aesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLk/:s4+VZQpt5hyPsa1ekiEP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673507, "uuid": "386164f4-3495-489a-9822-e95ad09851ce", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673507, "uuid": "aeab7250-e21a-45ce-bfa2-96bf264c0ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673507, "uuid": "ecc16eaf-fc14-4ac9-8ff6-25c35a2e754f", "value": "00c2eccc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70115b92-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662685, "uuid": "4fd9aa6a-deff-4877-9e7a-33104658db43", "comment": "Malware payload (Dridex)", "value": "0ad75bc42db1c7e4615e746b2d831367", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662685, "uuid": "fe4538e0-65c6-4706-8399-2380d9a593ad", "comment": "Malware payload (Dridex)", "value": "b392b756494ca913c5c18282932e677be4f5ea7678a21fa79c9e6d6cc5c2b618", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662685, "uuid": "bbe7799b-a84d-494e-b71f-0e6e1083384b", "comment": "Malware payload (Dridex)", "value": "782ea20e36673c4619546e1e3c2bbda3a7ee85c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662685, "uuid": "c4a2fb9c-86ad-49f7-b499-69cd98882bee", "comment": "Malware payload (Dridex)", "value": "b9580588663754130b7ede40ec850d6ad5e224e116f2da1bca3d7c08160110c188e37093b773f434bba1d59b27e92aee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662685, "uuid": "5369fd59-69d6-4b32-986e-2856d46d2270", "value": "A6F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662685, "uuid": "b3f7ba83-43a1-42d7-b856-a4bb52044d82", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662685, "uuid": "7b8f8372-d6ee-4820-9306-94aefe68cdb3", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662685, "uuid": "ab8d7fc8-3a6c-40a2-9e7d-e4d14b0503a8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662685, "uuid": "f67a26db-af4d-44d0-ac4f-16d9302731b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662685, "uuid": "687e6b73-7d33-47cf-ba45-86906c42fd3a", "value": "0ad75bc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d810545-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630898, "uuid": "a3804f07-c90a-4f68-918e-fa5c51314a6f", "comment": "Malware payload (AgentTesla)", "value": "a859a847c5e9d21bb3bf64d9d6cbbc66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630898, "uuid": "228fef69-b1d7-4ad2-93d4-5575c905997a", "comment": "Malware payload (AgentTesla)", "value": "b3ea561ba0d0e0f7f907364651bb7f91a13a66258315018d0c0726f92aa0cdad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630898, "uuid": "329b8f25-0432-4c8b-98a2-903f1adc52fe", "comment": "Malware payload (AgentTesla)", "value": "b1d2eb74f7c10e83cd0f6ed0d90c75ae7a71cece", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630898, "uuid": "514a18fd-c2ba-4a55-85da-7d7cfb7382b0", "comment": "Malware payload (AgentTesla)", "value": "15e911a8e8a7e81cbfd8fb94bbd4c16a11c89decccf260012ac357d38aabe36350f5f745ff24de58bf67dbe6e3c9bf4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630898, "uuid": "70288b7c-e210-45ec-822b-4127c03f2ae9", "value": "0A056BAC725459F1D36B1E7663CF5C0243652174A43BE90E8FA013FE5A63F172A3898E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630898, "uuid": "d05befff-0bc2-4f74-a54a-1903bc9d46dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630898, "uuid": "ba70e401-d2d7-450a-8242-4ab1c6031be0", "value": "12288:yAKckooLLoS60/K7yh008a15ad2m9gzp7QiqWzUf+DsAGSj00rSn0GOl:bKckooLA08a15G9gzeiqRzAdIESpOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630898, "uuid": "dc553680-6e53-453f-a7cf-ca9239508c04", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630898, "uuid": "1b90275d-9f4c-4e5a-bc2a-5cce1457334b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630898, "uuid": "7bcb1285-7614-48e3-aefa-4ee8b2c400a8", "value": "Invoice 2105011348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cba10a-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669786, "uuid": "05921761-95ab-49cb-9644-d4168f00b895", "comment": "Malware payload (Dridex)", "value": "263a35c323b7d046eaac10d0110db055", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669786, "uuid": "0c6a0c19-7cf3-4640-a4d9-04a26d9c80f6", "comment": "Malware payload (Dridex)", "value": "b40046faece31729a7e7358fd57edeb979941a9e464e121bfde0abe89f9217a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669786, "uuid": "397b1989-4688-4ec7-a513-5c647261be97", "comment": "Malware payload (Dridex)", "value": "8a305696fbd0e9c952e058da08624ee957ea7b17", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669786, "uuid": "17e44684-98fd-43a5-bd41-5e4ea91bd1fc", "comment": "Malware payload (Dridex)", "value": "bbfe530f8db64a6af33095811e0c432d0c2b078ca7ac7f13690533522beff82ec9d2369ea0eb243ae4d4b0ee4bb773d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669786, "uuid": "165031c6-61e9-4e4b-9a1b-a2df6f1e707d", "value": "25F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669786, "uuid": "5f5bfbb3-1011-49cc-9977-a68161c7e417", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669786, "uuid": "fda6f1bb-d5ab-4df5-8dab-f6602a81e7ce", "value": "3072:Gesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:I4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669786, "uuid": "b81fa6ea-69f8-499d-a8a3-55bda3009e9f", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669786, "uuid": "44b6a77c-da5d-49b7-a156-1c787b1d9af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669786, "uuid": "45fab348-50bd-4c3d-b073-c5f0f65dbb71", "value": "263a35c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639112a5-b1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620662664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662664, "uuid": "90b2a7d1-a8f2-4a09-89e3-31c86507fb8c", "comment": "Malware payload (Dridex)", "value": "d5ead94b7ca9d829c28d2c0777976f20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662664, "uuid": "2c588237-4e29-4448-a882-d8b08ae83c36", "comment": "Malware payload (Dridex)", "value": "b429236541de8c6a4f336514b7e5750214897600a34a9e66a5ed27cd899a00cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662664, "uuid": "4607579e-6f35-4ae3-823b-db147eda6323", "comment": "Malware payload (Dridex)", "value": "4c6665af6335de24ef8e6d8a02930931e047a3db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662664, "uuid": "fde9e7fc-d0a7-47eb-9093-6a79f884e6c1", "comment": "Malware payload (Dridex)", "value": "5392d5c56eb534acbd76ed325005cd2097fcd57043bb1b652634a08a6f71ff109eae42c2629ad5bae081eca144f55980", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662664, "uuid": "9cb8f132-07e3-49e7-a3ce-430299318329", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662664, "uuid": "7e851d09-f3c0-4377-99d3-b617fb001923", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662664, "uuid": "a55d1f0b-3f03-47ff-ac53-835aa74dbed0", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662664, "uuid": "bb9cf633-23ee-4aa7-95f4-eee7cd041c6a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662664, "uuid": "b37d8938-660a-4868-ae76-716afa569023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662664, "uuid": "87c28bf5-36e5-422a-bf6c-558cf765fbf7", "value": "d5ead94b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef8e432-b162-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620632403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632403, "uuid": "894d8dc6-9b52-4c7f-8e3c-c6d489163b53", "comment": "Malware payload (SnakeKeylogger)", "value": "be6065d9c2d6748f72f639369fca3127", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632403, "uuid": "09da43dd-7a5d-49ee-b2e3-803d4f948e05", "comment": "Malware payload (SnakeKeylogger)", "value": "b4969f8727f5981f9d1224925ce57e7b389df72f06ccc08fdb1fc35ea996fea5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632403, "uuid": "0c97d422-3392-4a75-99e8-f2d1a74c58ba", "comment": "Malware payload (SnakeKeylogger)", "value": "2d3192f19057ee65a8fd8e9599edb687ca839827", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620632403, "uuid": "1eac69c2-9ac8-4f38-8034-f1a6f7252017", "comment": "Malware payload (SnakeKeylogger)", "value": "28ab6388ca8065c51e7fed4a7ab4cff568133c54d4fb9146233d2cd0ad84b581fc58d847cc077d70ef498eb4a0c35719", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632403, "uuid": "59056c52-c004-48b5-b300-2795bcfc4aff", "value": "8105D060329C9BC6E47E5B322475902023F1780FD762E54E7DE676DE65F2B80412EB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632403, "uuid": "ce37bb12-9c32-46c4-acf2-ed25da60abbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632403, "uuid": "a1d694d4-2c8f-4981-8cf5-9a2234ccaf3f", "value": "12288:P7P90ZaHwJrfPeQ+it85+/jC1MhxACJiSMtRMZlyAKp:zPWZagfPVD/jCWhzQ/RSlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620632403, "uuid": "6c839ea5-199c-4818-9912-f63e61cdc8cd", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620632403, "uuid": "04ff9e57-c87b-425b-8edc-4e077b1ed938", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620632403, "uuid": "f96b2e86-fc9a-4843-98e0-0052c1b6bee6", "value": "New Order_WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38734893-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651854, "uuid": "01b8c8a4-b9e1-4fea-b648-10d6b90b6dd0", "comment": "Malware payload (Dridex)", "value": "4edf533dc86d12aeac36909d50b85300", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651854, "uuid": "3c713d4f-8d77-4b84-8782-00816d051b46", "comment": "Malware payload (Dridex)", "value": "b57c09eb43617c230081a94935b88d43821642edc0b67455a13cd81666e13796", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651854, "uuid": "b6525051-95a2-4abb-8e3b-b82589a78b23", "comment": "Malware payload (Dridex)", "value": "edf7a5d9e8add7b5da5b12c2e093fdfba036283f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651854, "uuid": "39fc3afb-3395-4112-b75c-2f8412d256c8", "comment": "Malware payload (Dridex)", "value": "fda3b0f7bf59e6c112c82b5f21952504904aa69a61ec09109fa0223ea6f09bf6502a04505e31f41b0b2642f4931daec8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651854, "uuid": "6427d79d-16ab-4287-8fe7-2255e87e92e8", "value": "45F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651854, "uuid": "54ef2e9b-39d0-4633-82f0-0ba6db6025e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651854, "uuid": "eb14e55d-4aa9-4450-a376-be6fe3b98a0e", "value": "3072:BIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651854, "uuid": "1b4681f4-a257-47cb-ba44-b87a64a57cf2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651854, "uuid": "f1479236-ec17-46cb-bfb2-ebb711a307b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651854, "uuid": "7b028b00-59bb-4c11-a128-2e445fab3c7d", "value": "4edf533d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c564d7f4-b1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620677001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677001, "uuid": "cac97ccd-4115-4b8f-8bc4-670b6dd4eeb4", "comment": "Malware payload (Dridex)", "value": "7902a5cf71f63d6b5c42d6aefaf9fba9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677001, "uuid": "c75c856e-6a84-4273-b0d3-30a09d98171a", "comment": "Malware payload (Dridex)", "value": "b591875a0a7581eb9897e81a0d49b7a4cc9404b9c3b26f7d26273cde87e82e3a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677001, "uuid": "f474e453-4c40-4484-a2ac-2b9e63a00c7d", "comment": "Malware payload (Dridex)", "value": "a143fe381caa1195cadefa6f5e1b61bc6d870a2e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620677001, "uuid": "f6c31eb6-1893-42c9-a716-9ebd7c51d36a", "comment": "Malware payload (Dridex)", "value": "ff102e18a279929db9b9cb4f63a30aca7a364d77e8ed441f04a0d8ce083263e66da95e51b159b89fe242b063adb6da11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677001, "uuid": "18d170a3-178e-43ab-9c41-c9e156d9607a", "value": "B4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677001, "uuid": "ad87d152-2663-4453-82a9-96d47f872c95", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677001, "uuid": "d91a32bc-eaf9-4480-b35a-fb0eaf41bcf7", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620677001, "uuid": "5cc26b1e-cad8-4523-a056-fc5de4d70c0e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620677001, "uuid": "ee02e36f-2d8a-4916-a980-1f67375bd3d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620677001, "uuid": "b825b5b5-e449-4f2d-86dd-b3521d638b19", "value": "7902a5cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb881bc3-b152-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620625526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625526, "uuid": "7fe4bb0f-6960-4394-aee7-92b4862e7464", "comment": "Malware payload (Loki)", "value": "e49e50cd59695ff18f63efb252a35b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625526, "uuid": "d19016c5-4846-4b6e-ba5c-9913d8c036af", "comment": "Malware payload (Loki)", "value": "b5c99c0df0b6c4cd43071e30be30139ef8474c85c8a6a874b2ae68f761faba1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625526, "uuid": "dcf8b426-ee14-4997-8bd0-385a7cf0aa01", "comment": "Malware payload (Loki)", "value": "91019efad11a5c1cc658bc3c7ab4c8db9d4581db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625526, "uuid": "72bf2a13-34ea-4e55-ab57-f2764ae878e0", "comment": "Malware payload (Loki)", "value": "e822443e58c97e5c82e6d3de60c4b212d2c37fdb7322d56ac7e0d561aeebb8f30c85eb51b0548c306a71f36c0e111688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625526, "uuid": "dbfe7cda-559f-47d1-8299-8005357a8bc3", "value": "38E4BE213398AF55E87EA7391531051013F2BE07CB31DA4D7DE6A5DE4AB2F408A27B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625526, "uuid": "507cd2e2-f2d5-4d4c-9b77-071951fafe84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625526, "uuid": "435a3312-1c7d-45e7-8f0d-f00ec4336087", "value": "6144:V71TET7US8WHmvAScMz9IaJVe9+YG3vjjuVFzqsmUF05ZAIRdHHjOfLrJAYo8tRe:PTg79MhPJVeMW89AQdqfTfEO/pJvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625526, "uuid": "872d30a3-c74d-48d9-b46c-326f987c6d63", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625526, "uuid": "6fb77610-b0d5-40e9-9bf5-d15e2e52f341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625526, "uuid": "80813353-2e86-4cae-a511-8cf6aadd20f2", "value": "Spare Parts (KITO)\u00a0\u00a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43016ac6-b159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620628249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628249, "uuid": "19b1e0a5-e400-421b-976d-f28d16798d4d", "comment": "Malware payload (AgentTesla)", "value": "bef0d1e9c66a0ae35a1e0ca747bdad15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628249, "uuid": "6720b852-8a3a-4deb-95e4-70c446465217", "comment": "Malware payload (AgentTesla)", "value": "b5ca98aaf7acc12175fda388247d7898d815a8091ede0f30dfe952d26b1739c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628249, "uuid": "db2d9b6b-5cc6-40d2-8372-64dfebd2d51c", "comment": "Malware payload (AgentTesla)", "value": "36480210715a4c038d21b071b7f89508fef80c20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620628249, "uuid": "27cc2691-f92b-472e-a51f-c420c4e47eb2", "comment": "Malware payload (AgentTesla)", "value": "8768659cc408a914192fe37ccaf353e478cceb80c66c1573553123239f4c6cd3ba209ce5d0cb377f154c55a1baa91e3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628249, "uuid": "3eabb7d1-a772-40c5-a141-73670973af53", "value": "B053E05EE160BC75C0F3BCBC8344D0DE514DAD48A04E7F1B7288ED8D5989295A2EE3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628249, "uuid": "533c65c6-8a73-45e9-ba35-8fe1fdcadeac", "value": "1536:wFuXOQOTO19mChPUH6I/YrShnDkY2lc1cl+GkC4:wwJWH2lcM+GA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620628249, "uuid": "77daebc7-799e-45e8-8d80-e0e5b9428f09", "value": 61988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620628249, "uuid": "7422db71-45d3-40f2-80e2-6c3bb5268bdd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620628249, "uuid": "45f66738-0fe9-4a14-a2b9-da778c4537a2", "value": "PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340ca050-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620684059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684059, "uuid": "b2f1c797-b4a6-4d46-b87b-6b3c779268b5", "comment": "Malware payload", "value": "4dfbfd6d3b7b0bb021bbd17d83dfb1ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684059, "uuid": "d1f38250-7c9d-4533-a691-f77190be98f3", "comment": "Malware payload", "value": "b63c82be13671fa228be47ed8704747dbfb193c7ca4ab6f187cf945ee81054c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684059, "uuid": "bcfa7a26-3185-4603-8a99-810288a3c0e6", "comment": "Malware payload", "value": "b427b588bc50df6eea167631ecc21abe9bda8f0b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684059, "uuid": "0d5f47bb-393d-4ea0-96de-90d5f8b0c021", "comment": "Malware payload", "value": "deb1817f423b0732dc5a842438bc2830a60ad94234c461c5ef9a663ba7fe5d4f42283bfb3e9a67563b23cf234184e1cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684059, "uuid": "5057feb2-43f6-486c-8f5b-4b628c1d82be", "value": "38F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684059, "uuid": "f4d8907d-786f-4cd8-98a0-1e8fbbc23415", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684059, "uuid": "bf324bfb-330a-4a97-ac59-69811c1ac7f4", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684059, "uuid": "48f138fd-824f-495d-9994-1531bef0dece", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684059, "uuid": "677fba3a-9c7f-4a3f-b18b-7c1a04e7070e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684059, "uuid": "38314d60-948b-405f-a5f4-ce493bdceda3", "value": "4dfbfd6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c44a02-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684062, "uuid": "f5409b2d-3cc2-4475-80d3-47dea6c859f4", "comment": "Malware payload (Dridex)", "value": "e769dc7baa660a01143c0b53a2c69665", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684062, "uuid": "88c41cd2-3b3a-4b7e-b521-e508cd3aa9b2", "comment": "Malware payload (Dridex)", "value": "b664ab55bf3a9be20621c9fa193da7a8b364e7dd885335d07504a7fc53962acc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684062, "uuid": "330387ed-5c02-426f-b83d-406a6405114f", "comment": "Malware payload (Dridex)", "value": "b419af206b1abd476cb1f2ffc895e149fd60bf59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684062, "uuid": "11b97891-26d0-4aef-acd8-62c756790d5c", "comment": "Malware payload (Dridex)", "value": "a0a20ba3f0cdfa4f01ea838486f2f290fe592ce1080e1c945fb17e139f819d97d4f38e4eca91ce0e2eb57cd2972fc182", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684062, "uuid": "c7bf84bf-27d4-4abc-85c3-05cfe6c9f78b", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684062, "uuid": "bc8942ef-ace3-43bc-8d92-542ce84d29cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684062, "uuid": "bc65ff30-4cb7-4cd5-b067-6f30c27b3386", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684062, "uuid": "09f7937b-ef34-41ec-b7f3-09991b95aa94", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684062, "uuid": "9e758cc9-4798-4184-9784-aefb477c3b71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684062, "uuid": "47a427f5-30ad-404f-aeb0-17c117f868c1", "value": "e769dc7b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a30b6f-b15c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620629641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629641, "uuid": "355275ce-237c-4a91-bbf0-040e86535401", "comment": "Malware payload (Formbook)", "value": "d557c38c880b3c4e2ba7bd8a17674e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629641, "uuid": "0dcd1995-f969-43f9-87ce-46a5d609e03e", "comment": "Malware payload (Formbook)", "value": "b66fc87dff2d8feb58c2d19e67ca54a0dc0139d0fc9de0ff4bd3e0c2b1fac519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629641, "uuid": "bf2947e1-5d09-413c-9c01-1cccc722b7c3", "comment": "Malware payload (Formbook)", "value": "cae80d12d5deff61dae302e3d83cae8f0472211f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620629641, "uuid": "7204a386-daff-40f4-9929-394c87f274be", "comment": "Malware payload (Formbook)", "value": "bcf288140f2f0172d97cc6255a428be89a705e2665a3e8d604e7ec24dd43fd85b1e25d422170ee151b901980b9fb6642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629641, "uuid": "df2bce64-119a-49b9-90b3-6baa2af710ba", "value": "BAF4E03027CC6A3EC3AF4175C015C58056F5EB066313CA5EAFD57A5D1A2630AF633B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629641, "uuid": "e473659a-35c2-4cd0-b1a9-45bf7644136a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629641, "uuid": "5db80e39-a1b6-4847-a3bc-b5f5395b80d5", "value": "12288:trpBVw1hhhiW7V/lWVrbbA2NOnVxU07L+WjrVCCFOi+hj48va4HQfyYxuB2UWYgz:xGhhhmbApnTU0+WjrVCgO/hj4W642UWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620629641, "uuid": "7d2373d0-e447-4d85-a794-02b63a69abd8", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620629641, "uuid": "759fa4bc-d8de-4eba-8171-a86060111022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620629641, "uuid": "b9b61770-9020-4603-a856-3633fd0e96c6", "value": "(G0170-PF3F-21-0510).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09390c06-b16f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620637601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637601, "uuid": "e51a3ef8-db41-444c-914e-efa6adcde7e4", "comment": "Malware payload (Formbook)", "value": "eaf353f50d090caa75e67f05393c8717", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637601, "uuid": "708e668f-6f8e-45f0-b911-44a9a6975b62", "comment": "Malware payload (Formbook)", "value": "b6a6ff003727e8fe59a6d10a4ea5fa4b066e15cd0ecba552c4d7d3d08da0d986", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637601, "uuid": "435681a4-51e9-40ab-8880-f2487544d8fe", "comment": "Malware payload (Formbook)", "value": "9dcea91cea5313f75f69ad255fd919497d418904", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637601, "uuid": "ea1e8ed9-3d2b-4cb4-a8af-d5087f6ab7f1", "comment": "Malware payload (Formbook)", "value": "19fa25a03256ef615623e0386fc2684255cd1a85244db36b063137f89be39ab6cfa5c66852ad1db38d2eb5644c704b13", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637601, "uuid": "87ba756c-5910-4849-91ca-c413066b7c37", "value": "2F6499ACC09746A88F85ABB82B1F2F85114C7A6EF784A5337234977527E2C7B501787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637601, "uuid": "da526156-bb3a-457a-9dee-c5759428bc05", "value": "6144:T8ZRaUZOi6r0XnmoMpljUv2r76AEnSP0kNESswqozLF029FdJLSoU3jtWA6i6Pbr:CgbBZf1viRmr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637601, "uuid": "a73536ff-021e-45c8-9863-31b7d5602342", "value": 326922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637601, "uuid": "b0b3c538-ee57-4bf7-93d4-eadd4fd01bf5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637601, "uuid": "3ffc1415-2c0e-4f30-815d-7b3127b6bc0e", "value": "Payment Swift.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8605babe-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673459, "uuid": "833d1944-2517-4e28-9295-208e21d5a92f", "comment": "Malware payload (Dridex)", "value": "7b4a631b81c5e204d9228868aaca9385", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673459, "uuid": "43372a81-c6fb-4b90-93a9-dca32bbeeeb5", "comment": "Malware payload (Dridex)", "value": "b6ad45ffa3788dbb011f9222ef49f73e2165f805662fa781ad60cf275368ca12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673459, "uuid": "82b1e47f-c42c-458b-87a2-61473827b5a9", "comment": "Malware payload (Dridex)", "value": "2b372e6bf0feb2eaa2982662aaef0fff915286a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673459, "uuid": "de487a19-cb2d-4c01-81d4-5d3f62747691", "comment": "Malware payload (Dridex)", "value": "6d4bc38981b15f9ae31a3a608b26487ea8eafd83c792f1cfe6b593df9cd65b12cb805fc4a0e41c1225cec02567f007bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673459, "uuid": "f8e68b8c-b064-42c9-af3c-22c0e67d5030", "value": "2FF3D0906A97DF0ED9C13CFD6A96A879B163468D811FDAB8D0CE84CEA4775B30327113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673459, "uuid": "8c4cb249-fc55-45f1-8685-f8d9e7a2d0fb", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673459, "uuid": "2442fb1e-7b91-4f0c-b204-3baf4bb5bf6b", "value": "3072:8esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLmm:m4+VZQpt5hyPsa1ekiEtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673459, "uuid": "4b5a8466-df53-4a81-96c1-f6ce344f0614", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673459, "uuid": "cb7e488c-de15-4e3a-9695-99afafc5c0d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673459, "uuid": "d767e725-19aa-43b4-b4c1-58743c87578d", "value": "7b4a631b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f66925-b169-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620635021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635021, "uuid": "a50396cc-f503-49f1-a374-04ffcbd442c8", "comment": "Malware payload (AgentTesla)", "value": "09e1b7df891556ca6f1b56b5b8a9be00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635021, "uuid": "7c81e89e-8f5c-4841-9708-25fcc68684ad", "comment": "Malware payload (AgentTesla)", "value": "b6ba4103948b273cf686f35f58c8af4569c82ffcc9fbe21f30abb700ab692ca3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635021, "uuid": "a425d54c-709d-46ed-bd8f-768fd288c48a", "comment": "Malware payload (AgentTesla)", "value": "2b10dd6bc033c9a249d3143aad2f268c56693e82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620635021, "uuid": "f765144a-bba5-4733-ae34-0510d50d2e87", "comment": "Malware payload (AgentTesla)", "value": "d8c5e3fe26ed1c3089b8b8d487fc964d4bf4f478274d625ae076d4a348c983e7ca622f989da975efc67a9ee74ad67b7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635021, "uuid": "36d78c95-fb56-42a6-909a-6cec4b5e87d7", "value": "7B262E34C3700B5CB7E98964952DA56DAD63FCAF16379DC74250660B0F3AE068F42B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635021, "uuid": "914a2fdb-cd59-4663-be22-b6ddc4aaf38a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635021, "uuid": "68ae050e-90b0-47d2-a245-fa5e445878d4", "value": "1536:LoBa5OFr0sh01CdwhBRxcxfUeIo7q/snDB+w+ll4JgeOLlDf406ua58QCyssb+WZ:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620635021, "uuid": "72c6cf88-9261-4c90-94e1-1bde0f7c2785", "value": 4618752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620635021, "uuid": "068d24c2-ac71-4871-a8b1-4e12965a800e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620635021, "uuid": "d223f4c6-1408-435d-b8d1-cb45365c989a", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8da07e2-b1b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666726, "uuid": "a2ba844c-1d94-4075-8528-5a2e37e14d09", "comment": "Malware payload (Dridex)", "value": "056d978074261851acacbe2b47ed063b", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666726, "uuid": "57058258-18ea-4c92-95fd-643578a4c05f", "comment": "Malware payload (Dridex)", "value": "b6c7efb7aa8b7200e43cfd66d2d8c02a572daefbe6d3924604ba8873a5295576", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666726, "uuid": "4f17f5d0-ee82-49d0-a4cc-c26a37be664e", "comment": "Malware payload (Dridex)", "value": "99ec69644025d9a306d58562e7b8084f29ffc862", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666726, "uuid": "54eb768a-2166-474a-9fce-69c6f5efa23b", "comment": "Malware payload (Dridex)", "value": "3767626fe6d573527c5264b7b3612a10c208d55fffe0238716c10af085ed33830d6d30863b29788c123acd00bddf4c68", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666726, "uuid": "b1e709e7-7d50-4b3e-a8ed-43aa2f78ecfb", "value": "AE063387D4F8BE2DD1BA15F46AF4EEFF2C2255F0BBB5E8A121C640E69C15D22D180E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666726, "uuid": "7d959c4a-b0f6-4c9b-a959-452eb90cef9a", "value": "98304:XoC4TbootgHldaAxYoJt/Geh2bqbzp4o6W5DGoNknJN8:XL4Qoa9xYoJlQqvOo6W5D5Nkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666726, "uuid": "232ea341-9ff0-408f-9700-b9a87054dea5", "value": 3881937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666726, "uuid": "4f731eda-a1fa-44d0-9bf9-0eed804a9172", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666726, "uuid": "41de6039-9211-43d6-9a3f-38ef1ae1beb3", "value": "fax 4044.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130d8e1f-b191-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620652221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652221, "uuid": "00f401b6-97cb-406f-9e05-4831b217624e", "comment": "Malware payload (RedLineStealer)", "value": "5589339dc823124f97e3a64806df9aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652221, "uuid": "fce64b33-2796-4fe5-b4fe-47dd12187f60", "comment": "Malware payload (RedLineStealer)", "value": "b6e1829df84ee9fcfc296dc516e2eb88170bc1bab71ba9097c88db7e54f23672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652221, "uuid": "40efe678-1628-40ac-809b-4e7df3b75095", "comment": "Malware payload (RedLineStealer)", "value": "748f30731b18e6d6226f4e1ec41644d72d52c490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620652221, "uuid": "bccd91a9-a19d-4237-8330-2f1c996db2b5", "comment": "Malware payload (RedLineStealer)", "value": "ae9c64f7fb8b096ca706068127b380750747fa6719b1d49e44068b1ce0a7c7c83bfa161b5075fa406e71503c2b0dc238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652221, "uuid": "ffcf8cfe-4a91-4a33-8f70-2208a364aca1", "value": "A4554A7C3BC99D11C5AC6A7B85C2900493F6ACA16643F797EDD831F98C62FE11907A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652221, "uuid": "59ec94bc-009a-4e08-b713-6e5acfc8872c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652221, "uuid": "95706e85-8734-4dd6-9a28-8d186980b357", "value": "3072:mvaFV38WYlKlm/72u+8JVG1i6zADwJCXro:e2VL2iu+WVGI6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620652221, "uuid": "9caecff7-da7e-44a0-ac78-77088f7f4c64", "value": 1333160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620652221, "uuid": "4f62a43e-5a76-4092-8f65-823a4db7cae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620652221, "uuid": "b99378aa-5a94-4cb4-9bd1-ac8a7704420c", "value": "5589339DC823124F97E3A64806DF9AAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94722c12-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687657, "uuid": "be44edfc-9be8-4e9a-b5fd-2ce15bf5aca2", "comment": "Malware payload (Dridex)", "value": "ff30923099f527d9c1e1b4bd284f6eee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687657, "uuid": "45eda631-401b-4b6e-a734-9d4f348cb6b4", "comment": "Malware payload (Dridex)", "value": "b6e5c0a57f953594a5ea68ddc2757999bc3de0f16e4b24ff09440c1c77f91adb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687657, "uuid": "ded4a717-6deb-4300-9a05-73746fd2bf0f", "comment": "Malware payload (Dridex)", "value": "309ff8bc0b9dc3d55c0a5526ec0b8ad6be841009", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687657, "uuid": "0dd6aa45-0036-4e1d-8f39-0e63e69576b2", "comment": "Malware payload (Dridex)", "value": "4c7dc1e23932b1b79dad18972630c212c82c96b680f31fe3c3701aa5b6b88180a6525f15550c1a09ce3a6b9313cf3a62", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687657, "uuid": "12f9d40c-0b13-42af-80cd-bf4b77e43bf0", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687657, "uuid": "540a4f07-71fb-4a08-a73c-62222e723ec3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687657, "uuid": "c5bcc496-71d6-4f07-b7db-c88cf6325cc3", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687657, "uuid": "583408e4-fc2b-4827-b3d4-88ff5869e776", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687657, "uuid": "11745610-1cc1-49f9-bace-5803340c3d25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687657, "uuid": "bded729c-72cd-4876-9066-72fa8e948d20", "value": "ff309230_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f92284-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630915, "uuid": "b17cf940-4d27-4bd8-8e92-050b5293b1bc", "comment": "Malware payload (AgentTesla)", "value": "9176f64f67ef84349387b35797664600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630915, "uuid": "f6d1f633-b204-4b7b-b7bf-ad44a8521b83", "comment": "Malware payload (AgentTesla)", "value": "b749cd6d8d74e65f5ff17f2d11b1c99d4e5540e161b572bfe58d7078943fb6d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630915, "uuid": "97273e94-3140-4637-aeda-df31d2d076b1", "comment": "Malware payload (AgentTesla)", "value": "48e0046fec89d77f86b239ae4dec3182f3f061b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630915, "uuid": "f7bfc0cf-2c50-47f0-8b8a-1287969cb860", "comment": "Malware payload (AgentTesla)", "value": "fc4d75469a2c4a6e7a3c9037fee2e5259e834a7cb8b21430204c7baaf613f70559b6005868f5fc5cf5a522c30a5bbb56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630915, "uuid": "af5334f2-ffb7-434c-a05d-3a311f09b8bb", "value": "F0258DA8715055F1D36F1E7267CF5D1242612D38A876D60E8BA033FA1A73F133A3998E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630915, "uuid": "2e2d86e3-6e73-4238-b01f-7f7d423b1cc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630915, "uuid": "ec470d60-ef7e-4f3e-88b9-b9ee7362c96d", "value": "24576:qbHZdOiSooLA8XeeEcM9Nl2VYJUEKlCW:qMeeCNSYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630915, "uuid": "0cab51a7-e903-455d-b6a6-f7fa69737d71", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630915, "uuid": "41aeb462-a01d-4818-adef-49be4e329777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630915, "uuid": "a804ac15-7e73-4471-99f4-17bef81af514", "value": "SOA PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726ab7d0-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637348, "uuid": "6c24af34-0926-4ed3-9e94-b4b33d3baf1b", "comment": "Malware payload (Dridex)", "value": "c5bb91f537412f8c25465d2293cf98c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637348, "uuid": "f8f22a10-071a-4d51-afa3-d92206bbae17", "comment": "Malware payload (Dridex)", "value": "b7ab2c7f8dab91bf41167b2336e3467403ff06757914aafbfc93d71f4cdc826f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637348, "uuid": "33e4b9de-4000-4935-884e-a35e6f9ad94a", "comment": "Malware payload (Dridex)", "value": "7cedcf32dffa64e76037099c7f997f401100e62c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637348, "uuid": "f4949861-c003-44b0-b3a5-bf434132d480", "comment": "Malware payload (Dridex)", "value": "73778ee565670338cf683ece3f01226aa0f4abce3529571d7a486ec7fd436fb47a0ea1ea175891c8066c1cf29bdb5346", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637348, "uuid": "998d2177-d358-403b-a8ae-f82692858b20", "value": "1BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637348, "uuid": "9d7ab9ed-481f-4f12-bd2e-c7080b7c1d6a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637348, "uuid": "7b172355-5e5b-4316-9384-f46864c68a53", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637348, "uuid": "fd09ccba-9570-479d-a11b-52b06e234dc6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637348, "uuid": "144080ae-2f28-4a39-af17-006344f5d0cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637348, "uuid": "dcd9c08d-7e15-469c-8144-07bdbef84d27", "value": "c5bb91f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e06d3f-b15f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630880, "uuid": "b94f6532-7e8f-484b-8d2e-c80eed54db2f", "comment": "Malware payload (AgentTesla)", "value": "783521b16ce02d97e48100f83c764150", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630880, "uuid": "4ec4c92e-8709-425e-8ea5-f9b23d2905d8", "comment": "Malware payload (AgentTesla)", "value": "b7ac4f2602d390462ae572aaf1a8d1eb6d15862dd3f65b7d0d03c8b925a32530", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630880, "uuid": "9054b434-bf3e-44db-b1d5-b33e1148c94c", "comment": "Malware payload (AgentTesla)", "value": "b62c51d83a20d98220ade683afe85077b775b4ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630880, "uuid": "6ee56340-3e4f-4a44-b1f1-0082e327bc8c", "comment": "Malware payload (AgentTesla)", "value": "1b16456142c80a4e6c2ddd33e19d797d5cdd3361309c61adff731b962b8f1fa91f7dc7daab98b1e13d565fee47cb5834", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630880, "uuid": "487265bf-1b41-4580-8297-ac01e528ee2d", "value": "FA1537802566A28DD0713ABDA13134E403B8EE27F8E54DD742AC7B22FDFF9115FA1925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630880, "uuid": "4504bc59-1753-435b-a42c-b0bf531c9339", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630880, "uuid": "720c0f0b-c3e3-42fe-8fa2-31599f694878", "value": "12288:MiKxeayECYte/gcym/08mHpxD2CzwxJ/IPneNeatoGopheas:HIeaPwgKmHjKSP+f5Eheas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630880, "uuid": "39b617f6-de90-4b09-88f0-2de0995cc7e0", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630880, "uuid": "e89aebca-c2ad-4e4b-a58f-37e519dfd7cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630880, "uuid": "74c2e3c0-3853-4067-aaa5-61e7c956dc7e", "value": "INV 3326GHF- from Outriger General Importers Korea for acknowledgment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbf03e4-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620637285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637285, "uuid": "67756fe2-e21c-44a7-88e1-d30ec4c5aecd", "comment": "Malware payload (Dridex)", "value": "ba957311cd6b72f263ef00b4df88fac3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637285, "uuid": "301943d6-8bfb-464e-aa33-0508c2fbcdc7", "comment": "Malware payload (Dridex)", "value": "b7b811676f23a7fdd0d83247dbed7c8f80dd2f3dcf32e94b129068139d90d9cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637285, "uuid": "38bdbdf9-db4b-4869-a7bf-bf98d04363f4", "comment": "Malware payload (Dridex)", "value": "aebc6a0ec689095f50ab792a8330e803b64a2138", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637285, "uuid": "6e7503ed-7383-4caf-b88e-314db585e16c", "comment": "Malware payload (Dridex)", "value": "ff7dc97b7f496c131baf8f8ce1ca4ac7f5312102ab1a0a74847618a78658ae32517c6a7ac564ff092ea1438d8ddb0ffb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637285, "uuid": "497fab7a-bc18-4340-ab45-fe5dcb1f443a", "value": "81F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637285, "uuid": "79a8f0c6-bfc5-4843-a4e3-a1e5080a18ba", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637285, "uuid": "2da2d8bf-dc6a-4e16-99e9-babf491725f2", "value": "3072:hWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:h42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637285, "uuid": "f921bcb4-1c9a-4a5f-ab66-e214e6c7c973", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637285, "uuid": "b234cd7a-aad9-4061-a86a-7a010878a47c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637285, "uuid": "a9fdb0b7-2811-432b-ad40-162f9e17d15a", "value": "ba957311_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146d1795-b13c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620615716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615716, "uuid": "4e74cb97-643a-4b98-bb90-361538d121df", "comment": "Malware payload (Dridex)", "value": "a3759056e245d5b1101e7390e5fd7608", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615716, "uuid": "0789e54d-e5c1-4ebf-9fe8-ba074f27ec04", "comment": "Malware payload (Dridex)", "value": "b7dd5938d39b8fbabee1eb9be529a597d3d71a99be8de2069bd3efab13113d50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615716, "uuid": "7650535e-5505-4793-b161-e3b566317379", "comment": "Malware payload (Dridex)", "value": "e4bab055b0d06486f6ec76df5cf233f5ea460505", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620615716, "uuid": "036ae41f-45f7-42c0-8ceb-4ea4aacf12c6", "comment": "Malware payload (Dridex)", "value": "b3750cb31d5719dcb10c3ffee43a54304441def3763f414bb1b46af2c105451a174da0aeb665698072a05a3866736669", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615716, "uuid": "1efdba23-c8bb-4087-99db-ad1e06980d2d", "value": "E9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615716, "uuid": "6371bb9f-6548-47ce-a808-7c664ae7a733", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615716, "uuid": "109617b6-d16f-4b3f-9bfe-3ef4b8e33823", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620615716, "uuid": "b3787d94-181a-44b2-adec-f19054c48bea", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620615716, "uuid": "ba40e74c-f83e-474a-9a27-e5ffd05e2dd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620615716, "uuid": "3cc71692-3082-4c93-9017-d5baf4dd2a8c", "value": "a3759056_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09bfc0f-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620666229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666229, "uuid": "f3f16ffa-506b-485f-a3d3-d82735a6e5a7", "comment": "Malware payload (Dridex)", "value": "1cd4a5813e53794c78509eb2e9078ba7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666229, "uuid": "d5796741-c67f-4785-bfd3-77b023099fe4", "comment": "Malware payload (Dridex)", "value": "b7e8c33f11cd64bcde066b117a4b4aa51207a1d383e9ccdcbaaeb0fe0d1a0237", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666229, "uuid": "e7a312d3-346c-4570-9eca-30dcdcf7029e", "comment": "Malware payload (Dridex)", "value": "2e7a94188255267101e04be4c49dad63800e149e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666229, "uuid": "7a4ca767-7677-48bb-b0dc-3a3c16c70e5b", "comment": "Malware payload (Dridex)", "value": "4fc1e3ad4c92700bb743dbeac0993cc63ced76a37fcc80db1f17f3f494ba69995555189420ce69e5bc77546f9d3eb610", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666229, "uuid": "9179bbc3-4195-4452-ad64-3720e0db4215", "value": "B2F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666229, "uuid": "a98a233f-ece4-4208-9f5c-5d08300f6759", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666229, "uuid": "aef7bef8-51e1-46d4-a196-a4055fdfe83d", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666229, "uuid": "d3b2c9a1-ae09-4094-8c93-c91d85127403", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666229, "uuid": "d9b5307a-e918-464d-9043-b97b1142b9ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666229, "uuid": "8f4e121a-c102-46e8-9846-af4fc74d4818", "value": "1cd4a581_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5972bbcb-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620651909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651909, "uuid": "7af0b757-dc64-4d44-9d77-b05dfc862724", "comment": "Malware payload (NanoCore)", "value": "ff05771c412b0887cf9cbe111afd55c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651909, "uuid": "a0b19ff3-326a-4e73-95be-a2ec5bb3b95a", "comment": "Malware payload (NanoCore)", "value": "b7f622992848e96745a6afdd8feaffce161b7e2d73d3b8d179d8e3a683026220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651909, "uuid": "0d82d2f5-b8a2-43fc-99ff-0b3afd7027fa", "comment": "Malware payload (NanoCore)", "value": "159bdaf0f571612e804f3435442b5ef4f43391e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651909, "uuid": "bec1e92c-b276-4934-bf38-8bb62fd689d4", "comment": "Malware payload (NanoCore)", "value": "8b4146ee85a1c424f258d4da5e812c4d3c4ff3327746c1ffe03867271ea84672d9df865a46fdf9476cd0c222ccbecf26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651909, "uuid": "2ba7e854-b7e0-420a-acf1-e83ddcb99856", "value": "7C35E0282AE58845EEBD46BC8871407552FABD522812FB5E0EF13DD83D33741DE13AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651909, "uuid": "5cdf1227-e6d6-4712-b002-b9f2ff1fe64a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651909, "uuid": "601f1391-88c0-4b4c-a825-8d6c189913c4", "value": "24576:WS3cFrG38ndhwpOJXT51dIdxrDWj5r4zjT:WS4G38nJXLsDWj5r4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651909, "uuid": "f6e041ad-284e-471d-81a2-0697a6d341ce", "value": 1148416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651909, "uuid": "466440c8-794e-4ffe-a494-97e3af2f0e91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651909, "uuid": "04337127-e09b-45ee-8820-b05757d9b08e", "value": "ff05771c412b0887cf9cbe111afd55c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fda58a-b1df-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620685730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685730, "uuid": "0e4c3f65-c7f8-4cc9-8065-a1ce1fb680a9", "comment": "Malware payload", "value": "6aac55508524706f94cd73c7c9bd425c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685730, "uuid": "d1e1e1a7-995b-43d6-addc-9cb33b00ab48", "comment": "Malware payload", "value": "b7fec820b7ce27f6e4dba3f71dff5b491bbb1e094945d6c505f1d5d0a018e86c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685730, "uuid": "81ca7d14-0fec-428d-8618-938480e30571", "comment": "Malware payload", "value": "7101ae50f66be7136a65ce0a24bd50b130a5f35e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620685730, "uuid": "77e95200-70de-4b65-9a87-2a557e72c629", "comment": "Malware payload", "value": "4e3b2bf30872481880f19dc30a975a0ed4c236bc1a485f2f0e2c123de8adce80b742d778f42a09d0f424bb7907d5dd1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685730, "uuid": "ef5d9e1a-fb2b-4611-9fc1-ad7258b9b673", "value": "72B31A35E9545B19C2E232FAF78D014E3E131FEFE3EA30259930BB5413F5A960A76921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685730, "uuid": "bb2c01b1-161e-4976-8865-c77f1ff1ab95", "value": "1536:y/nV+UK3bdfKqhft537ZTcXanE5u24G02l+yogiq7aC5qjl9Y7OUdImq:CKfrdTcXanE5u2qE7aC5qp9+dImq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620685730, "uuid": "41d21f35-d486-4c4a-b6f3-9bb17e2683ad", "value": 111724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620685730, "uuid": "396ba2c5-4df5-474f-a2d8-592f1f3f1b1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620685730, "uuid": "e13526b5-dd21-4ccf-8b6d-87cc644e1724", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361fb438-b1a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620662158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662158, "uuid": "31ce5798-6d9e-4528-94e5-54d4bb3f736e", "comment": "Malware payload", "value": "d01af12fa36549aace2543869ad91a74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662158, "uuid": "3d0a5da2-ee68-41fe-b015-765809b02546", "comment": "Malware payload", "value": "b825093ff0b31f95484f6741daf71fefc164497b871e01e534ab619696f99aed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662158, "uuid": "d66f6c22-56c6-4a49-82da-983391582ac8", "comment": "Malware payload", "value": "67cfa9a612eb8ab579e7a9185452e2640266af28", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620662158, "uuid": "fe195358-a619-4ce2-b794-80540bb3499d", "comment": "Malware payload", "value": "2fdce842bcbf21b0d03b2b49a7eb79fec796b61cb33783f00a8521a7e41b545a504f536f74ffab497d58f49103974e4c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662158, "uuid": "806de911-41ea-481a-83c4-bbf4c46382fb", "value": "ED815132E18708BAFF9E8EBC5DD7852E23AE2AC117610AB7139040891DD4DE7F534B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662158, "uuid": "3219f2b7-7850-4d3a-99d3-65f51511f9d2", "value": "fedf9f199dde0fdb7192322e063acd1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662158, "uuid": "fd4c0b8f-96ce-422a-9faf-563511ca9536", "value": "48:Sl2n1ASkT3Jd95Ei4T1W9w0qCSP3ShdP79WqCM66dC2om/9rnt:3n1ASkP34iPWUyOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620662158, "uuid": "84d33503-8780-402a-a823-7f7cbe03200a", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620662158, "uuid": "6cbd775f-9e5a-45ac-ace8-baa0b242aab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620662158, "uuid": "42524bea-3d69-4fad-a094-420e9cd3cac9", "value": "SecuriteInfo.com.Trojan.Win32.Injector.356654d6.11522.25838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46291308-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620644576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644576, "uuid": "ecbb8784-0d2b-4a23-b2c8-125636de91dc", "comment": "Malware payload (Dridex)", "value": "da0d5f9d43f8764a5f89f169175b3226", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644576, "uuid": "88a60587-8089-45e5-abe0-487ee5d1f081", "comment": "Malware payload (Dridex)", "value": "b8732f6e4a29d0aeec8ada0d58b1f2896344c308beb037b9c52ff10e6e8b8325", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644576, "uuid": "e741d0d2-308f-44bf-9598-e61fcdedd559", "comment": "Malware payload (Dridex)", "value": "d4a48a5e64080b78da8f310986f519f97d7300b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644576, "uuid": "59431f0e-b59b-4f17-9cd1-fa77c69b3a25", "comment": "Malware payload (Dridex)", "value": "1ca725f04c9dca3bb451c0a547dc4a661e576df729526e93a8aa5c00e0290bcf236ed77800d424f242d807e1999fd73b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644576, "uuid": "16caaef1-f318-4bf3-ab9b-029342015e51", "value": "B1F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644576, "uuid": "0a82c555-e92c-482b-9e89-b80599825a74", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644576, "uuid": "fe88d30e-eecb-4598-b7bc-949b769651cc", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644576, "uuid": "d4f7bf49-e763-4007-b44b-23c6ccc47613", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644576, "uuid": "dc876314-2c64-407a-9d88-8cb63f7e1096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644576, "uuid": "231ff602-1489-4376-9c02-8967de6b4aa2", "value": "da0d5f9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c034c572-b1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620687730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687730, "uuid": "2c5f0e70-66db-470b-a5b6-fabe423f85c7", "comment": "Malware payload (Dridex)", "value": "21283153bff623c4ac43d92a3e3fc826", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687730, "uuid": "81ed486d-55ee-4030-a4ed-2c9798eb9464", "comment": "Malware payload (Dridex)", "value": "b8a4a84ce38053b2bd31ba104117186a23e5526c410b2d550774e79deb0cc508", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687730, "uuid": "5f343571-128e-41a4-b6d8-a0de16650692", "comment": "Malware payload (Dridex)", "value": "7760e739f59c5f931fa59b2894b59921080a9be6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620687730, "uuid": "909df078-9b0d-4e10-a6e9-d1f78f5cd5e8", "comment": "Malware payload (Dridex)", "value": "a137b426b012fbc2ef182b16d39c92e93822190289637ea8d86c2352ef357655043d35cf6bfdd8ba7953c506b43b13fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687730, "uuid": "5e11fbc3-a6d9-49c7-8278-4cb494a90d08", "value": "9FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687730, "uuid": "e4d65ff2-640c-4b77-85e7-ece141148036", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687730, "uuid": "13d065ec-c94b-489b-b029-390ac0bb9aa6", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620687730, "uuid": "f8baa315-a543-4b35-832e-d764c120a33c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620687730, "uuid": "94be4e35-8e6b-4fc4-bdde-ce5920ef38a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620687730, "uuid": "7cbc9af9-cc7f-43ed-9791-3a14facdcdf3", "value": "21283153_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53b25c7-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620625059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625059, "uuid": "7a1573c4-a40f-4268-8b75-d65ff7cd6d15", "comment": "Malware payload (SnakeKeylogger)", "value": "3538d79d8bed7aaeeb0c1158d2c88c35", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625059, "uuid": "c47b6e3c-7d95-4db0-903a-5b1471791321", "comment": "Malware payload (SnakeKeylogger)", "value": "b8ad65064b956e9d15c5660dd52c9a17374f5023acf0e79722f5b05527b861e6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625059, "uuid": "42b1ceac-e75b-4ae2-bce1-d58414cf7347", "comment": "Malware payload (SnakeKeylogger)", "value": "35ff92b2ee1849dc7b61a0639aadc8136e247225", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620625059, "uuid": "fc70d619-2701-40d7-826c-4ab73af1c161", "comment": "Malware payload (SnakeKeylogger)", "value": "934d104d70407e75e492d60eee244f1bdff45cf9d4708317efa19b38e10bebd87d8a7b530ea4d9919c3eb49c6e8f6c3c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625059, "uuid": "77b11993-d646-4231-b2b4-b2e97194c0f1", "value": "81B4231234D36C1FC1F5AE3F65D2F8179091F1D03E76A1914DE6473278BEAE0A2A4C61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625059, "uuid": "a08d3b4f-e029-4439-9f65-110b512a338b", "value": "12288:dZuzX35h8BySQyfRqNhaj4L2LbqWgoF9TLT3HbbtPtNr:vub3PTpARqNQj4kbqWgKLTLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620625059, "uuid": "86f08fb7-e079-4a50-a45c-e0696e3e0e65", "value": 541790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620625059, "uuid": "8be6e277-65c5-4385-9ee0-311415adc5ed", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620625059, "uuid": "2b6fd7d8-0558-468f-9d1b-95d679ef7e21", "value": "BL and debit note.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b1ccbe-b1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620684068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684068, "uuid": "ce2364df-7fe3-47f0-9ac6-02427d04698a", "comment": "Malware payload (Dridex)", "value": "a4480447e77cc75265380f650984c345", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684068, "uuid": "3ae26ec9-eb1a-4819-8617-176006c760bc", "comment": "Malware payload (Dridex)", "value": "b8d9bf03592e220455ec1344c8bb5d0b8ca6eddb8f7cf90390b77eb41f00bf45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684068, "uuid": "c860a131-2039-4251-af92-9b841091cdba", "comment": "Malware payload (Dridex)", "value": "d74a28b3cbed652c910f3b5124a5ce9447512e39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620684068, "uuid": "a4a2513f-f1cd-4128-a465-d7e68e89832e", "comment": "Malware payload (Dridex)", "value": "301a5d84079777f934bcbda43e475b4564c11d89c4b0c25f5e68f9c13960f7fd3324c01a8d4622084d56fa710281f43a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684068, "uuid": "35f5af2b-d23b-412f-92fb-facf2ed4768e", "value": "91F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684068, "uuid": "b5c884c3-26e6-4e9e-807f-17ebee723e23", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684068, "uuid": "501dcd4c-180c-443f-8eb2-58b1c450799a", "value": "3072:aiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ZeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620684068, "uuid": "9ef2c4ac-dfc6-4d9e-9862-b6cf418e4e91", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620684068, "uuid": "1cc45f3c-9397-4e2d-899c-895f37682e38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620684068, "uuid": "c664c65d-612a-4bfd-b4a4-7ca85e9b9558", "value": "a4480447_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7af3d4-b1b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620669769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669769, "uuid": "4584d33b-0e45-4df3-a0d3-07ab30b9544e", "comment": "Malware payload (Dridex)", "value": "9a9949a7c86e04584fca764e72781588", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669769, "uuid": "c785c2de-41b1-4413-80e5-75b5c9974e41", "comment": "Malware payload (Dridex)", "value": "b90622a00a4e8f3d9347eb3f8db50d3797237a26930da1f0275b8a31f274e407", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669769, "uuid": "b33531e8-9963-4ddc-a1dd-b3fd8704c148", "comment": "Malware payload (Dridex)", "value": "89f7eab0f8f0500966d46fe32e40ee82b604960b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620669769, "uuid": "5e2dc983-b05d-4422-af5c-3e8ddd7b145e", "comment": "Malware payload (Dridex)", "value": "5d79eb301e1854037ec34bd3f425d433852f3e789825fb8461070ccfdecaf376052b5e8f83019e646b0dda72459299a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669769, "uuid": "09f4f736-a59c-4d69-9447-0e41a2105182", "value": "91F3D00FD94ADFC3E7F21C3284EEB26E7A98D12A4D20E2D77960E52E5267D6901344D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669769, "uuid": "c2e7ca6a-66e8-4bd0-ac2b-9fcc869e58a9", "value": "35893a758d71a4b313745582f88cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669769, "uuid": "293f4d28-1d3f-4789-9857-a751e0f1e824", "value": "3072:0/FbrEzD9N+RiMB00c9/74DXE+JgaV7IPx+e6O/pPtaLYM:+brE1kvcB74DXZ2Mel5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620669769, "uuid": "abaff6af-e58d-431a-a68c-b5ffa121fe47", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620669769, "uuid": "788ee555-09e5-492e-b356-5910210ca76e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620669769, "uuid": "5c992350-f5af-4b47-9ce5-ead3eb05ebad", "value": "9a9949a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb37f18-b18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620650766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650766, "uuid": "7c1d174c-cdb1-42c0-8525-8566486501b1", "comment": "Malware payload (AgentTesla)", "value": "aa30ea82ad02d8cb090fb767751c136a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650766, "uuid": "02f5348e-0f20-4115-b855-e0266786469c", "comment": "Malware payload (AgentTesla)", "value": "b93e9615ade2df86673292ad4f8f9cfd90021e39bef85d227f23f18330534856", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650766, "uuid": "29095eaa-9493-4708-83ec-ad01093f3766", "comment": "Malware payload (AgentTesla)", "value": "9ff7d3c4848aae0908e2e8e835eb358c163476b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620650766, "uuid": "e6ba381f-21ec-49b5-b2c1-af854b46423f", "comment": "Malware payload (AgentTesla)", "value": "5b1a919b6bbaa5eabf282dfe1efca0e6c44dcb3537cd71a74d47e2e1de876599ca741fc328c9374cb271517f1c5214d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650766, "uuid": "fb789b07-0af0-4fae-8caf-955e2a6e423c", "value": "3D15AF887644B59FC81B8E32C9649C30A6117C67C31BD707A4CF39AABD7E597EE050B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650766, "uuid": "1c3c7d08-217c-4902-93b0-e999ba340118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650766, "uuid": "edd2408d-2976-4691-80e3-705712dc2e5e", "value": "24576:KfHARQVipJZp0RTy8ZJy+MXOU0/xi/L6PnCnir:zcipJYZ6XGZi/L6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620650766, "uuid": "acfef1ee-4876-4ea4-ac6b-4e4d24b069fb", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620650766, "uuid": "68e92ed7-397d-4c01-b3c9-3211b33f18a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620650766, "uuid": "bb82bbeb-9a9c-4d71-8eaa-7daf1ef07709", "value": "Detailed File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1186504-b1b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620666203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666203, "uuid": "a94e4e6c-8064-4fb8-a4ad-456d8c6b0a43", "comment": "Malware payload", "value": "950855b20d993acd341e87feaa208037", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666203, "uuid": "aa129cec-5fc1-457d-b306-922595ea58c6", "comment": "Malware payload", "value": "b96965d845c925b8dc0f3e4279ad4e571c1409891fee795bde704c5b1f063ce9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666203, "uuid": "f8b4a457-85e9-4197-8292-348423156900", "comment": "Malware payload", "value": "973f3a8ac29ad715ec649e9785738f60fe0a2d48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620666203, "uuid": "783096d1-18ed-43d5-aec8-85eea964c2d5", "comment": "Malware payload", "value": "de27eb816c1a2d158086db2a037791b3979871beee518e4bc2dc895e12ceab2de950102da64d360cad044722383541bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666203, "uuid": "2d6e1973-4c59-4236-8110-1e325acfb014", "value": "760383E2B282DC15DA4807764DEBD6E66772BC515F57838B3288F31E1FB1AC08A03617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666203, "uuid": "105d5f4f-9c7b-46d9-9f41-7a7edda627d3", "value": "768:Zck3hOdsylKlgryzc4bNhZFGzE+cL2knAJ0OiCgI02z7ypmT1OhdngKzZ3W8m:ek3hOdsylKlgryzc4bNhZFGzE+cL2kn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620666203, "uuid": "22fd713b-b31f-44e0-b974-b829fd9dad3f", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620666203, "uuid": "b8c0970a-c422-4336-9697-76d7a003d7df", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620666203, "uuid": "3b77655e-2b41-44f0-950a-70510ba36735", "value": "950855b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3f5865-b190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620651911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651911, "uuid": "87aa0bca-bf0a-4ceb-8117-9a92ef6a3284", "comment": "Malware payload (Dridex)", "value": "8f93d2586cc6017b1ddb3b64a465feb0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651911, "uuid": "8c060641-6c7c-4998-b191-35247f08a6a5", "comment": "Malware payload (Dridex)", "value": "b977bcb2dab17fff255c3ff9deb64adfa854ab481e60590201e7d0e42ead155c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651911, "uuid": "d1008e02-e537-4c6f-b55c-dfd87524df21", "comment": "Malware payload (Dridex)", "value": "ab13e631bfae2dbabc1d3834931a0045f74c9c2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620651911, "uuid": "c7e94480-6490-49a6-9065-f8c9c8df3974", "comment": "Malware payload (Dridex)", "value": "8ea99d1e29d3ecb330c74c0b171dad0e04b48bc2357743efd3c4b24fdb3211defb796ada2c642e7767032a2b5a135e9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651911, "uuid": "113760c5-6afe-4a5a-bd23-dcf254719951", "value": "A3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651911, "uuid": "d3b34941-a52c-4d5a-bcff-d01b9334d3de", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651911, "uuid": "0b6dac07-f997-4a8b-8afb-8f503ec5c416", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620651911, "uuid": "e422262f-16fe-434f-97a0-dbd08d5eebe6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620651911, "uuid": "50d0ee03-c405-4c08-beaa-6663e551ac3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620651911, "uuid": "c9dc4199-d0c9-46ce-9074-132e59fa1c34", "value": "8f93d258_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd752516-b15e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620630656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630656, "uuid": "2f912f7c-8969-4fbc-9146-206c57307566", "comment": "Malware payload (AgentTesla)", "value": "bcfdcb33edc65825864ea464eb7fb906", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630656, "uuid": "56720f45-1945-4dfd-a475-adf2d6651a2d", "comment": "Malware payload (AgentTesla)", "value": "b98a83499e18ce217da8afce3b57ab9118afe955893b80c9dae5d96d1ce20f2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630656, "uuid": "8900fbef-027d-4ecb-bc13-b989bd28b692", "comment": "Malware payload (AgentTesla)", "value": "a5793c08cad19ae08fe801417ebabc3c6aaca9a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620630656, "uuid": "1783c64a-5976-48c4-a57f-9dc1d854e235", "comment": "Malware payload (AgentTesla)", "value": "9e0e0fca0da51565d0e9cce688782c05fb60857bd8ddd7d5ace9ce366b307041bac2955db23d7f3a2f3bb61802731d5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630656, "uuid": "2f246187-28a2-4c67-b84f-fcf7ee3b2747", "value": "40E4CF253398AF56E43E67391170110023F2BE07D721DA5D7DF6B4DA8AB2F818627B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630656, "uuid": "57d408fe-3d1a-434a-8e3a-f01a626c971f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630656, "uuid": "fda5d86d-facf-4a6a-ba56-54f80cf9a51a", "value": "12288:WF95m7mMDRNsBNzx0qe7+0TZccbMt6AjN7uxdiKb:WF95CmsRNsBJqqe7+D5R6xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620630656, "uuid": "59b1925f-9681-4890-8dfa-e371ef747131", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620630656, "uuid": "aa762071-9c40-4ba5-9eae-c92cdebb281d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620630656, "uuid": "f97ab20a-22e1-4fb3-991f-9b02228dbc72", "value": "RFQ-MS GCPL 3031 DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4bca71-b16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620637263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637263, "uuid": "c63f9fe5-8991-4f75-800e-0fe9efc0a3d6", "comment": "Malware payload (Loki)", "value": "8a79707bc08b4058b8e07d3e33f5648c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637263, "uuid": "6df07bfd-ac30-4cb4-a055-56d87293a553", "comment": "Malware payload (Loki)", "value": "b9ffcca5ddbfb668e0e6c16bb7ffb776786279c49bc2a9765aff08efe915d0f9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637263, "uuid": "f95d3c49-7e97-4290-a2be-0edd0b4c8e3e", "comment": "Malware payload (Loki)", "value": "4f14b852778d32b5a52a73e44ec426ad8637fe34", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620637263, "uuid": "23b408b2-7f67-41d4-8ed3-dfde3329925c", "comment": "Malware payload (Loki)", "value": "c86e76e3f6649402d16db38b56807a706792c51c2f5067ba90af39955d902c88d3c98425aea21c37c59b26bf718183ed", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637263, "uuid": "a226c653-1ee7-49a6-b18b-f2d6a5daadff", "value": "E1053335674544D38DA4CAF731B563FFDE58A89F4608F39BE2001BB6DBA8C720A91436", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637263, "uuid": "b8266fec-27f9-48af-85f8-90d4e4dc8644", "value": "12288:qBuRnwvKpAJrklg9j4c5aClef8SBIPbL+J4hooom6kZNm1bqKMJn2tmftT:qIPer8gSeluubi6hfom6kKFq8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620637263, "uuid": "05a84a70-4723-4531-a6b1-5215e705081c", "value": 804615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620637263, "uuid": "0c9f88a6-d482-4a6e-9fc6-c882c19da72f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620637263, "uuid": "fccd2ce0-cbd9-46a4-96d5-2d1513b48d6f", "value": "8a79707b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9861405-b1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620673653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673653, "uuid": "0607aac0-187a-4751-a791-552ffa610f40", "comment": "Malware payload (Dridex)", "value": "f8071b6b2728bbfd2803a6bc61d8f634", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673653, "uuid": "3c7d706c-a61c-4f34-89f0-ad398aa8240c", "comment": "Malware payload (Dridex)", "value": "ba1d2f390787cd4e815b738e9edd7b46b15a55d82aa7dfa44f94951733c795fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673653, "uuid": "75001c6f-9b9d-44cf-b33b-8cbe6d368a24", "comment": "Malware payload (Dridex)", "value": "fc84bc7c87ca3bd351f10cc7bd9148b4d735e867", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620673653, "uuid": "d39845c0-0b28-48d3-8714-38a4a4645c1a", "comment": "Malware payload (Dridex)", "value": "ab4799e0d7c0ef853162ceb6f9ee577ca29ce5fdede63073c911f3d44e409f3d6adbf68922d4b239ae45c268ad62825d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673653, "uuid": "7436a29d-21a0-4555-ad15-625b279ab7c4", "value": "28F3D0906A9BDF0ED9C13CF96AD6A879B073458D811FDAB4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673653, "uuid": "83479d5b-a8d8-4c12-8485-bd54ac7ac8bd", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673653, "uuid": "81bf51b6-46ac-487c-a669-9247ab066428", "value": "3072:2esl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLHB:Y4+VZQpt5hyPsa1ekiEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620673653, "uuid": "cd0f5fb0-4a6f-4253-8af8-9c7a4aa64dba", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620673653, "uuid": "587065bb-7936-4ab3-9bb8-487580ef55cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620673653, "uuid": "43e03123-6f22-4c7d-a0dc-394da005df0b", "value": "f8071b6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52627e26-b17f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620644596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644596, "uuid": "cc77cb8a-f39f-4cf4-ac0f-006145656187", "comment": "Malware payload (RemcosRAT)", "value": "5a96079fd1ed632e3afa017e210518a5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644596, "uuid": "38ea75e8-85f6-41f9-88bf-917eac7146b0", "comment": "Malware payload (RemcosRAT)", "value": "ba743ef93625025018dfc47978452d19503cee81e2adc2cd71ac0a173b3e2513", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644596, "uuid": "9788e23d-42db-4da7-b818-cd8b2152e4fb", "comment": "Malware payload (RemcosRAT)", "value": "b62b48677bdf7ae841d7aff5d2053e268ec679e0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620644596, "uuid": "2c9b0116-2b1b-4666-83b6-0d9ae3487f9c", "comment": "Malware payload (RemcosRAT)", "value": "7cdafe0f54026d0f6a2374da4d8f88c1bf8c18485879b12abe0f6af3ed313bbd68c575fc9efb9da6358714a8ce3f4087", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644596, "uuid": "9a250848-9566-475f-9f88-81f5e9c521ee", "value": "AFF49D22B2D04873D0AE1E3C9C5BF27158257E642DE8907A6BF479485F7B3913C2D29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644596, "uuid": "dfd88fd3-4137-4187-ad24-4865fd29fe81", "value": "6b3ae8f7a807e67f6fac520b10e5dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644596, "uuid": "a1292df6-7802-41a0-a214-a8ad58923365", "value": "12288:8rnWDrl98a7LUacm7sbiD97T5QM4Pr4rvU/Oy/:8rWnZnUivR71B48rvUD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620644596, "uuid": "e1e2343b-1fa7-4a8a-ba7c-834472820b0a", "value": 738968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620644596, "uuid": "7eb9afd4-9411-4764-88d9-f5753797d9d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620644596, "uuid": "7013b646-8018-4aa2-af5f-8de4fbc76ad3", "value": "5a96079f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de13408e-b19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620657715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657715, "uuid": "87be7f6c-043c-408d-aed2-f32a36f4eb90", "comment": "Malware payload (Loki)", "value": "de4611725a8082434c9cf76e83e43f78", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657715, "uuid": "23564ea8-1205-4b37-8d71-2c8aae10ee70", "comment": "Malware payload (Loki)", "value": "ba8d833ca8718a927d482316c7c09bc1381c666ce15ebaca13377e556143da23", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657715, "uuid": "bcbca1b3-10a7-4c5d-846d-14570b87399b", "comment": "Malware payload (Loki)", "value": "b5b5389f16546679c63a1c3adebbed627f00c895", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620657715, "uuid": "3fb9d5ca-9a2e-4234-8577-60a4c2e95aea", "comment": "Malware payload (Loki)", "value": "c1afe529cc7c7cb57b7585d9a6bbe919de68f44d869151af1cf9957166050b2f8afc790089d6412b9200121f21db4d7e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657715, "uuid": "9e8bb519-62e2-46a5-b95e-6eedb8af6201", "value": "EDC42371F80769632A307D92D9B2693C1D540674DAFE32531E92C1BB54EC206FEF89AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657715, "uuid": "236b1942-aeba-4f13-9cd8-b1c8a6add77b", "value": "12288:4ilhJ1wWlNSFEMcxoUW5FGV2BPm4NgO70aqE8eW:4ilhJ11lzpmFGkBm4NgOYazk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620657715, "uuid": "2b4aa99a-2b5b-47b8-8d13-4c253d39fe05", "value": 569177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620657715, "uuid": "c0d86072-b722-45ee-bb9d-f77eab88983e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620657715, "uuid": "260fe8b6-c1f2-45e0-ad81-3c1ccf8b2ef8", "value": "Swift Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afff28c-b151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620624881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624881, "uuid": "2a90ccf2-307a-4581-819d-30571d414874", "comment": "Malware payload (AgentTesla)", "value": "a741742751871447b0da46ee0ca33901", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624881, "uuid": "c9730555-38df-468c-8015-8e4e6d20d8a5", "comment": "Malware payload (AgentTesla)", "value": "bab94c5d73ea22cdc44f5b1a838647af4f6f187616bb8d49d018bafb18b9e0b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624881, "uuid": "7a63be66-6325-4738-860e-e1547339d405", "comment": "Malware payload (AgentTesla)", "value": "1d231abcacb3e2a29cc7f8c42c01f8ca4426c24b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620624881, "uuid": "4fb8e3a9-76ba-46a9-9de7-ac7eb1287b97", "comment": "Malware payload (AgentTesla)", "value": "02fa2cb4b4cd89d132a5a324a7b02cba7bd2b0f742d844c21788b3d32312f19c202749ab5a44b68584f5bb6d7be6b14c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624881, "uuid": "e4473a93-8db7-4f06-b9b4-4fb3e57907bc", "value": "F5F4D0203BD8AA58D5BF97762970D14023F2BA17D732C74E698DA14E1E31742CBB2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624881, "uuid": "3b2b6a06-526f-45ef-89ad-89bc51b843cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624881, "uuid": "53fe1702-352f-4fcd-814e-9119a28670b5", "value": "24576:myzAX3PGhhhQb7+c7GoIH0NBn65kf5k2s:JzAX3n3q1H0NB6qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620624881, "uuid": "80600546-84cf-4783-8e1a-30f3fdf123d7", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620624881, "uuid": "d6ab3006-83ba-4cbd-911c-2223fcc37c3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620624881, "uuid": "188f5cf6-3243-4d5b-aad8-d2d6fa2c4afb", "value": "HBL-20210510 INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00de6b24-b1d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620680537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680537, "uuid": "23370a8d-20a2-4a30-a340-207678aefb05", "comment": "Malware payload (Dridex)", "value": "a09c1105c0728f7f42ceff794b391242", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680537, "uuid": "bb9795ae-5a6d-4452-87ac-faa0e809ed6c", "comment": "Malware payload (Dridex)", "value": "baf2acd85307d59b603d38be7110b4aafe6e421c62f7fc846bc79b80b522b4d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680537, "uuid": "8ad0d684-fc24-4301-a55e-59398687859f", "comment": "Malware payload (Dridex)", "value": "929b29492fc90240ce19f30878fb30548340bb39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620680537, "uuid": "609ad159-ec54-4581-9040-ab3dfa357eac", "comment": "Malware payload (Dridex)", "value": "e5e4b7cbaddb03b6c5cc2d6a25bb5100e2b0e8a4dbd846aa10bb18a2baa692c408909339e4bbfdd4fec46ecd1d28f18a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh",